标签：#ki

Memory is not a log. It is a story rewritten after you learn how it ended. You will remember being less certain than you were. You will remember seeing the risk you missed. That is not dishonesty. That is how remembering works. Which is why you cannot learn judgment from memory alone. The correction is unglamorous. Before the decision, write down what you expect. Not a plan. A prediction. We are choosing this because we believe that. We think it takes three weeks. We think the load arrives by March. If it does not, we were wrong about the growth, not about the design. Four lines. A date. Somewhere you will find it again. Add the number you least want to write. How sure are you. Seven out of ten is a real answer. Certain is almost never a real answer, and writing it down makes you notice how often you reach for it. Then set a time to come back. The value is not in the writing. It is in the reading, six months on, when the outcome is known and the note is not. You find out something nobody else can tell you. Whether you run early or you run late. Whether your confident calls land better than your hesitant ones. Whether you are wrong about people more often than you are wrong about systems. That is calibration. It is the whole difference between ten years of experience and one year lived ten times. It changes rooms, too. A review where somebody can produce what they actually believed in March is a different meeting from one where everyone remembers agreeing. Hindsight makes us unfair in a peculiar direction. It makes the past look obvious, and the people standing in it look careless. They were not careless. They were standing exactly where you are, with less information and no ending. So write down where you are standing. Your future self will not be able to reconstruct it, and your future self is the one who has to get better. – Serguey Asael Shinder

Vulcan oven mitts, spaceship baking dishes, and an out-of-this-world communicator grater—you'll need warp speed to Klingon to this limited edition kitchen kit, ideal for perfecting the broth of Khan.

Even though networking fundamentals are often taught at the early stages of a tech career, their relevance becomes far more important when you begin working with distributed IoT and edge-driven architectures. Concepts like subnetting, routing, NAT, DNS, firewalls, and VPNs evolve from simple textbook ideas into core architectural tools that determine how devices communicate, how secure the system remains, and how reliably data moves between the edge and the cloud. This refresher looks at these fundamentals from the perspective of someone building and supporting real IoT and edge environments. The goal is not to re-teach the basics, but to reconnect them with the realities of large-scale, low-power, and cloud-connected systems. 1. Subnetting as the Backbone of IoT Network Segmentation Subnetting plays a much bigger role in IoT and edge-driven environments than most people realize. In traditional networking, subnets help organize traffic and reduce broadcast noise. In IoT, they become a core part of the system architecture. When you’re dealing with sensors, gateways, and edge compute nodes running side by side, the network must be segmented in a way that keeps each function secure and predictable. A typical LoRaWAN setup shows this clearly. The gateway LAN, the packet-forwarder network, and the edge analytics node usually sit in different subnets. This separation allows you to apply strict ACLs around what each component can communicate with, especially because IoT devices often have limited security controls of their own. Subnetting also helps manage traffic flow, ensuring that noisy sensor broadcasts don’t interfere with time-sensitive edge workloads. Beyond security, good subnet design improves fault isolation. If a node misbehaves, the impact is contained within its segment. This structure also supports multi-tenant IoT deployments, where different applications or departments share the same physical infrastructure without touching each other’s data paths. In short

Every messenger you use has a hidden dependency: a working network path to a datacenter. Drop into a basement, a packed stadium, a moving train through a tunnel, an exam hall with jammers, or a remote area with no plan, and the app is just a spinner. The people you want to reach are often standing a few meters away, but your message still has to travel to a server on another continent and back. When that path is gone, so is the app. Kabootar is my attempt to remove that dependency entirely. It is a messenger with no backend at all. Your phone forms a peer-to-peer mesh with other phones nearby, and messages hop device to device over Bluetooth and Wi-Fi until they reach the recipient. No internet, no servers, no SIM. It is built in Flutter, and the routing core is plain Dart. The core idea: delay-tolerant networking The insight that makes this work is refusing to assume the recipient is reachable right now . Normal networking is connection-oriented: open a path end to end, then send. If there is no path, there is no delivery. Kabootar instead treats the network as a delay-tolerant network (DTN). A message does not need a live end-to-end path at the moment you hit send. It needs a chain of carriers that will exist over time . You hand your message to whoever is nearby. They hold onto it, carry it as they walk around, and pass it along to the next phone they meet. Eventually a carrier bumps into the recipient and the message lands, even if that is minutes later and both you and the recipient have long since walked away. This is store-and-forward, the same shape as a durable, at-least-once message queue, except the queue is running across a swarm of phones instead of inside a datacenter. How a message actually travels The routing strategy is epidemic routing: flooding. When you send a message, it spreads to everyone in range like a rumor. Each device that receives it re-broadcasts it onward, so the message replicates through the crowd, taking every path at once. That red

If your AWS bill has a NAT Gateway line, you are paying twice for the same packet: once for the gateway to merely exist, and again for every gigabyte it carries. The fix for most teams is dull and free. Add an S3 and a DynamoDB gateway endpoint, route the heavy traffic away from NAT, and only then argue about anything fancier. That single change is free to turn on, takes minutes, and stops the most expensive traffic from ever touching the meter. This is a playbook, not a lecture. The trick with NAT Gateway pricing is that the two charges hide in different places on the bill, so most teams only ever see half of it. Numbers first, then the fixes, in the order I would actually do them. What you are actually being charged for NAT Gateway has two charges, and people forget the second one until they read the bill closely. Hourly charge — you pay for every hour the gateway is provisioned and available, whether or not a single byte moves through it. In us-east-1 (N. Virginia) and us-east-2 (Ohio) this is $0.045 per NAT Gateway-hour . That is roughly $32.85 a month per gateway just to keep the lights on. Partial hours bill as full hours. Data processing charge — you pay $0.045 per GB processed through the gateway, in the same region, on top of the hourly charge. This applies to every gigabyte, inbound or outbound, regardless of source or destination. And then there is the part the pricing page mentions almost in passing: standard AWS data transfer charges still apply on top. NAT processing is an extra meter on traffic you were already paying to move. The hourly charge is fixed and visible. The per-GB charge is the one that catches teams out, because it scales with traffic you mostly cannot see: package installs, container image pulls, S3 reads from private subnets, telemetry shipped out, cross-region calls. The rate varies by region (it runs higher in places like São Paulo, where both the hourly and per-GB rates sit around $0.093), so check your own region rather than trusti

Humanistic Architecture Learning to See Problems Differently I had the opportunity to attend a class called “Humanistic Architecture” by Mr. Chakrit Riddhagni. The class was about applying humanistic principles to software development . Before talking about what I learned, I would like to share a little about my own perspective on software development. Personally, I have a quote and a belief about software development: it is both a science and an art. I see software development as something that has an artistic side, while being grounded in logic, with almost endless possibilities. “Crafting software requires artistry, guided by imagination, grounded in logic, endlessly enduring.” This quote has been one of my inspirations since I started working as a developer. What I mean by this is that I have always liked thinking about software development as a kind of literature . We are not simply writing code. We are solving problems. We are developing and creating something to solve a problem that either we or our customers are facing. Because of this, as a developer, I naturally work with problems every day. But… I never really thought much deeper about what a “problem” actually is. Usually, when we solve a problem for a customer or develop software for them, we receive an issue or a scope of work and then start working on it. We know that something is a problem, so we focus on solving it. But we do not always stop and ask What is the actual structure of this problem ? Is this really the problem? And does the solution we are building actually address the problem we are trying to solve? That changed when I attended the “Humanistic Architecture” class. One of the biggest things I gained from this class was a new perspective and a set of tools for defining what a “problem” really is. Anatomy of a Problem We can look at a problem through the Anatomy of a Problem , which consists of three parts: Current State — where we are now Gap — the difference between where we are and wher

Adapted from my original Japanese article , with AI-assisted translation and editing. My manager: “Test this device.” (Doesn't really know the product or the technology.) Me: “Sure.” (Also doesn't really know the product or the technology.) If you've worked in infrastructure, that may sound familiar. I'm Goda, a network engineer sharing things I learned while figuring out the job. SNMP comes up in a lot of network device testing. For a while, my idea of an SNMP test was simple: Run snmpwalk . Watch a pile of OIDs and values scroll past. Mark SNMP as working. A screen full of output is reassuring. It certainly looks like something is being monitored. Then I was asked to write a test plan for a device. I added an item along the lines of “Confirm that information can be retrieved using SNMP” and sent it for review. The feedback was: Which OIDs will you use for CPU and memory? The customer will probably ask. You should at least cover those. That was when it clicked: a successful walk and successful retrieval of the metrics we need are two different things. My other thought was, “Fine, you write the test plan, then.” But the feedback was fair. Getting something back is not the same as getting what you need. What did the successful walk actually prove? snmpwalk is useful. Net-SNMP's tool uses GETNEXT requests to walk through a subtree starting from a specified OID. Net-SNMP manual If it successfully returns values, you've established that you could read those values under those test conditions . That matters. It does not, by itself, establish that your CPU and memory monitoring requirements are satisfied, or that every required OID is available. I had been treating a successful command as a much broader result than it actually was. Break “SNMP testing” into specific checks Today, I'd separate at least these questions: Question What to check Can I communicate over SNMP? Whether the device responds to the intended request under the defined conditions Can I monitor CPU? The

Yash K Saini — Engineer, building in public — AI/ML, low-level (Rust/C/C++), and open source. GitHub...

🇪🇸 Leer este post en Español I spent months watching my agent re-solve the exact same problems, over and over, because I never sat down and wrote them up once so anyone else could reuse them. That's the kind of technical debt nobody ever puts on a roadmap. So I published alpha-skills : eight installable Agent Skills and my first MCP server on npm . Where the published skills live The installable catalog lives in skills/ , split into three categories: external/ for third-party APIs, local/ for homelab and workflows, and general/ for cross-project utilities. All three are public: one skill in external/ , one in local/ , and six in general/ . local/ describes the use case. skills/ ├── external/ │ └── nextdns-api/SKILL.md ├── local/ │ └── progressive-search/SKILL.md └── general/ ├── agent-context-generator/SKILL.md ├── nestjs-iam-patterns/SKILL.md ├── nestjs-advanced-patterns/SKILL.md ├── nestjs-graphql/SKILL.md ├── tuning-claude-code/SKILL.md └── obsidian-second-brain/SKILL.md <DIAGRAM 02: 02-public-skills-structure-en.png> The eight skills Three categories: external/ for third-party services, local/ for homelab infrastructure and personal workflows, general/ for cross-cutting utilities that don't depend on any one service. Skill Category Use it for nextdns-api external NextDNS API progressive-search local Code and documentation search agent-context-generator general Project context nestjs-iam-patterns general Authentication and permissions nestjs-advanced-patterns general NestJS internals and architecture nestjs-graphql general Code-first and schema-first GraphQL tuning-claude-code general Claude Code configuration obsidian-second-brain general Note organization and review Each command installs one skill. Run the command for the one you need. 1. nextdns-api A full reference for the NextDNS REST API: profiles, security/privacy/parental-control settings, denylist and allowlist management, analytics, query logs. This is the one the MCP server below is built directly agai

🇺🇸 Read this post in English Llevo meses haciendo que mi agente resuelva los mismos problemas una y otra vez porque nunca me tomé el tiempo de escribirlos una sola vez, bien, y dejar que otros los reusaran. Ese es exactamente el tipo de deuda técnica que nadie pone en un roadmap. Así que publiqué alpha-skills : ocho Agent Skills instalables y mi primer servidor MCP en npm . Dónde están las skills publicadas El catálogo instalable vive en skills/ , separado en tres categorías: external/ para APIs de terceros, local/ para homelab y flujos de trabajo, y general/ para utilidades transversales. Las tres son públicas: una skill en external/ , una en local/ y seis en general/ . local/ describe su ámbito de uso. skills/ ├── external/ │ └── nextdns-api/SKILL.md ├── local/ │ └── progressive-search/SKILL.md └── general/ ├── agent-context-generator/SKILL.md ├── nestjs-iam-patterns/SKILL.md ├── nestjs-advanced-patterns/SKILL.md ├── nestjs-graphql/SKILL.md ├── tuning-claude-code/SKILL.md └── obsidian-second-brain/SKILL.md Las ocho skills Tres categorías: external/ para servicios de terceros, local/ para infraestructura de homelab y workflows propios, general/ para utilidades transversales que no dependen de ningún servicio en particular. Skill Categoría Para qué sirve nextdns-api external API de NextDNS progressive-search local Búsqueda de código y documentación agent-context-generator general Contexto de proyecto nestjs-iam-patterns general Autenticación y permisos nestjs-advanced-patterns general Internals y arquitectura de NestJS nestjs-graphql general GraphQL code-first y schema-first tuning-claude-code general Configuración de Claude Code obsidian-second-brain general Organización y revisión de notas Cada comando instala una skill. Ejecuta el de la que necesites. 1. nextdns-api Referencia completa de la API REST de NextDNS: perfiles, seguridad/privacidad/control parental, listas de bloqueo y permitidas, analíticas, logs de consultas. Es la que respalda al MCP server que desc

Plus: Tens of millions of US and Canadian drivers’ licenses go up for sale on the dark web, the US military finally tries to tackle the risk online ad data poses to troops, and more.

Ev Ağı Nasıl Çalışır? Bir ev ağını en basit haliyle şöyle düşünebiliriz: Internet │ ISP ağı │ Ev Router'ı │ ┌─────────────┼─────────────┐ │ │ │ Laptop Telefon NAS Ev router'ı burada iki farklı dünyayı birbirine bağlar: ISP üzerinden ulaştığı dış ağ ve evdeki cihazların bulunduğu yerel ağ. Bu basit topolojinin arkasında LAN, WAN, subnet, DHCP, routing, NAT, firewall, bridge ve VLAN gibi kavramlar birlikte çalışır. 1. Ev ağı, ISP ve internet tarafı LAN ve WAN LAN — Local Area Network , router'ın yerel ağ tarafıdır. Evdeki laptop, telefon, NAS, televizyon gibi cihazlar genellikle bu tarafta bulunur. Örneğin router'ın LAN adresi: 192.168.1.1/24 olsun. Cihazlar da: Laptop 192.168.1.20 Telefon 192.168.1.30 NAS 192.168.1.50 adreslerini kullanabilir. Bunların tamamı aynı: 192.168.1.0/24 yerel IP ağına aittir. WAN — Wide Area Network ise router'ın kendi yerel ağı dışındaki bir upstream ağa bağlandığı taraftır. Tipik bir evde: Internet / ISP │ WAN │ Router │ LAN │ Ev cihazları şeklinde görünür. LAN ve WAN, Ethernet kablosunun fiziksel türünü tanımlamaz. Aynı standart Ethernet bağlantısı bir router için LAN, başka bir router için WAN rolünde olabilir. Örneğin: Internet │ Upstream Router LAN: 192.168.1.1 │ │ Ethernet ▼ Downstream Router WAN: 192.168.1.50 LAN: 192.168.10.1 Buradaki 192.168.1.0/24 ağı: upstream router açısından LAN, downstream router açısından WAN tarafıdır. Dolayısıyla LAN ve WAN kavramları hangi router açısından baktığımıza göre anlam kazanır . Upstream ve downstream Ağda internet veya daha üstteki ağa doğru olan yön upstream , son kullanıcı cihazlarına doğru olan yön ise downstream olarak adlandırılır. Internet │ Upstream Router │ Downstream Router │ Laptop Downstream router'ın internete doğru bağlandığı router onun upstream router'ıdır. Bu terminoloji özellikle evde bir modem/router arkasına ikinci bir router bağlandığında kullanışlı hale gelir. ISP'nin rolü ISP — Internet Service Provider , ev ağını daha büyük internet altyapısına bağlayan servis sağlayıcıdı

When building an online game in Unity, the question is often framed as: Should I use Photon, Netcode for GameObjects, FishNet, or Mirror? That question is too small. In 2026, there is still no single networking product that is optimal for every Unity game. The real decision is a stack : transport, netcode, authority model, session management, server hosting, and backend services. For a GameObject-based action game that needs client prediction, Photon Fusion 2.1 is a strong first PoC baseline . If your priorities are Unity Gaming Services, DOTS/ECS, self-hosting, source access, or deterministic simulation, the starting point changes. This article explains how to make that decision in production terms: latency, cheating, reconnection, hosting, bandwidth, operations, and total cost. This article uses official documentation checked on August 31, 2026 as its factual baseline. SDK versions, pricing, licensing, and service availability can change, so re-check them before committing a production project. What I mean by a real-time multiplayer game The target is roughly this class of game: 2–32 players in the same session continuously synchronized players, enemies, projectiles, or interactable objects input latency that directly affects game feel reconnects, host loss, and late joining that must be handled co-op action, FPS/TPS, racing, or competitive action If you only need turn-based play, leaderboards, chat, friends, or asynchronous PvP, you may not need a sophisticated state-synchronization netcode at all. A backend such as Nakama, PlayFab, or Unity Gaming Services may be the more important part of the architecture. Do not treat “networking” as one product A production multiplayer stack has at least five layers. Layer Responsibility Examples Transport Packet delivery, reliability, connection path, secure channel integration Unity Transport, Photon transport, UDP/WebSocket-based transports Netcode Replication, RPCs, input, prediction, interpolation, rollback Fusion, NGO,

More than 200 people in roles such as engineering, finance, and communications will now be represented by the Communication Workers of America.

Gene-edited pig kidneys could offer a lifeline to patients stuck waiting for a human donor.

Amazon just hiked prices on Kindles, Echo speakers, Eero routers, and Fire TV devices ahead of the holiday shopping season.

Upgrading Juniper MX Networks from 100GbE to 400GbE: What Engineers Need to Know Moving a production network from 100 Gigabit Ethernet to 400 Gigabit Ethernet sounds simple on paper: Replace a 100G interface with a 400G interface and get four times the bandwidth. In a real carrier or data-center network, however, the interface is only one part of the equation. The router's forwarding silicon, switch fabric, midplane, power system, cooling, optics, software release, slot selection, redundancy configuration, and licensing can all determine whether the expected capacity is actually available. Juniper's MX240, MX480, and MX960 platforms provide an interesting example because these systems can be upgraded with newer generations of Modular Port Concentrators rather than requiring an immediate chassis replacement. One particularly useful case study is the Juniper MPC10E-15C , a Trio 5-based line card capable of supporting both 100GbE and 400GbE interfaces. This article isn't about whether you should buy a particular line card. Instead, we'll use the MPC10E-15C to examine the engineering questions that should be answered before attempting a 100G-to-400G upgrade on an existing Juniper MX network. Video Overview The video provides a short overview of the hardware. Below, we'll go deeper into the architecture and the deployment considerations that matter when integrating this class of line card into an existing MX environment. Why Moving from 100G to 400G Isn't Just a Port Upgrade Suppose an edge router has four heavily utilized 100GbE connections. At first glance, replacing those links with 400GbE interfaces appears straightforward. But consider what happens behind the physical port. Traffic entering that 400G interface must travel through several parts of the system: Interface → Packet Forwarding Engine → Fabric → Other line cards/interfaces Every component in that path needs sufficient capacity. A 400GbE optic connected to a router that cannot move 400 Gbps through its inte

Hello, I'm Maneshwar, and I'm building LiveReview — a blast-radius aware AI code review built for your business-critical systems. Star us to help devs discover the project, give it a try, and share your feedback to help improve the product. You open a video and it starts playing in about a second. Somewhere between your thumb and that first frame, your request crossed maybe fifteen different companies' equipment, possibly an ocean, and came back. Nobody coordinated it. That is the part I find genuinely strange about the internet, and it is the part most explanations skip. They tell you the internet is "a global network of networks", which is true and tells you nothing. So let's actually take it apart. There is no internet. There are 75,000 of them. The single most useful thing to understand up front: the internet is not a thing anyone built. It is roughly 75,000 independent networks that agreed on how to hand traffic to each other. Your ISP is one. Your university is one. Cloudflare is one. They own their own cables and routers, they answer to nobody in particular, and they interconnect voluntarily. Once you see it that way, every weird thing about the internet starts making sense. The whole arrangement has three parts: The edge is everything that actually wants to say something. Your phone, a laptop, a server in a rack, and increasingly a doorbell. These are called hosts or end systems , and they split roughly into clients that ask and servers that answer. The access network is your on-ramp. Fibre or cable at home, the office network, 5G from your pocket. Its only job is getting you to the first router. It is also, almost always, the slowest part of the entire journey, which is worth remembering next time you blame a website for being slow. The core is the mesh in the middle. Routers and the links between them, and nothing else. No control room, no master server, no company that owns it. Nobody reserved you a line Here is where the design gets clever. Before the in

This article provides a step by step comparison of three Gemma 4 deployments on a single AWS hosted GPU enabled system. A suite of Python MCP tools is built to simplify management of each deployment, and one benchmark harness is shared across all three so that the runtime is the only variable. https://github.com/xbill9/gemma4-dev The whole exercise cost under three dollars, and that is the part worth keeping. Nineteen instances and about four and a half instance-hours bought three serving sweeps, nine timed boots and a handful of A/B restarts. It also bought five wrong claims, each caught by measuring instead of reasoning. On hardware where a run is expensive, the cheapest of those five would have shipped with a caveat attached. What is this project trying to Do? Three rigs in this monorepo serve google/gemma-4-E2B-it on an AWS G5g instance. One runs vLLM, one runs a pure JAX port, one runs PyTorch with transformers. The hardware is identical and only the runtime slot moves, so this should be the cleanest A/B available. For months it was not, because each rig measured itself with its own harness and quoted its own number. Three harnesses computing three statistics is not a comparison. Prerequisites An AWS account with G-family quota in us-east-1 . Each g5g.2xlarge is 8 vCPU, so 16 vCPU of spot quota runs two at once. A subnet, a security group opening TCP 8000, and an instance profile carrying AmazonSSMManagedInstanceCore plus read on the Hugging Face token secret. A Hugging Face token in Secrets Manager. It is fetched at boot into a root-only EnvironmentFile and never appears in user data. boto3 and the standard credential chain. No AWS CLI shell-outs, no inbound SSH rule, and no private key anywhere in the flow. AWS EC2 G5g Instance g5g.2xlarge — 8 vCPU, 16 GiB host Host CPU AWS Graviton2, aarch64 GPU 1x NVIDIA T4G, Turing, SM 7.5 GPU memory 15,360 MiB per nvidia-smi ; AWS lists 16,384 nominal G5g is the only family AWS ships that puts an NVIDIA GPU behind a Gravi

This article provides a step by step comparison of three Gemma 4 deployments on a single AWS hosted GPU enabled system. A suite of Python MCP tools is built to simplify management of each deployment, and one benchmark harness is shared across all three so that the runtime is the only variable. https://github.com/xbill9/gemma4-dev The whole exercise cost under three dollars, and that is the part worth keeping. Nineteen instances and about four and a half instance-hours bought three serving sweeps, nine timed boots and a handful of A/B restarts. It also bought five wrong claims, each caught by measuring instead of reasoning. On hardware where a run is expensive, the cheapest of those five would have shipped with a caveat attached. What is this project trying to Do? Three rigs in this monorepo serve google/gemma-4-E2B-it on an AWS G5g instance. One runs vLLM, one runs a pure JAX port, one runs PyTorch with transformers. The hardware is identical and only the runtime slot moves, so this should be the cleanest A/B available. For months it was not, because each rig measured itself with its own harness and quoted its own number. Three harnesses computing three statistics is not a comparison. Prerequisites An AWS account with G-family quota in us-east-1 . Each g5g.2xlarge is 8 vCPU, so 16 vCPU of spot quota runs two at once. A subnet, a security group opening TCP 8000, and an instance profile carrying AmazonSSMManagedInstanceCore plus read on the Hugging Face token secret. A Hugging Face token in Secrets Manager. It is fetched at boot into a root-only EnvironmentFile and never appears in user data. boto3 and the standard credential chain. No AWS CLI shell-outs, no inbound SSH rule, and no private key anywhere in the flow. AWS EC2 G5g Instance g5g.2xlarge — 8 vCPU, 16 GiB host Host CPU AWS Graviton2, aarch64 GPU 1x NVIDIA T4G, Turing, SM 7.5 GPU memory 15,360 MiB per nvidia-smi ; AWS lists 16,384 nominal G5g is the only family AWS ships that puts an NVIDIA GPU behind a Gravi