标签：#ki

Tired of explaining the same things again and again to your AI Agent? Frustrated because the AI keeps forgetting minute things custom to your codebase which needs to be kept in mind in each change? This is the current scenario for most people using AI agents to build their software. You handoff a task to it, it gives back the solution but misses something. You explain that to it, it nods back and then does it again. I myself did it until i came to know about Skills. What are Skills? Remember the CONTRIBUTING.md file we find in almost every open source repository? The file which explained anyone coming to the repo what to check, understand and keep in mind when contributing to it so that you don’t break it. The Skills works like that for any AI Agent who is going to make changes in your codebase. Its a folder that your AI checks anytime it needs to perform a specific task, specialized jobs or multi-step workflows without requiring you to prompt every time. And the best thing is, it follows an open standard that works with almost every AI agent be it Claude Code, Cursor, Copilot and more. It follows a folder-based structure around a SKILL.md file containing YAML metadata about that skill and instructions for that in markdown. How to build a Skill? Skills can vary from simple instructions to multi-step workflows depending on your need and there are 3 ways (limited by my knowledge) to build a skill: Manually First you need to create a dedicated folder for your skill and place a SKILL.md file inside it. This file needs to have 2 things: YAML frontmatter for metadata( name & description ) Instructions in markdown. Below is a basic sample SKILL.md file for your reference: — - name: word-counter description: Counts the total number of words in a given text. — - Word Counter Instructions Take the user’s input text. Count the total number of words. Return only the final word count as a number. Using a generator/CLI It is a tooling interface (command-line or script) which can

Networking terms can feel like alphabet soup when you're starting out — Hub, Switch, Router, MAC address, IP address, Subnet Mask — thrown at you all at once, usually with zero real-world context. Here's how I finally made sense of it, using something a lot more familiar: cricket. The Cricket Analogy Imagine a cricket team with three players: a hub , a switch , and a router . All three are part of the same game, but each has a completely different job — one's a batsman, one's a bowler, one's a fielder. Networking devices work the same way: they're all part of one network, but each does something distinct. Hub — The One Who Shouts to Everyone A hub is the simplest of the three. If only two devices need to talk, you don't even need one — but the moment more than two devices are connected, a hub becomes necessary to relay traffic between them. Here's the catch: a hub has no idea who's talking to whom. If Device A wants to send data to Device B, it sends that data to the hub — and since the hub doesn't know which device Device A actually wants to reach, it just broadcasts the data to every single connected device. So a hub's "functionality" is really a lack of intelligence — it doesn't figure out who wants to speak with whom; it just floods the message everywhere and lets the devices sort it out. Switch — The One Who Knows Everyone by Name A switch does the same basic job as a hub — moving data between connected devices — but with one major upgrade: it actually knows who's who. Instead of blindly broadcasting to every device, a switch keeps a table of each connected device's MAC address , so it can send data directly to the right recipient. What Is a MAC Address? Every device that connects to a network — a laptop, phone, router, anything — has a Network Interface Card (NIC) . That NIC comes with a MAC address : a permanent ID burned in by the manufacturer. If your laptop has an Ethernet port, the NIC lives right behind it. If you're connecting over Wi-Fi instead, the NI

With advice from infectious disease experts, I tested a low-effort way to pasteurize eggs at home.

Salmonella outbreaks are seemingly everywhere right now. A good temperature probe is the last and best line of defense.

Weeks after OpenAI disclosed that one of its cybersecurity models had gone rogue and hacked AI dataset company Hugging Face, Alabama’s attorney general announced an investigation into the incident.

Looking to better protect your Kindle or add a little personality to your favorite e-reader? From cases and covers to page turners and even charms, this is the guide for you.

tailscale up --tun=userspace-networking gets you a green dot in the admin console and almost nothing else. The node appears in your tailnet, tailscale status looks healthy, and then you try to SSH into that container from your laptop and the connection hangs until TCP gives up. Two lines in the LXC config file fix it, and the container stays unprivileged. That's the whole post, really. But those two lines only make sense once you understand why every guide pushes you toward userspace mode in the first place, and what you're giving up by staying there. Who should care Anyone running services in unprivileged LXC containers on Proxmox who wants those containers to be real tailnet members with their own 100.64.0.0/10 address. Not reachable through something else. Reachable directly, over WireGuard, with a kernel network interface that ip addr can see. If you're already routing everything through a subnet router, you have a working setup and this is an optional upgrade. I covered that pattern in Tailscale Subnet Routers . Treat this as the next rung on the ladder: instead of one node advertising routes on behalf of everyone else, each container carries its own identity, its own ACL surface, and its own direct path to peers. What userspace networking actually costs you Every LXC-and-Tailscale guide I've read lands on the same instruction: pass --tun=userspace-networking and move on. It works because it sidesteps the problem entirely. Rather than asking the kernel for a TUN device, tailscaled runs a userspace TCP/IP stack (gVisor's netstack) inside its own process and never opens /dev/net/tun . Those costs stay invisible until you trip over one. Outbound traffic needs a proxy. In userspace mode, tailscaled exposes SOCKS5 and HTTP proxies on a local port. Nothing on the system routes to 100.64.0.0/10 automatically, because there is no interface and no route. Every client has to be told about the proxy: # userspace mode: this is the only way out export ALL_PROXY = socks5://l

Cloudflare, Astro, AI agents, GitHub Actions, issue triage, agentic AI, software architecture, open source, developer tools, AI automation, automated testing, human in the loop, agent workflows, GitHub, software engineering, AI software development, bug triage, continuous integration, developer productivity, autonomous agents, AI coding, Cloudflare Workers, Flue, triagebot By Leela Kumili

Senator Ron Wyden sent a letter to the U.S. federal watchdog requesting a comprehensive review of how the FBI, DEA, ICE's HSI, and the Secret Service use hacking tools and spyware against Americans.

Ich wollte kein Gesellschaftskapitel schreiben Ehrlich gesagt hatte ich es fest geplant, es wegzulassen. Das Buch sollte technisch bleiben. Guards, Skills, Crystallization-Loop. Harte Zahlen, echte Systeme. Kein Manifest, kein Aktivismus. Aber dann saß ich eines Abends vor meinem Dashboard und schaute auf eine Zahl, die mich nicht losließ: 1.087 autonom erledigte Tasks. Ohne mich. In einem einzigen Monat. Und ich dachte: Was passiert, wenn das nicht mehr mein persönliches Experiment ist, sondern die Standardausstattung eines Unternehmens? Was mein System jeden Tag beweist Mein Agentensystem läuft auf einer einfachen Architektur. Cron-Jobs feuern Tasks, Guards prüfen Ausgaben, Skills führen spezialisierte Workflows aus. Die Erfolgskennzahlen sprechen für sich: 232 aktive Cron-Jobs, die rund um die Uhr arbeiten 88,1% Aufgaben ohne menschliches Eingreifen abgeschlossen Durchschnittliche Reaktionszeit unter 4 Minuten für routinemaessige Entscheidungen Das ist kein Proof-of-Concept. Das ist mein Arbeitsalltag. Ein konkretes Beispiel: Jede Nacht um 2:00 Uhr laeuft ein Agent, der meine LinkedIn-Performance auswertet, Erkenntnisse in eine Wissensdatei schreibt und den naechsten Morgen mit priorisierten Empfehlungen vorbereitet. Ich wache auf und finde eine fertige Analyse vor. # Auszug aus meinem Cron-Setup 0 2 * * * claude --skill post-analyse --input performance/daily/ $( date +%Y-%m-%d ) .md 30 2 * * * claude --skill content-excellence --mode review Das ist Routine. Das laeuft jeden Tag. Das macht niemand manuell. Die Frage, die ich nicht ignorieren konnte Wenn eine Person mit diesem System die Produktivitaet von mehreren Vollzeitkraeften erreicht, dann stellt sich eine Frage, die ich nicht wegdefinieren kann: Was passiert mit den Arbeitsplaetzen, die diese Routinetaetigkeit bisher ausgefuellt haben? Der IMF schaetzt, dass 40% aller Arbeitsplaetze weltweit von KI betroffen sein werden. Nicht in zehn Jahren. Die Verschiebung findet jetzt statt, in kleinen Schritten, in je

VRP Is Ready for External Validation — Who Will Be the First to Pilot It? My name is Vitalijus Riabovas. I am the independent architect and creator of VRP — Veil Routing Protocol . VRP is a continuity-first networking architecture built around a simple principle: A logical session should not have to die simply because the network underneath it changed. Wi-Fi → LTE/5G. IP mutation. NAT / CGNAT churn. Temporary blackout. Path failure. Recovery. Replay attempts. Stale authority. Duplicate execution. For a long time, VRP was primarily architecture, runtime engineering and internal validation. That stage has changed. The public validation boundary exists now. And I am inviting serious engineers and organisations to test it. DON'T TRUST MY CLAIMS. TEST THEM. I am not asking the networking industry to believe a presentation. I built the measurement boundary. The public VRP Validation Kit provides engineers with an environment for evaluating observable behaviour independently. You can: clone the repository; run the Docker scenarios; inspect generated evidence; verify manifests and hashes; attack the evidence; delete events; duplicate events; reorder events; attempt replay; introduce stale conditions; corrupt artifacts; run the verifier; reproduce PASS / REJECT / INCOMPLETE outcomes. If you believe something is wrong, try to produce a reproducible contradiction. Give me: environment → scenario → commands → evidence → result That is useful engineering. WHAT HAS BEEN BUILT? VRP has moved far beyond an architectural diagram. The project now includes multiple engineering layers. Continuity architecture Logical session identity is designed to survive changes in the underlying network path. The architecture is being developed around continuity rather than assuming that transport identity and logical session identity must always be the same thing. Runtime The protected runtime implements the private VRP mechanisms. That implementation is not public . State and transition handling T

When I shipped KittyClaw two weeks ago, the tool did one thing: serve as a board. The Claude agents ran alongside - first by hand, then via a dispatcher.mjs : a Node script polling KittyClaw's API, triggering the right agent based on who was assigned to which ticket. The dispatcher worked great. It orchestrated Aekan's 13 agents for weeks. But it was an external process : one more node dispatcher.mjs to launch, a state file ( dispatch-state.json ) to keep in sync, logs to dig up in .agents/channel/debug.log , a config to copy-paste across projects in JS. Today, the dispatcher doesn't exist anymore. Orchestration lives inside KittyClaw . I run dotnet run on KittyClaw, nothing else. Aekan's 13 agents still run - but the infra that drives them is now a first-class citizen of the board. This shift from "dispatcher on the side" to "dispatcher inside the board" is small in lines of code, but it completely changes what the tool is. And how I work. This piece documents KittyClaw , the kanban orchestrator at the center of the Ekioo agent-fleet R&D. Alongside Bloomii (constructive-journalism media) and Kalceo (regulatory B2B SaaS for construction contractors), KittyClaw runs the AI agents that drive these projects in production. Before: two processes to run, two places to look The old setup was three stacked layers: KittyClaw - the board, with its UI and REST API. dispatcher.mjs - a separate Node script in the project's .agents/channel/ , launched manually in a terminal. Claude Code - the agents themselves, launched by the dispatcher. It worked. But every project had its own dispatcher.mjs , usually forked from Aekan and hand-adapted. Patterns duplicated: 30s polling, code lock, evaluator debounce, daily budget. Adding a feature (say boardIdle or subTicketStatus ) meant re-coding it in every dispatcher, or accepting that one project had it and others didn't. And visually, orchestration was invisible from the board . To see an agent's live activity, I'd pop a terminal, tail -f

I thought I was building a better planning engine. What I actually built was a machine for showing...

Subnetting errors rarely announce themselves as "bad math." More often, two devices make different decisions about whether a destination is local, a route points at the wrong boundary, or a cloud/VPN design contains two networks that cannot be unambiguously routed. These five failure modes are worth recognizing in live configurations. 1. The two hosts use different masks Consider Host A at 192.168.10.10/24 and Host B at 192.168.11.10/16 . A calculates that B is outside 192.168.10.0/24 , so A sends the packet to its default gateway. B calculates that A is inside 192.168.0.0/16 , so B treats A as local and tries ARP directly. The result can be asymmetric: one direction follows a router, while the reply is sent directly or never reaches the expected gateway. Check the actual prefix on both interfaces, not just the dotted decimal mask shown in a diagram. ip -br addr ip route ping -c 3 192.168.11.10 Correct the prefix so both endpoints agree, or intentionally route between two correctly defined subnets. 2. Overlapping subnets are assigned to different networks Suppose a branch uses 10.20.0.0/16 , while a cloud VPC or VPN peer also uses 10.20.0.0/16 . The problem is not that either mask is mathematically invalid. The problem is that a router cannot distinguish "the branch's 10.20.5.0/24 " from "the cloud's 10.20.5.0/24 " if both are reachable through different paths. Symptoms include traffic taking the wrong tunnel, routes that cannot be installed, or a VPN that connects but cannot reach some subnets. Inventory both sides of a tunnel and compare the complete network/prefix pairs. A longer, more specific route may make one destination appear to work while hiding the underlying overlap. ip route ip route get 10.20.5.25 traceroute -n 10.20.5.25 The durable correction is renumbering or using an intentional translation/design boundary. Adding increasingly specific routes is usually a brittle workaround. This is also why I prefer teaching subnetting inside routing and troublesh

Some fortnights the complaints scatter across a dozen topics; this one they clustered around two. Across the forums where paying AI users gather to compare notes, two things happened in the same window that left the same taste: the meter moved, and the mark landed. In both cases, something about the product changed without a clear announcement, and the users found out by running into it. Quotes sourced from: the OpenAI Developer Community and Hacker News. Every quote below was opened at its permalink and copied verbatim; each is listed with its handle, platform and date in the Sources section. We quote experiences, not verdicts — a forum post is one person’s felt reality, and we have framed it as exactly that. The $200 plan that lasted two days The loudest note this fortnight was the Codex usage drain. On the OpenAI Developer Community, a Pro subscriber posting as jjjnoronha laid out the damage plainly on 4 August: “I’m on the $200 Pro plan, and my weekly limit was completely exhausted in 2 days of serious development work. This is simply not viable.” He was refactoring a Rust backend with two agents running — one coding, one checking code quality — and described leaving Ultra mode on for three or four hours, which alone consumed 30% of his weekly allowance. But the complaint was not that the work was expensive; it was that the plan was sold with language suggesting far more headroom than what the cap delivered. “When someone pays for the highest consumer tier,” he wrote, “the expectation is capacity for sustained, professional work — not being locked out for the rest of the week after two days.” Others described something stranger. A user posting as kalani reported going to bed with 70% remaining after a Saturday reset, then waking up to find 0%. “Not like I had something running overnight, and yet all usage blocked until this next Saturday,” they wrote on 4 August. “Hard to trust a $200 / month service that is completely unpredictable about whether you’ll even be

This is a writeup of building a required CI gate for degraded-network behavior. The system under test is a robotics fleet substrate, but the finding applies to anyone shaping networks in CI. Ganglion exists to reach robots on networks nobody controls. Warehouse Wi-Fi, carrier CGNAT, a hospital VLAN, a customer firewall that was configured once in 2019 and has not been touched since. Until this week that claim was a sentence on a website. CI ran on clean loopback, everything was green, and the failure modes that actually matter in the field were the exact ones the test suite could never produce. That is now a required gate. Every push to main runs the full deploy, invoke and verify round trip over the relay against five shaped network profiles, and all five have to pass before anything merges. I build Ganglion, so treat the enthusiasm accordingly. The part worth your time is not that it went green. It is what I got wrong on the way there. The five profiles clean : baseline, no shaping. If this one fails, something else is broken. lossy : packet loss with light reordering. high-latency : 250ms round trip. asymmetric : plentiful downlink, starved uplink. This is the one nobody tests and the one teleop actually dies on, because control acknowledgements go the starved direction. nat-relay : endpoints with no route to each other at all, forcing hole punching to fail and relay fallback to carry the session. The last two are the ones I care about. Loss and latency are what people imagine a bad network is. Asymmetry and no-direct-route are what a bad network usually is. What I got wrong The original design assumed you can pin netem's seed and get a repeatable lossy run. Two profiles: a pinned-seed one that gates the build, and a nastier randomized one that runs nightly and is allowed to fail. You cannot pin netem's seed. Its loss and jitter draw from the kernel RNG and there is no seed parameter to set. A "deterministic lossy netem profile" is not a thing that exists. This m

Short version: An Application or Network Load Balancer costs ~$0.0225/hour, about $16/month, just to exist , plus capacity units. Classic Load Balancers run ~$18/month. Load balancers outlive the services behind them: the app gets torn down, the ALB keeps billing. Here's how to find load balancers with no real traffic or no healthy targets, and remove them safely. Why idle load balancers linger The hourly base charge is fixed - an ALB with zero requests bills the same ~$16/month as a busy one. Load balancers are usually created early (with an app or an IaC module) and deleted last, if ever. A handful of abandoned ALBs from old environments is real, recurring money. Step 1 - List load balancers and their traffic aws elbv2 describe-load-balancers \ --query 'LoadBalancers[].{Name:LoadBalancerName,Type:Type,ARN:LoadBalancerArn}' \ --output table For an ALB, check request volume over the last 7 days (the metric dimension is the tail of the ARN, e.g. app/my-alb/50dc6c495c0c9188 ): aws cloudwatch get-metric-statistics \ --namespace AWS/ApplicationELB \ --metric-name RequestCount \ --dimensions Name = LoadBalancer,Value = app/my-alb/50dc6c495c0c9188 \ --start-time " $( date -u -d '7 days ago' +%Y-%m-%dT%H:%M:%SZ ) " \ --end-time " $( date -u +%Y-%m-%dT%H:%M:%SZ ) " \ --period 86400 --statistics Sum \ --query 'Datapoints[].Sum' Near-zero request counts over a week is a strong idle signal. (For NLBs, use the AWS/NetworkELB namespace and ActiveFlowCount .) Step 2 - Check for empty or unhealthy target groups A load balancer with no healthy targets is doing nothing useful: for tg in $( aws elbv2 describe-target-groups \ --load-balancer-arn <lb-arn> \ --query 'TargetGroups[].TargetGroupArn' --output text ) ; do echo "== $tg ==" aws elbv2 describe-target-health --target-group-arn " $tg " \ --query 'TargetHealthDescriptions[].TargetHealth.State' --output text done Empty output (no targets) or all unhealthy alongside near-zero requests is a confident "delete me." Step 3 - Delete saf

A surprising share of "the app is down" pages resolve to a name-resolution problem, not a broken service. The service is fine; the client can't turn a name into an address. dig is the precision tool for proving that in seconds instead of guessing. Think about it as a resolution chain, not "is DNS broken" When a name fails, work the chain: which resolver did the client ask, what did that resolver return, and does it match what authoritative DNS actually says? Most incidents live in the gap between those three. The method is boring and reliable: observe the symptom, form a hypothesis about where in the chain it breaks, test with one query, read the evidence, fix, then validate. The single most important habit: query the name from the same host and the same resolver the app uses. Running dig from your laptop proves nothing about what the pod or VM sees. The record types worth knowing You don't need all of them, but you need to recognize them: A / AAAA — name to IPv4 / IPv6 address. The usual suspect. CNAME — an alias pointing at another name. A stale or wrong CNAME sends traffic somewhere unexpected. MX — mail routing. TXT — SPF, DKIM, domain verification, and other metadata. NS — which servers are authoritative for a zone. SOA — the zone's serial and TTL defaults; the serial tells you whether a change has propagated. PTR — reverse lookup, IP back to name. The commands that actually earn their place Start with the quick answer, then get precise. dig +short api.internal.example.com +short strips everything except the answer. If it prints an IP, resolution works from this host. If it prints nothing, you have a real failure to chase. Empty output is a signal, not an error. dig api.internal.example.com A The full form. Read the status in the header: NOERROR with an ANSWER section is good; NXDOMAIN means the name genuinely doesn't exist; SERVFAIL points at a broken upstream or DNSSEC issue. Also note which SERVER answered at the bottom — that's the resolver you're actually

The early website Hot or Not taught its users to rank people at scale. Twenty-six years later, dating apps are trying to escape the culture the site helped create.

The tunnel comes up. wg show prints a recent handshake. The client has its address inside the tunnel. And not a single byte reaches the internet. Almost every guide answers this with "open UDP 51820 in the firewall". You already did that — it is why the handshake works at all. The problem is somewhere else, and UFW makes the distinction easy to miss: Entering a machine and traversing it are two different permissions. ufw allow 51820/udp lets packets arrive at the server. Your clients' traffic does not stop there — it goes through the box and out the public interface. That path lives in the FORWARD chain, which UFW denies by default and which no allow rule touches. The four things to check, in order 1. IP forwarding — and the file that overwrites the other file This is the one that costs hours, because the setting looks done. UFW loads its own sysctl file at startup, and it takes precedence over the system one. A value you carefully set in /etc/sysctl.conf can be silently overwritten on the next ufw enable . The right place is /etc/ufw/sysctl.conf : net / ipv4 / ip_forward = 1 net / ipv6 / conf / default / forwarding = 1 net / ipv6 / conf / all / forwarding = 1 Then check the effective value, not the file you just edited: sysctl net.ipv4.ip_forward 2. Forwarding, which is not the same as ingress Targeted, and the one to prefer: sudo ufw route allow in on wg0 out on eth0 Or globally, in /etc/default/ufw : DEFAULT_FORWARD_POLICY = "ACCEPT" The second opens forwarding for every interface. It is a good ten-second diagnostic and a poor permanent configuration. 3. NAT, which UFW never adds on its own Without it, packets leave carrying their tunnel address, which nothing on the internet knows how to answer. In /etc/ufw/before.rules , at the very top , before the *filter line: *nat :POSTROUTING ACCEPT [0:0] -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE COMMIT Two classic mistakes here: putting this block after *filter (it is then ignored), and copying eth0 without chec