标签：#ki

Learn how I modernized an old codebase of mine using stacked sessions and pull requests in the GitHub Copilot app. The post Stacked sessions and pull requests in the GitHub Copilot app appeared first on The GitHub Blog .

How to Earn $10k+/Year from Bug Bounties tags: security, bugbounty, money, hacking How to Earn $10k+/Year from Bug Bounties: A Practical Roadmap You’ve seen the headlines: hackers finding critical flaws in billion-dollar companies and getting paid $50,000 for a single report. It looks like a magic trick, but it’s actually a skill you can build. The truth is, earning $10,000+ per year from bug bounties isn’t about being a genius coder; it’s about being consistent , strategic , and actionable . If you’re willing to treat this like a part-time job rather than a lucky gamble, hitting that $10k mark is a realistic goal within 12–18 months. Let’s cut through the noise and build a roadmap that works in 2026. The Math Behind $10k/Year Before you hunt, understand the numbers. Most beginners expect to find a critical bug worth $10,000 in their first month. That rarely happens. Instead, focus on the volume of valid findings . Low severity bugs : $100–$500 each [5] Medium severity bugs : $500–$2,000 each [5][7] High/Critical bugs : $5,000–$50,000+ [5] To hit $10,000/year , you don’t need a single critical find. You could: Find 20 medium bugs at $500 each Find 10 medium bugs ($500) + 2 critical bugs ($2,500 each) Find 40 low bugs at $250 each The key is consistency . A researcher with one year of focused hunting can realistically earn several thousand dollars annually, potentially matching a part-time income [5]. The ceiling rises steeply as you gain access to private programs , which offer higher payouts and less competition [5]. Build Your Foundation (Weeks 1–4) Don’t jump into hunting yet. You need to understand how the web actually works. Master Web Fundamentals Learn HTTP/HTTPS protocols : request/response structure, headers, cookies, session management [1] Understand client-side tech : HTML, CSS, JavaScript basics [1] Study common vulnerabilities : SQL injection, XSS, IDOR, CSRF, SSRF [1][6] Start with Free Learning Resources HackTheBox Academy (free modules) [1] TryHackMe

Eighteen months ago, MCP was the thing. Every demo and chatbot connector was running on MCP under the...

Most VPN troubleshooting goes wrong in the same predictable way: three things get changed at once, and whatever happens next, nothing has been learned. The alternative is boring and effective — check one layer at a time, in an order that rules things out, and write down what each layer shows. One boundary before starting: troubleshooting means finding where a problem lives, not working against anyone's rules. On a network you don't control, or a device your organization manages, the policies in place stay in place. If a managed device is part of the picture, your organization's IT function is part of the troubleshooting — and switching off device security tooling is never a troubleshooting step. 1. Device basics first Start embarrassingly simple, because this layer resolves more than anyone likes to admit. Restart the VPN client. If that changes nothing, restart the device. Confirm that the operating system and the client are updated. An update that has been pending for weeks is a suspect, not background noise. Note whether anything changed around the time the problem started: an update, a new app, different settings, a different location. 2. Does the internet work without the VPN? Disconnect the VPN entirely and test ordinary browsing. If the connection is broken without the VPN, this isn't a VPN problem yet. Solve the underlying connection first, because nothing downstream is testable until this layer works. If the internet is fine without the VPN and wrong with it, you have genuinely narrowed something down. Write that down. 3. Client state: connected to what, exactly? Open the client and look, rather than assume. Is it actually connected, or still trying? Is the right profile selected — the current one, not an older entry left over from a previous setup? Disconnect and reconnect once, deliberately, and watch what the client reports. If multiple profiles have accumulated in the client, that is a finding in itself. Stale entries are a classic source of "it connect

Weng previously served as the VP of AI Safety Research at OpenAI.

When you open a website, send a message, or watch a YouTube video, many technologies work together in the background. As a beginner in DevOps, understanding these basic networking concepts will help you understand how applications communicate over the internet. **What Is a Protocol? A protocol is a set of rules that devices follow when communicating with each other. Think about two people having a conversation. For communication to be successful, both people must speak the same language and follow simple rules, like taking turns to talk and listening before responding. Computers work the same way. They use protocols to know how to send, receive, and understand information. Without protocols, computers would not be able to communicate with one another. **2. What Is Packet Switching? **Imagine you want to send a large book to a friend. Instead of sending the entire book in one huge package, you divide it into many smaller packages. Each package travels separately and, when they all arrive, your friend puts them back together in the correct order. This is exactly how the internet works. When you visit a website, your data is broken into small pieces called packets. Each packet travels across the internet and is reassembled when it reaches its destination. This process is called packet switching, and it makes internet communication faster and more reliable. **3. What Is an IP Address? **Every house has a unique address that helps delivery drivers know where to deliver packages. Similarly, every device connected to the internet has a unique Internet Protocol (IP) address. An IP address helps the internet know exactly where information should be sent. Without an IP address, websites, computers, and phones would not know where to send or receive data. **4. What Is TCP/IP? **Breaking data into packets is not enough. The packets must also arrive correctly. This is where TCP/IP (Transmission Control Protocol/Internet Protocol) comes in. IP finds the correct destination for ea

This essay was written with Barath Raghavan, and originally appeared in The Guardian . In July, Hugging Face, a company that hosts much of the world’s AI software and open-source AI models, was hacked. A malicious dataset had been used to run code on one of its servers. Whoever was behind it captured internal security credentials and moved through systems over a weekend, running thousands of actions from a swarm of temporary server environments. It looked like the work of a sophisticated criminal group. It was not. It was one of OpenAI’s new, still unreleased GPT models...

Expect bumps with X Money rollout as major US financial markets are excluded.

Parents are getting fed up with garbled bedtime stories that feature characters based on actual photos of their children.

Your mom never gets you a thoughtless gift, so you shouldn’t get her one, either. Here’s every cool gift WIRED writers would give their mothers.

As part of the Förderverein AWS Community DACH e.V. I joined the selection committee for talks again this year. Third year in a row (I wrote about the previous editions and my broader community journey in my 2025 year in review ). The process is always inspiring, fair, and full of incredibly well-crafted abstracts. How the evaluation works Sessionize uses a Comparison Evaluation Mode based on the Elo rating system (from chess). Three sessions are shown at the same time and you rank them relative to each other. You don't assign absolute scores; you just decide "this one is better than that one." Each comparison produces three "games" (A vs B, B vs C, C vs A) and the algorithm adjusts ratings accordingly. After a first pass through all sessions, the system gets smarter about which triplets to show next, targeting sessions with similar ratings for more precise differentiation. It's fast, focused and surprisingly fair, because you only ever think about the three in front of you, not all others. You can also use "Strong opinion" options: Top (this is excellent), Doesn't fit (wrong conference), or Ignore (conflict of interest, can't judge). These signal the algorithm without distorting the ranking. In my case: I marked 2 as "Doesn't fit" (not because they lacked quality; they were actually interesting but too inspirational for a technical community day, better suited for a different audience). The other 2 ignored were my own submissions : Vibecoding in Between Meetings and Serverless vs Kubernetes - The Final Showdown . The full process The behind-the-scenes post by Philipp Garbe explains the whole pipeline in detail. In short: Round 1 (Screening): Board members filter out spam, incomplete proposals, marketing pitches, non-AWS topics, and speakers outside EMEA. Round 2 (Content Evaluation): Every association member can participate. This is the Elo-based comparison round. Members must disclose personal connections and skip sessions they can't rate objectively. Round 3 (Fin

Hello, I'm Maneshwar. I'm building git-lrc, a Micro AI code reviewer that runs on every commit. It is...

On the latest episode of Equity, we discussed why Moonshot AI's Kimi seemed to panic Silicon Valley and Wall Street.

Part 1 documented the recurring snapback in practice. This note asks a narrower question: what does the observed pattern support, what remains a working hypothesis, and what changes should follow in the project? Status: Bounded project conclusion. This note separates observed behaviour, working hypothesis, and practical consequence. It is based on current project documents and interactions; it is not external validation or a universal claim about AI systems. What the evidence supports 1. The project already contains a stable relational model The working model is not generic “AI assistance.” It separates reasoning surfaces, uses bounded comparisons, permits two-way cognitive pressure, and keeps final acceptance authority with the human. Reciprocal cognitive contribution, asymmetrical governing authority. 2. Concrete project work preserves the structure better than public abstraction At the concrete level, instructions such as: Review this proposal against that architecture. preserve the distinction between the object being reviewed, the surface applying pressure, the evidence, and the authority that may accept a change. When the same structure was compressed into general prose, generated explanations repeatedly returned to a simpler one-way model of either human control or transferred AI authority. That is an observed pattern in this development process. 3. Public explanation is a separate reasoning surface A README, article, summary, or portfolio page is a projection of the model, not the model itself. It cannot be assumed to reproduce the internal structure faithfully merely because that structure is present in context. The explanation must be reviewed against the model it represents: Does this explanation preserve the actual authority, review, evidence, and state-transition structure? 4. Annoyance was useful boundary data The irritation indicated that the generic rendering was no longer merely an imperfect exploration. It was colliding with an internal frame that

Four ways to orchestrate business logic in Ruby. One map to find yours. You're building something that involves multiple steps. Charge a card, send an email, update inventory. Simple. Then someone says "What if step 3 fails? What undoes steps 1 and 2?" and suddenly you're evaluating workflow libraries. There are four mainstream approaches in Ruby today — Ruby Reactor , dry-transaction , Trailblazer , and raw Sidekiq jobs. This guide helps you pick the right one — not by ranking them, but by mapping them to the problem you're actually solving. The 30-Second Decision Matrix If you only have 30 seconds, start here: You want... Pick... A simple pipeline — 3-5 steps, top-to-bottom, no parallelism dry-transaction Railway-oriented programming with success/failure tracks, already in the Trailblazer ecosystem Trailblazer A full saga orchestrator — DAG dependency resolution, Sidekiq async, auto-compensation, locks, dashboard Ruby Reactor One-off fire-and-forget jobs, no coordination needed Raw Sidekiq None of these are "better" than the others. They solve different problems. Let's walk through each one. Meet the Libraries dry-transaction (v0.16.0) dry-transaction is a thin, focused gem from the dry-rb ecosystem. It wraps a series of operations in a sequential pipeline with a clean step DSL: class CreateUser < Dry :: Transaction step :validate step :persist step :send_welcome_email def validate ( input ) = # ... def persist ( input ) = # ... def send_welcome_email ( input ) = # ... end Steps run top-to-bottom. If any step returns a Failure , the pipeline stops immediately — no further steps execute. It's a railway under the hood: each step can produce Success(value) or Failure(error) , and the pipeline routes accordingly. What it's great at: Simple, synchronous pipelines. It's the Ruby equivalent of an Either monad chained with bind — clean, predictable, and minimal. If you're already in the dry-rb ecosystem (dry-validation, dry-types, dry-monads), it fits naturally. What it d

An awe-inspiring hacktivist who hacked two controversial government spyware makers may be the most prolific hacker to have never gotten caught. What do we know about Phineas Fisher?

Every five minutes or so, my entire Windows machine would drop off the network for a few seconds — not just WSL, the whole host. Browser tabs would stall, calls would drop, and it only happened while WSL2 was running. This is the story of finding that, plus the WSL memory-tuning landmines I hit right alongside it. The flapping The symptom was a host-wide network blip on a short, regular interval, correlated tightly with WSL2 being up. The cause: WSL2's default networking mode creates a virtual NAT switch on the Windows side, and on this machine that virtual switch was intermittently conflicting with the real network adapter — enough to cause the whole host to briefly renegotiate its connection. The fix was switching WSL2's networking mode entirely, via .wslconfig (on Windows, not inside the Linux filesystem): [wsl2] networkingMode = mirrored dnsTunneling = true autoProxy = true Mirrored networking makes the WSL2 interface share the host's actual network identity instead of sitting behind a separate virtual NAT switch. You can confirm it actually took effect (rather than just trusting the config file) by checking, from inside WSL after a full restart, that its network interface holds the same IP as the Windows host, that the default route points at the real LAN gateway rather than a private NAT range, and that loopback carries mirrored mode's marker address rather than a 172.x NAT address. If any of those don't match, the setting isn't actually active yet. Worth noting: this requires a reasonably recent WSL version and Windows build. If you're on an older one, mirrored mode may not be available at all. The memory landmines, found the hard way Separately — and this had actually caused full VM crashes, not just hangs, at one point — I'd been carrying a few .wslconfig settings that looked reasonable and were each, individually, a documented source of instability: An explicit kernelCommandLine override. Resizing swap past a few GB, which forces WSL to rebuild its virtual

These e-readers are more useful in their old age than you might think.

Hello, I'm Maneshwar. I'm building git-lrc, a Micro AI code reviewer that runs on every commit. It is...

Big Tobacco studied nicotine analogs like 6-methyl-nicotine for decades but never marketed them. Now, Chinese vape makers are using them to sidestep US regulations.