标签：#m

"I don't think you get a model this strong and this quickly on the heels of Fable doing strictly distillation," one expert told TechCrunch.

A few weeks ago, a back-of-envelope calculation told us that scaling Tula Spaces to 100,000 concurrent listeners would need roughly 100 small VPS boxes. That number was scary enough to derail a roadmap conversation — and, as it turned out, almost entirely wrong. This is the story of how we got from that panic number down to a real, measured, production-ready plan: five boxes, not a hundred, with every claim backed by a test rather than a guess. If you're building anything real-time at scale — live audio, video, multiplayer, anything running over QUIC — the failure modes we hit are probably waiting for you too. The panic number was built on an assumption, not a measurement The original math went something like: X% of a CPU core per listener, therefore Y cores needed, therefore Z boxes. It felt rigorous because it had numbers in it. But every number in that chain was inherited from an untuned, default configuration nobody had actually interrogated. The first rule we relearned the hard way: a scary capacity number is a hypothesis, not a fact, until you've tried to break it on purpose. Myth #1: "It's too much crypto for one core" Our relay runs one process per box, encrypting media for every connected listener over QUIC. At ~0.4% of a CPU core per listener at a modest bitrate, the instinctive explanation was cryptographic overhead — AES doesn't usually struggle at these data rates, so something had to be off. It wasn't crypto. It was packet count . Our encoder was emitting one CMAF fragment every 21 milliseconds — about 47 fragments a second, each one a separate send over the wire, per listener. That's a syscall and framing tax, not a cipher tax. Crypto didn't even show up in a profiler trace once we went looking. The instinct to reach for "batch the fragments" didn't work, though — that's the first place the story took a turn. Myth #2: Batching the container doesn't touch the wire We tried extending the CMAF fragment duration from 21ms to 200ms, expecting a straightfor

MAGA-coded adult content playing off immigration crackdowns, white supremacy, and obeying the “natural order” is finding rabid audiences on X.

Jeremy Edberg & Qian Li discuss why external orchestrators decrease reliability and how to use your existing database for durable execution. They share how DBOS Transact uses standard tables, SKIP LOCKED queues, and unique primary keys to manage complex, fault-tolerant AI workflows with minimal latency, all without the operational overhead of separate distributed systems. By Jeremy Edberg, Qian Li

QCon AI New York 2026 (Dec 15-16) has opened registration at The Westin Jersey City Newport. Six tracks on production AI, chaired by Eder Ignatowicz with Faye Zhang and Wes Reisz. First sessions announced in August, full program by November. By Artenisa Chatziou

Ink & Switch published bijou64, a variable-length integer encoding where every number has exactly one byte representation, closing the canonicality bug class behind attacks on PKCS#1, JWT libraries, and Bitcoin. The design also decodes two to ten times faster than LEB128. Community ports to Elixir, Go, Perl, and Java followed, while HN commenters debated SIMD performance and residual range checks. By Steef-Jan Wiggers

The fast fix If your GitLab CI job fails with Cannot connect to the Docker daemon at unix:///var/run/docker.sock , your docker client is looking for a local socket that does not exist inside the job container, because DOCKER_HOST is not set. Point the client at the docker:dind service over TCP and the error goes away: build : image : docker:28.3 services : - name : docker:28.3-dind alias : docker variables : DOCKER_HOST : tcp://docker:2376 DOCKER_TLS_CERTDIR : " /certs" DOCKER_CERT_PATH : " /certs/client" DOCKER_TLS_VERIFY : " 1" script : - docker info - docker build -t my-app . That is the whole fix for the common case. The rest of this page explains why the socket variant of the error is different from the tcp://docker:2375 variant, and covers the two other setups (socket-mounted runners and the Kubernetes executor) where the same message shows up for a different reason. Why you get the unix socket variant specifically This error is not the same as Cannot connect to the Docker daemon at tcp://docker:2375 . The address in the message tells you exactly what the client tried: Cannot connect to the Docker daemon at unix:///var/run/docker.sock. Is the docker daemon running? When DOCKER_HOST is empty, the Docker CLI falls back to its compiled-in default, the local unix socket at /var/run/docker.sock . Inside a GitLab CI job that uses the docker executor, that socket file simply is not there. The daemon runs in a separate docker:dind service container, not in your job container, so there is nothing listening on the local socket. The client connects, finds no socket, and prints the message above. The tcp://docker:2375 form is the opposite problem: DOCKER_HOST is set correctly but the dind service is not reachable (missing service, no privileged mode, or a TLS mismatch). If you are seeing that address instead, read the companion write-up on the tcp://docker:2375 form of this error , which walks the service and privileged-mode causes in detail. This page is about the case w

Does Roadmap.sh , Coderspace.io which offers a roadmap-style approach—really look like the kind of site that helps you master and keep up with technology? I am a computer engineering student. My goal isn't just to sign up for a site like that; I want to gain experience and build products, but I don't want to waste my time. Do you think it would be worth it to build and work on a site like this, or would I just be wasting my time? submitted by /u/ardasongurr [link] [留言]

I cranked Apple’s iOS 27 beta to maximum transparency on my iPhone and enjoyed every warped second.

If you are an enterprise architect working on Microsoft Entra and AI agents, your first overdue job is not another policy wizard, another dashboard, or another governance steering committee. It is schema design. Specifically, it is deciding how you classify non-human identities with custom security attributes in Microsoft Entra . Not eventually. Up front. I keep seeing the same pattern across customers of every size: teams move quickly on agent experimentation, they onboard identities, they test controls, and then they realize they have no consistent attribute language for policy scope. At that point, every policy becomes a naming convention problem in disguise. That is backwards. The control plane starts with classification Custom security attributes are not decorative metadata. They are tenant-scoped key-value classifications you can assign to users, enterprise applications (service principals), and agent identities that are modeled as a service principal subtype, with dedicated role and permission boundaries for who can define and assign them ( overview , Graph model , agent identity service principal model ). That alone should change how architects think about them. This is not "nice to have taxonomy." This is policy input. Microsoft Entra Conditional Access for agents supports attribute-driven targeting with custom security attributes, and policy evaluation happens during token issuance and refresh, not just at policy authoring time ( Conditional Access for agents ). In other words: if your classification is sloppy, your runtime decisions are sloppy. Why agents raise the stakes You can say "an agent identity is still a service principal" and be technically correct. Microsoft Entra Agent ID is built on service principal infrastructure ( agent identities, service principals, and applications ). You can also miss the point. Agent identity introduces a blueprint-centered model where one blueprint can represent many agents, where blueprint-level policy decisions can

Every morning, an online store receives the previous day’s orders from a marketplace partner. The file comes in JSON format. The company needs to add those orders to its main MongoDB orders collection. The sales manager also needs a CSV report that can be opened in Excel. That sounds like a small task. Import the file, copy the documents, export the report. But in practice, a few things can break the process. A date can be imported as a string. A field can have the wrong name. One batch may use total , while the main collection uses totalAmount . A temporary collection can keep old records and trigger duplicate key errors. A CSV export can create null values because the mapping points to fields that do not exist. And then there is customer data. The manager may need the sales numbers, but they probably do not need real customer names or internal customer IDs. This article walks through a real daily workflow: Import marketplace JSON ↓ Store the batch in a temporary MongoDB collection ↓ Copy the orders into the main orders collection ↓ Mask customer fields during export ↓ Create a CSV report The goal is not just to move data from JSON to CSV. The goal is to make the process repeatable, easier to check, and safer to share. The workflow The workflow has three jobs: Import Yesterday Orders ↓ Add Orders to Main ↓ Export Daily Sales Report The important part is the parent relationship between the jobs. Add Orders to Main depends on Import Yesterday Orders , so it only runs after the JSON file is imported successfully. Export Daily Sales Report depends on Add Orders to Main , so the CSV is created only after the main orders collection has been updated. This prevents the report from being generated when data is missing or incomplete. The incoming JSON file The partner sends a file with yesterday’s completed orders. A single order looks like this: { "orderId" : "ORD-2026-07-201" , "customerId" : "CUST-1003" , "customerName" : "Sofia Rossi" , "orderDate" : "2026-07-21T08:20:00

This week's releases cluster around a theme: reducing the overhead that compounds in production agentic systems. Gemini 3.6 Flash ships with measurable token reduction and a price cut, Vercel's AI Gateway gets service tier routing for latency-cost tradeoffs, and Python cold starts quietly drop by half with zero code changes required. Nothing experimental here—most of this is worth touching immediately if you're already in these ecosystems. Gemini 3.6 Flash cuts output tokens by 17% Google's 3.6 Flash reduces output token usage by 17% versus 3.5 Flash while lowering cost to $1.50/1M input and $7.50/1M output. The improvement is most pronounced on coding and web tasks, which happen to be the workload profile of most production agents. The companion model, 3.5 Flash-Lite, trades some quality for throughput—350 output tokens/sec—at $0.30/$2.50 per million tokens. Token efficiency isn't a vanity metric in agentic systems. Multi-step workflows compound output costs: every intermediate reasoning step, tool call response, and context accumulation multiplies what you pay. A 17% reduction per model call can translate to significantly more than 17% savings across a full agent loop, depending on how many hops your workflow runs. The throughput number on Flash-Lite matters too—if you're running high-volume document classification or search reranking, 350 tokens/sec opens architectures that weren't cost-viable before. The API swap is a single parameter change. No migration friction, no new authentication surface. Ship it now if Gemini is already in your stack and you're paying attention to inference costs. Replace 3.5 Flash with 3.6 Flash for general agentic tasks; move high-throughput, lower-stakes subtasks to Flash-Lite. Gemini 3.6 Flash and 3.5 Flash-Lite on AI Gateway Both new Gemini models are immediately available through Vercel's AI Gateway, callable via the unified AI SDK with the same cost tracking, failover, and routing you'd use for any other provider. Model selection

Most bibliography failures show up the night before arXiv or the journal deadline: placeholder DOIs, year pasted into volume= , inverted page ranges, invented case reporters. The fix is a paper repo that fails closed from day one . One command pip install https://github.com/SybilGambleyyu/citesure/releases/download/v0.5.68/citesure-0.5.68-py3-none-any.whl citesure init my-paper cd my-paper citesure gate . --preset ci citesure gate . --preset arxiv citesure init writes refs.bib , pre-commit hooks ( gate --preset ci + soft-lint), .github/workflows/citesure.yml , and a short CITESURE.md for coauthors. Empty bibliographies skip hard-ID floors until entries appear. What the gate checks Soft-lint — placeholder number/issue, inverted pages, year-like volume/month/edition, unsafe keys, all-caps titles, missing venues, duplicate DOIs/titles Health — hard-ID coverage floors Promote dry-run — DOIs still buried in url= Live verify — Crossref, doi.org, arXiv, PubMed, Europe PMC, DataCite, OpenAlex, CourtListener Domain packs Fifty-five live-clean packs (demography, sociology, political science, anthropology, ML, law, ecology, …): citesure packs --gate-all citesure packs --run anthropology-classics Evidence: 256/256 integrity · 209/209 claim pairs · 55 packs. Source: github.com/SybilGambleyyu/citesure · Demo: citesure.sybilgambleyyu.workers.dev

Ethereal Bytecode for the Network: Unlocking XDP's Magic! Hey there, fellow tech enthusiasts! Ever felt like the traditional networking stack in your Linux kernel was a bit… sluggish? Like it was taking the scenic route when you needed it to be a supersonic jet? Well, let me introduce you to a superhero that swoops in and turbocharges your network packet processing: eBPF, specifically in the context of XDP (eXpress Data Path). Forget the days of wrestling with complex kernel modules or praying for better hardware offload. eBPF and XDP offer a revolutionary, in-kernel, safe, and incredibly efficient way to program packet processing at the very edge of your network interface. Think of it as giving your network card a tiny, super-smart brain, capable of making lightning-fast decisions before the packet even bothers the main kernel stack. Pretty cool, right? So, buckle up as we dive deep into the wonderful world of XDP and eBPF, demystifying its power and showing you why it's becoming the darling of modern networking. 1. The "What's the Big Deal?" Section: Introduction to XDP & eBPF Imagine a bustling highway (your network). Traditional networking is like having every car stop at a toll booth, get inspected, and then directed by a central traffic controller. This works, but it can get congested. XDP, on the other hand, is like having intelligent on-ramps where some cars can be instantly identified, rerouted, or even rejected before they even hit the main highway. eBPF (extended Berkeley Packet Filter) is the technology that makes this possible. It's a powerful, sandboxed virtual machine that runs within the Linux kernel. Unlike traditional kernel modules, which can potentially crash your entire system if written incorrectly, eBPF programs are rigorously verified by the kernel for safety and correctness before they are allowed to execute. This means you get the power of kernel-level access without the existential dread of a kernel panic. XDP (eXpress Data Path) leverages

An AI can write a perfect email in seconds. Having a real back-and-forth conversation is much harder. Sarah runs a salon. She has an AI assistant that emails her customers when a slot opens up. Last Friday, a customer canceled his booking. The assistant sent an email: "We have an opening tomorrow at 2 PM. Want it?" The customer replied in a minute: "Yes, book it!" The assistant never saw that reply. The slot stayed open. The customer never got a confirmation. This happens more than people realise — not because it's hard to receive email, but because most setups were never wired to close the loop. Sending is easy. Wiring the whole loop isn't. To be fair, receiving and parsing email isn't some unsolved problem — providers like SendGrid, Mailgun, and Postmark have offered inbound email parsing for years. Point your domain at them, and they'll hand you the clean message. But those webhooks only push the message once. There's no inbox to check back later, and no built-in way to link a reply to the right conversation. You have to build that part yourself — and you still can't run any of it on your own servers. There's a second issue too. AI assistants sometimes send a slightly odd reply — nothing harmful, just a little off. Many managed email providers watch for exactly that pattern, and can suspend an account fast. One strange sentence, and Sarah's whole booking system could go dark with no warning. What a real AI assistant needs For an assistant like Sarah's to actually hold a conversation, a few things need to work together: Replies need to land somewhere the AI can read them They need to arrive clean, not messy They need to stay linked to the right conversation The AI needs to reply back from the same email address All of it needs to run on infrastructure you control, not three different vendors This is what we built Reloop for Reloop puts that whole loop in one place, self-hosted. When Sarah's customer replied "Yes, book it!", Reloop caught the reply, cleaned it up,

On July 3, as a heat wave swept the region, New York State’s grid imported 52 gigawatt-hours of electricity from Canada—enough to meet about 9% of its total electricity demand that day. Some of that power shuttled in on a 339-mile power line stretching from Quebec to Queens called the Champlain Hudson Power Express (CHPE).…

Hear from six pediatricians in measles hot spot Utah, as the US faces infection levels not seen in over three decades and prepares to lose its status as a country that eliminated the dangerous disease.

The bottleneck in a mature SOC is rarely analyst triage; rather, it is the detection-engineering team's ability to keep the rule base aligned with a threat landscape that evolves faster than rules can be written. Learn how multi-agent system for production security operations has reduced mean times to detect and to respond by 40% and compressed the human work required by 12x. By Willem Berroubache

submitted by /u/ffatty [link] [留言]

submitted by /u/Electronic-Cook-9227 [link] [留言]