标签：#m

A patient opens their prescription and sees 500mg instead of 50mg. A lab report displays "Normal"...

The Hidden Cost of Manual IAM Review Most teams don't track how long they spend reviewing IAM policies. When I started measuring it on my own team, the numbers were worse than I expected. A thorough manual review of one IAM policy takes 10 to 15 minutes. Not a quick scan. A real review: read every statement, trace every cross-account trust, verify every condition key, check for privilege escalation paths, confirm the resource ARNs match what you think they should. At 4 engineers touching IAM once a week, that's 4 hours a month. 48 hours a year of senior engineers reading JSON documents. And that's the optimistic case. Add a security incident. Add an audit. Add the emergency Friday-afternoon policy change that needs review before deploy. The real number is higher. What manual review misses The problem isn't just the time. It's that humans are bad at repetitive structured-data review, especially under time pressure. Here are the things I've seen slip through manual IAM reviews on production systems: iam:PassRole with no condition. This is the big one. PassRole lets a principal pass a role to a service — and if there's no iam:PassedToService condition, that role can be passed to any service that accepts roles. Including services the attacker controls. The reviewer saw the action, mentally categorized it as "role stuff," and moved on. It was statement 47 of 52 — the reviewer had already been reading policies for 40 minutes. Wildcard resource with sensitive actions. s3:* on Resource: "*" is obvious. s3:GetObject on "arn:aws:s3:::*-backup/*" with a wildcard in the bucket name — that's subtle. The reviewer reads it as "restricted to backup buckets" and moves on. But the wildcard means any bucket ending in -backup , including ones in other accounts if cross-account access is configured. Missing aws:SourceArn on Lambda invocation permissions. When you grant another service permission to invoke your Lambda function, you need aws:SourceArn to prevent the confused deputy

"Increasingly in our world, it gets harder and harder to know what is real," Lorde said onstage.

Old and forgotten "shims" Microsoft failed to revoke have made Secure Boot bypasses simple.

Citizens must now spend 21 days in a third country before they are allowed to come home.

The restrictions, which can be turned off, will include a crackdown on “addictive” app features and will be in addition to a total ban on children under 16 accessing platforms like TikTok and YouTube.

Hello all: I am just about finished with my first production-quality app. I developed it for macOS and Windows with full platform parity and am about to port to Ubuntu/Debian before releasing. I have licensing setup through Keygen.sh. I am happy with that decision so far; however, I have questions regarding that issue and the issue of telemetry. Privacy is a focus of mine and a commitment I made to prospective subscribers. That said, I need some form of telemetry and a DRM that can take subscription payments. I am trying to think of the best way to implement the Keygen.sh API for privacy. The app has, well, an app--the client--and it also has a remote server component. It will mostly be free but the more labor intensive developed elements and the tools that require the remote server will be paid at either a monthly or annual subscription rate. I am so confused about how to best implement the licensing API while remaining true to my privacy commitments. Part of me says, "Well, their information is going to be on Keygen's servers anyway, might as well host the store through their website/portal." The other inclination is to host the store on my server/website, so I can control how much information PII is required. The answer can be “very little,” but a much bigger question arises surrounding what to do with the information once accepted. (I’ve considered maintaining the subscriber data in some kind of encrypted space on the server with hardcoded, volatile keys. That way not even I can see their data, but they’d still be able to search for and regenerate their licenses, management payment methods, etc.) The other question I have is along that same vein and involves telemetry. What I would like to do is keep the telemetry deliverables locally stored. When the user has an issue, experiences a bug, or has some other issue requiring my troubleshooting assistance, I can request it and they can choose to release their telemetry data to me. In between those disclosures, using

The Google Cloud Workbench Notebooks extension for VS Code is a new tool that enables developers to connect their local IDE directly to managed Jupyter notebook environments on Google Cloud. By Sergio De Simone

One weekend I wrote an LLM eval framework in about two hundred lines of Python. It demoed beautifully. I felt clever. Six months later that same framework was a mess. Three different judge models with three different parsing hacks. A test dataset nobody had touched since November. A CI gate that kept failing because a vendor nudged their model, not because anyone broke a prompt. And the second engineer on rotation asking me, fairly, "how does this even work?" The framework did not fail. The eighty percent of the work the weekend tutorial skipped is what failed. That gap is the whole story, and this is what I would tell myself before starting again. The one line I wish someone had told me: build the rubric, buy the runner Here is the split that took me six months to see. Some parts of an eval setup are yours and only yours. The rubric that decides what "good" means for your product. The dataset built from your real failures. The rules for when a change is bad enough to block a release. Nobody else can write these, because they encode your domain. The rest is the same at every company. The thing that calls the judge model, parses its answer, retries, and caches. The machinery to run thousands of checks in parallel. The plumbing that scores live traffic. The system that groups failing calls together. Every team rebuilds these, hits the same bugs, and gains nothing by writing them twice. So build the first list. Do not hand-build the second. I rebuilt the second, and it cost me most of a year. Two questions I now ask about every single piece Before writing any part of this, I ask two things: Is it specific to me, or generic? A rubric for my domain is specific and worth owning. A retry-and-cache loop around a model call is generic. Everyone writes the same one. Does it compound, or does it rot? A dataset that grows from real production failures compounds. A year in, it is a regression suite no competitor can copy. A hand-built tracing layer rots. The moment a vendor chan

It seems some people take issue with one billionaire family overseeing a third of the US' entertainment media.

SPOILER: De 1 à 2000 Durante minha jornada como jogador , existiu uma coisa que me despertou muita curiosidade: os créditos. Quando eu jogava coisas como Final Fantasy, ficava completamente arrepiado quando via aquelas cenas antes do menu inicial, com CGIs bem bonitões e um monte de nomes em japonês — muitos deles que, honestamente, até hoje não sei quem são. Esse arrepio também acontecia quando eu chegava ao final de algum jogo e começavam a aparecer nomes e mais nomes. Quando eu entendi o que eram aqueles nomes, a primeira coisa que me veio à mente foi: peraí, precisa de tudo isso de gente pra fazer um jogo? Too long, didn't read : Sim e não. Skyrim levou aproximadamente 6 anos com uma equipe de 100 pessoas (e ainda é dito que é uma equipe enxuta), enquanto Stardew Valley levou 4,5 anos com uma "equipe" de apenas 1 pessoa. Eles têm quase o mesmo tamanho em horas jogadas na campanha principal. Not too long, I'll read it : É um pensamento lógico que trabalhos maiores no mundo da tecnologia envolvam uma quantidade maior de pessoas trabalhando E tempo. Dessa forma, seria correto assumir que um trabalho menor exige menos tempo e menos pessoas trabalhando. Mas o que os dados dizem? King of Fighters 94: 2 anos, começou com 6 pessoas, aumentou para 60. Clair Obscure - Expedition 33: aproximadamente 6 anos, 30 pessoas. TES V - Skyrim: 6 anos, 100 pessoas. Super Mario Bros: 2 anos, 7 pessoas na equipe principal. Stardew Valley: 4,5 anos, 1 pessoa. Kenshi: 12 anos, 1 pessoa por 6 anos (trabalhando meio período), aproximadamente 8 pessoas por mais 6 anos (tempo integral). Final Fantasy VII (PS1): aproximadamente 2 anos, de 100 a 150 pessoas (uma das maiores equipes da indústria na época). Final Fantasy VII Remake: Cerca de 5 anos, e não se tem números exatos, mas os créditos citam mais de 2000 pessoas, incluindo muitos -istas e -ores (vou tentar confirmar esse número depois). É claro que existem muitos fatores envolvidos aí, como época, demandas de mercado, prazos, tecnologia

Design + Product Thinking: NYC’s Path to Reliable AI AI delivers value when it’s useful, trusted, and operational. For city services that affect millions, those qualities don’t happen by accident — they come from applying design thinking (who the service is for, how it’s used) together with product thinking (what outcome we’re trying to achieve and how we operate over time). This article explains why hiring designers and product managers matters for NYC’s digital and AI initiatives, summarizes the city’s PIT Crew program, and outlines how Flamelit applies outcome-focused delivery in the public sector. Why design and product roles matter Designers and product managers have distinct but complementary responsibilities that reduce common AI delivery failures: Designers (Design Thinking): center human needs, prototype user flows, and validate that interfaces and decision workflows are understandable and accessible. They surface usability and trust issues early, preventing technically accurate models from becoming unusable in practice. Product managers (Product Thinking): define the measurable outcomes, prioritize use cases, align stakeholders, and manage the lifecycle from discovery to ongoing operations. They ensure work is evaluated against mission impact, not just technical metrics. Together they prevent common failures: building technically impressive models that nobody trusts, deploying brittle systems without human review, or shipping features with unclear ownership that decay in production. PIT Crew and NYC hiring context NYC’s PIT Crew program is a city initiative designed to attract and staff product, engineering, and design talent for public service projects. It’s a practical recognition that public-sector digital transformation needs people skilled in user research, product management, and delivery. Read more about the PIT Crew and how it works here: https://www.nyc.gov/content/pitcrew/pages/ (open in a new tab). Hiring programs like PIT Crew help create the c

Genkit Agents API, ORA, Python AI Explainer: New Tools for Workflow Automation Today's Highlights This week, Google's Genkit ships a powerful Agents API for TypeScript and Go, featuring human-in-the-loop capabilities for robust production deployments. Additionally, a new Go-based open-source task orchestrator, ORA, emerges for efficient model routing, alongside a practical Python tutorial for building an AI error explainer. Google's Genkit Ships Agents API with Detached Turns and Human-in-the-Loop for TypeScript and Go (InfoQ) Source: https://www.infoq.com/news/2026/07/genkit-agents-api-preview/?utm_campaign=infoq_content&utm_source=infoq&utm_medium=feed&utm_term=global Google has released a preview of its Genkit Agents API, significantly enhancing its open-source AI framework for building generative AI applications. This new API introduces features critical for deploying robust AI agents in production, specifically "Detached Turns" and "Human-in-the-Loop" functionalities. Detached Turns allow agents to operate asynchronously, handling long-running tasks or waiting for external events without blocking the main workflow, which is essential for complex, multi-step agentic processes. The Human-in-the-Loop feature provides crucial mechanisms for human oversight and intervention, ensuring reliability, safety, and compliance in critical applications where full automation is not yet feasible or desirable. The Genkit Agents API supports both TypeScript and Go, targeting a broad range of developers integrating AI into existing systems or building new agentic workflows. By offering structured patterns for agent interaction, state management, and human review, Genkit aims to streamline the development and deployment of intelligent agents, addressing key challenges in control and reliability for real-world AI applications. Comment: The introduction of Human-in-the-Loop into Genkit's Agents API is a game-changer for production-grade agent systems, offering the control and reliab

Microsoft just released a long list of improvements for Windows 11 as part of its bigger patch Tuesdays, and that includes the ability to pause updates indefinitely, as reported earlier by Windows Central. This option rolled out to Windows Insiders earlier this year, allowing you to hold off on updates for up to 35 days […]

For a long time, teams treated browser test reliability as a framework problem. When tests failed, the usual response was to change selectors, add waits, increase retries, or replace one automation library with another. That approach made sense when the main challenge was simply controlling a browser. Modern applications are different. A single user journey may now include an identity provider, multi-factor authentication, a streaming AI response, a background API request, a feature flag, a canary deployment, and a frontend rendered differently across several operating systems. The test framework is still important, but it is only one part of the reliability problem. The bigger question is whether the entire testing system gives the team enough evidence to make a release decision. Headless failures are usually a symptom, not the real problem A common example is a test that passes locally but fails only in headless Chrome. It is tempting to assume that headless mode is simply unreliable. In practice, the difference is often caused by viewport size, rendering behavior, animation timing, fonts, resource loading, or elements being positioned differently when no visible browser window exists. This breakdown of why browser tests fail only in Chrome headless is useful because it separates several failure categories that are often grouped together as “timing issues.” That distinction matters. A test that fails because an element is outside the viewport needs a different fix from a test that fails because a network request completes later in CI. Adding a longer timeout may hide both problems temporarily, but it does not make the test more trustworthy. Retries can make a weak test suite look healthy Retries are one of the easiest ways to reduce visible failures in CI. They are also one of the easiest ways to hide instability. A flaky test that passes on its third attempt still consumed runner time, delayed feedback, created extra logs, and made it harder to determine whether

Hello Reddit, I'm 33, currently in school for my Bachelor's in IT (~2 years from graduation). I am taking Calculus (Math 110 at Penn State) for the 3rd time. I failed it twice before. I am currently a nurse of 10 years going back to school. I am taking a summer class version of it, which I did not realize is accelerated / asynchronous, and am slowly starting to do poorly in it. My end goal after school is to work remotely in a programming-related job. But math has always been hard for me. So I am asking: -Any tips / resources / insights for passing Calculus -Any way I can pursue a degree in programming / computers without having to take Calculus -what other degree options that aren't math heavy will allow me to pursue tech-related careers? Open to suggestions, but my necessity list is being able to work remotely and earn a comfortable living abroad. Thanks! submitted by /u/Born_Cod_8931 [link] [留言]

Meta cut its workforce by 10 percent in May.

If Claude can already search the web, read a 10-K, and explain what a rate cut does to long-duration equities, the fair question is why you would connect anything to it at all. It is the right question, and the honest answer is that for a large class of questions you should not. Raw Claude is enough. The gap is narrower and sharper than "Claude does not know finance." Claude knows finance. What it does not know is you. What raw Claude already does well Be clear about this before the sales pitch, because pretending otherwise would insult anyone who has actually used it. Claude with web search will look up a current quote, summarize an earnings call, explain a valuation multiple, walk you through how a Monte Carlo simulation works, and reason about a macro scenario better than most of the commentary you would read instead. If your question is about the world, and not about your own balance sheet, a connector adds nothing. Ask Claude directly. The trouble starts the moment the answer depends on what you actually own. Four things that break when the question is about your money 1. It starts from zero every time A chat has no memory of your holdings. You can paste them in, and many people do, and it works for exactly one conversation. There is no cost basis, no purchase date, no daily snapshot series behind it. So "how concentrated am I really", "what is my realized gain this year", and "how correlated are my top five positions over the last 90 days" are not questions it can answer. It can only answer them about the numbers you re-typed, this once, from memory. 2. The same question gives a different answer twice LLM inference is not deterministic, and it is not deterministic even at temperature zero. Thinking Machines Lab traced the cause to batch-invariance in inference kernels: the batch your request lands in varies with server load, so the arithmetic varies with it. They fixed it in a research setting and got 1,000 bitwise-identical runs, which tells you how much engi

Look inside almost any modern connected device -- a smartphone, a smartwatch, a Wi-Fi thermostat, a battery-powered sensor node -- and you will find a processor core designed by ARM. It is one of the most successful engineering ideas in computing history. And here is the strange part: ARM has never manufactured a single one of those chips. It does not own a factory. It sells blueprints. A three-person project in Cambridge The story starts at Acorn Computers in Cambridge, England, in the early 1980s. Acorn had built the BBC Micro, a hugely popular educational computer in the UK, and it needed a faster processor for its next machine. The commercial chips available at the time were disappointing, so a tiny team decided to design their own. The acronym everyone knows today originally stood for Acorn RISC Machine . Sophie Wilson designed the instruction set and wrote the simulator; Steve Furber led the physical chip design. RISC -- Reduced Instruction Set Computing -- was the key bet. Instead of piling on complex instructions, they kept the instruction set small and simple, which made the chip easier to build, cheaper, and remarkably power-efficient. The first silicon, the ARM1, was fabricated by VLSI Technology and delivered to Acorn on 26 April 1985. When the team powered it on, it simply worked -- first try. For anyone who has designed hardware, that is almost unheard of; new processors normally need several rounds of revisions to shake out design errors. A famous piece of Acorn lore is that the early ARM chips drew so little current they could keep running on leakage alone after the power was disconnected. From a British computer to the whole world Acorn the computer company faded, but the processor design did not. In 1990 the ARM team was spun out into a separate joint venture, and the acronym was quietly re-expanded to Advanced RISC Machines . The new company made a decision that defined its future: it would not build chips. It would license the designs and let oth

submitted by /u/Independent_Pitch598 [link] [留言]