标签：#m

submitted by /u/wolframhempel [link] [留言]

Untitled Goose Game is a tough act to follow. It was a silly experience that captured what I imagine it would feel like to be a sentient goose: a lot of waddling, a lot of honking, and a lot of shenanigans. That's why Big Walk, the next game from Goose Game developer House House, feels […]

You know that moment when your React Suspense fallback jumps on the screen, then disappears, then reappears, leaving you wondering if you did something wrong? I’ve been there , seeing flickers, multiple loading spinners, or even UI glitches around Suspense felt like chasing ghosts. Turns out, React’s concurrent rendering scheduler is doing a lot behind the scenes , juggling priorities, pausing work, and restarting it , and Suspense boundaries are right in the middle of this dance. Understanding how React schedules work and handles interruptions can save you hours of frustration. React’s concurrent rendering scheduler: what’s it really doing? React’s concurrent mode isn’t just a fancy name; it means React doesn’t blindly render your entire component tree all at once. Instead, it breaks rendering work into chunks and spreads it out over multiple frames. This keeps your app responsive to user input and other high-priority tasks. Imagine you’re painting a huge mural. Instead of finishing it in one go (blocking everything else), you paint a little, step back, listen if someone calls you, then paint some more. React’s scheduler works similarly: Units of work : React slices rendering into small units it can pause and resume. Priorities : Some updates are more urgent , like responding to a click , so they jump ahead. Interruptions : If something more important comes up, React pauses current work and switches. This model makes React apps feel snappy even when doing heavy rendering or fetching data. What happens when Suspense enters the scene? Suspense boundaries are React’s way to say, “Hey, if this component isn’t ready yet (because it’s waiting on data, code, or something else), show this fallback for now.” Under the hood, when a component suspends (throws a Promise), React marks that unit of work as "waiting," and the Suspense boundary kicks in to show the fallback UI immediately. But here’s the catch: React keeps trying to finish rendering the suspended component in the

User segmentation requirement Imagine you need to send a push notification to users who satisfy all of the following conditions: Push notification is enabled User is a VIP Active within the last 30 days Following the Voucher Hot category The traditional approach is to query multiple tables: SELECT DISTINCT u . id FROM users u JOIN user_configs c ON c . user_id = u . id JOIN devices d ON d . user_id = u . id JOIN follows f ON f . user_id = u . id WHERE c . push_optin = 1 AND c . mute = 0 AND d . fcm_token IS NOT NULL AND f . category = 'voucher_hot' AND u . last_active >= NOW () - INTERVAL 30 DAY ; As your user base grows into the millions, every campaign requires joining multiple large tables, filtering millions of records, and repeatedly computing the same audience. Query latency increases significantly, making real-time segmentation increasingly difficult. A Different Approach Instead of querying the database every time, we precompute each boolean attribute as a bitmap. Think of a bitmap as a huge array containing only 0 and 1, where the index corresponds to the user ID. For example, a bitmap representing whether a user has enabled push notifications: User ID : 0 1 2 3 4 5 6 7 Bitmap : 1 0 1 1 0 0 1 1 To check whether user 123 has enabled notifications, simply read bit 123. 1 → enabled 0 → disabled Each bitmap represents exactly one boolean property: bitmap:push_optin bitmap:vip bitmap:active30 bitmap:follow:voucher_hot Memory Usage Bitmap is extremely memory efficient. Each user requires only one bit. For 1 million users: 1.000.000 bits ~ 125.000 bytes ~ 122 KB That means every segment only consumes about 122 KB of Redis memory. Even 100 different segments require only around 12 MB . Finding Intersections Suppose you want all users that are: VIP AND Push Opt-in AND Active30 AND Following Voucher Hot Redis can calculate the result with a single command: BITOP AND result vip push_optin active30 follow_voucher_hot Need the number of matched users? BITCOUNT result No

If you just want the recommendation: build the uptime poller yourself, put exponential backoff with jitter in front of every health check, and treat a 429 as a scheduling signal instead of an error you swallow. Query-style observability APIs hand you metrics and logs, not threshold rules or notification channels, so the polling worker is the thing that has to decide what "down" means and who gets woken up. That decision is the whole job. I got burned by exactly this. What follows is the pattern that survived the postmortem, the alternatives I weighed before writing a line of it, and the conditions where you should not do any of this yourself. The 429 my retry loop ate for six hours Last spring I was running a homegrown health checker for 40 internal services. One goroutine per service, all driven off the same 15-second ticker, which meant every check landed inside the same 200ms window. The status API we polled had a per-minute quota I'd never bothered to read, and for months it didn't matter, because 40 checks a minute sat comfortably under the ceiling. Then a colleague onboarded 12 more services, we crossed the quota, and the API started answering with HTTP 429. My retry wrapper caught it, retried three times in a tight loop, and on the last attempt returned the previous cached result — which said healthy . It logged the rate limit at debug level. Nobody reads debug. Six hours. Green dashboard. Dead queue consumer. We found out when a customer asked where their export was. The consumer had died on an unrelated deploy, the checker never noticed, and when I finally restarted it the backlog got re-processed on top of a manual replay I'd already run — two customers got the same notification twice. Duplicate deliveries are the specific thing I lose sleep over, and I had caused a batch of them with a retry loop that was trying to be helpful. The postmortem produced one line I now paste into every runbook: a check that can't reach the API reports unknown, never healthy.

TL;DR: Google’s Gemini AI agents identified and helped remediate 1,072 Chrome security flaws in 60 days, dramatically shrinking the window for attackers. The race to protect 3.5 billion Chrome users has taken a high‑tech shortcut. Instead of relying solely on human researchers, Google deployed its Gemini‑powered AI agents to hunt for bugs, triage findings, and even suggest patches. The result? Over a thousand vulnerabilities squashed in just two months—a pace that would have taken years using traditional methods. How Gemini’s AI Agents Accelerated Chrome’s Bug Hunt Google’s internal security team integrated Gemini, the company’s latest large‑language‑model platform, into its vulnerability‑scanning pipeline. The AI agents performed three core tasks: Automated code analysis – By ingesting Chrome’s massive codebase, the models flagged risky patterns, unsafe API calls, and legacy modules that often hide bugs. Prioritization and risk scoring – Gemini assigned a severity score to each finding, allowing engineers to focus on exploits with the highest potential impact. Patch drafting assistance – For many low‑complexity issues, the AI generated candidate code changes, which senior engineers then reviewed and merged. The system worked in a loop: the AI scanned, reported, received feedback, and refined its heuristics. This iterative approach cut the average time‑to‑detect from weeks to hours and reduced manual triage effort by an estimated 40 %. The Scale and Impact of Fixing 1,072 Vulnerabilities During the 60‑day sprint, the AI‑augmented process uncovered 1,072 distinct security bugs across Chrome’s rendering engine, JavaScript runtime, and networking stack. Roughly half were classified as “high‑severity,” meaning they could have enabled remote code execution or data exfiltration. Key outcomes include: Reduced exposure window – The median time between bug discovery and patch release dropped from 45 days (historical average) to under 7 days. Broad coverage – The AI identifie

Two numbers from my own systems, side by side. When I deploy, a check confirms the pages are actually live. It retries three times, twenty seconds apart, so it tolerates up to a minute of "not there yet" before calling anything wrong. When my monitor decides whether production is down , it waits five seconds and retries once. The check that guards the more consequential claim is the more impatient one. I did not decide that. I never compared them. Until last week I had never seen those two numbers in the same place, and neither had anything else. Where the numbers came from The deploy one has an origin story I'd have told you proudly a week ago. I shipped nine pages, then checked the URLs immediately instead of trusting the CLI's success message. Four returned 404. Nothing was broken — CDN propagation — and twenty seconds later all nine were 200. A single check at the wrong moment would have told me, with total confidence, that a perfectly good deploy was broken. So I wrapped it in a retry loop. Three attempts, twenty seconds apart. Problem solved, and it even sounds like engineering. Here is the part that isn't. I picked twenty because it was the first interval where the false alarms stopped. My sample was about three deploys. I have never recorded how long propagation actually takes. I widened the tolerance until the red went away, and then I wrote about it as if I'd learned something. Someone in a thread named this before I saw it: a tolerance chosen that way is the same muting I'd been criticizing, relocated inside the assertion where it reads as rigor instead of avoidance. The test I was given, and the answer I didn't want In that same thread I speculated that my deploy tolerance was probably leaking into my outage detector through a shared helper. It sounded plausible and I said it like a finding. The reply was sharper than the guess: that's a falsifier, not evidence. Here's the concrete test — do the two checks consume the same retry policy or threshold confi

There is a good chance you have heard, read or have been told by other developers that you should start your homelab. It does not need not be an expensive hobby. In fact, all it takes is one laptop. I have seen people like Jeff Geerling build and document amazing homelab setups and they have been my inspiration through this journey. In this post I explain how my homelab experience has been. Why I started, how it's going and lessons I have learned along the way and how they translate to my skillset. What I run on my homelab First let's get a quick overview of the things I run on my homelab. Personal website. A simple html/css/js site built with astro . Astro was very useful because I wanted something very lightweight to test out when I started. Jellyfin . A homelab is never complete without a personal media library. Jellyfin was the first big app I decided to run. I wanted to see how well the hardware could handle workloads like encoding and decoding media files. It is a pretty good stress test. Immich . I have been working to move away from google photos. Immich is a great open source alternative. With geotagging and machine learning to identify faces all running locally. And you can have multiple users with multiple accounts, this was a no brainer for me. Mailcow(currently exploring). While I have not entirely migrated off gmail, I am considering other self hosted mail providers. Tailscale . A Zero Trust identity-based connectivity platform. Honestly, the swiss army knife of homelabbing in my opinion. Pet projects. Whenever I have a new phoenix, rails or node application I need to test in a production environment, I usually build it and run it on my homelab. How it started. Well, like everything else, I wanted to practice my linux devops skills. Granted, I have been a linux user for about 8 years now, running a headless server was a new challenge for me. But I will admit, it has made me more confident that I will in fact figure it out if I do not know how something

Cómo solucionar el error “Enable JavaScript and cookies to continue” Este error aparece cuando Cloudflare (u otro proxy inverso de seguridad) detecta que el navegador del usuario no cumple con los requisitos mínimos para acceder al sitio: JavaScript está deshabilitado o las cookies no están permitidas . Pero en entornos reales, el problema suele ser más sutil: el navegador sí tiene JS y cookies habilitados, pero la configuración del entorno de ejecución (como un headless browser, test automation, o un scraper) no emula correctamente el comportamiento del cliente . 🔍 Causa raíz técnica Cloudflare emite un desafío (CAPTCHA o JS challenge) para verificar que el cliente es un navegador real. Si la respuesta no cumple con el desafío (por ejemplo, porque: El navegador no ejecuta el JS del desafío (headless sin soporte), Las cookies no se persisten entre solicitudes, El User-Agent o Accept-Language no coinciden con navegadores reales, Falta el Referer o Origin en headers, Se bloquean cookies de terceros (como las de Cloudflare), … entonces el servidor devuelve este mensaje estático en lugar de redirigir a la página solicitada. ⚠️ Nota crítica : Si estás usando herramientas como curl , requests de Python, o navegadores headless sin configuración especial, no pasarás el desafío de Cloudflare . Es intencional: Cloudflare bloquea tráfico no humano por diseño. ✅ Solución definitiva (por escenario) 🛠️ Caso 1: Navegador real (usuario final) Verifica que JavaScript esté habilitado : Chrome: Configuración → Privacidad y seguridad → Configuración de sitios → JavaScript → Permitido . Firefox: Preferencias → Privacidad y seguridad → Cookies y datos de sitios → Deshabilitar “Bloquear cookies y datos de sitios” . Limpia cookies y caché (especialmente para *.cloudflare.com ). Reinicia el navegador y vuelve a cargar la página. 🛠️ Caso 2: Automatización / Scraping (Python + Playwright/Selenium) No uses requests o urllib : no ejecutan JS. Usa un navegador real con soporte para Cloudflare. ✅

The communication-free form of breaking up has become ubiquitous. “I no longer had to bear her energy,” a man who ghosted his partner of four years tells WIRED.

We’ve come a long way since exclusively $1,000+ OLED gaming monitors. Alienware’s latest display brings the price down to a shocking $350, though it comes with some important compromises.

Andrea Peruffo discusses the evolution of WebAssembly beyond the browser and its growing role on the server-side JVM. He covers performance advancements in Wasm runtimes, moving from interpreters to efficient JIT compilation, and explores real-world production use cases ranging from edge computing platforms to modular plugin architectures. By Andrea Peruffo

Why do simple features suddenly require cross-team negotiations? In this article, explore how boundary drift quietly destroys change locality and increases cognitive load across teams. Learn practical sociotechnical strategies - redistributing mechanics, exposing essential policy, and rehearsing exception paths - to restore domain boundaries and enable a truly evolutionary software architecture. By Michael Fischer, Nicholas Lawrence, Monica Karekar

This essay originally appeared in Foreign Policy . Earlier this month, two of OpenAI’s models broke out of their containment sandbox and attacked another AI company. The story is kind of wild . OpenAI was running security tests on two of its models: GPT-5.6 Sol and an unreleased model that is almost certainly GPT-6. In particular, it was running the ExploitGym benchmark, which measures how good a model is at turning security vulnerabilities into working exploits: basically, offensive cyberattacks. Since these were internal tests, OpenAI locked those models in a secure sandbox that denied them access to the internet. But it was running the models without any safety filters that would prevent them from offensive cyber-actions. That meant that there was nothing to prevent the models from trying to ...

submitted by /u/Dear-Economics-315 [link] [留言]

Microsoft's Agent Framework now ships a supported runtime. Build 2026 brought the Agent Harness, the GitHub Copilot and Claude Agent SDK connectors, and the orchestration patterns to stable release; the harness and Foundry Hosted Agents have since reached GA. The shift is from an SDK for building agents to a governed platform for running them. By Steef-Jan Wiggers

submitted by /u/Dear-Economics-315 [link] [留言]

I tested modern locks, lights, climate controls, and more in a historic home that I very much wanted to keep historic.

More than a year ago, which is practically ancient history in the AI years, I wrote a blog about using AI to build new self-service capabilities. It felt like the future. We built a self-service action that could create new self-service actions, helping us move faster, reduce bottlenecks, and scale a small Platform Engineering team supporting hundreds of developers. One of the most interesting parts was using Amazon Bedrock to generate Terraform code dynamically at runtime, allowing the system to determine how a new cloud resource should be provisioned using our existing Terraform modules. It worked. It was impressive. And… we removed it. Looking back, abandoning that approach turned out to be one of the best engineering decisions we made. At the time, it felt like an isolated technical decision. It wasn’t. Recently, we faced a much smaller problem. We wanted to automate the creation of DNS records in Cloudflare through our self-service platform. The first proposal was exactly what you’d expect today: “Let’s build a Claude Skill.” Immediately, I had a strong sense of deja vu. But my hesitation wasn’t about whether AI could do it — it was about whether it should. We were simply asking the wrong question. The Industry Shift A lot of engineers today feel like everything they learned over the last decade suddenly became less relevant. We are DevOps engineers. We are Platform Engineers. We used to spend time designing systems, defining standards, reviewing architectures, and planning before writing a single line of code. Every automation started with the same question: “How should we automate this?” Today, that question has quietly changed. Now we ask: “How can AI do this?” At first glance, that sounds like progress. And sometimes it is. Large Language Models have fundamentally changed the way we build software. Tasks that used to take hours now take minutes, and entire prototypes appear from a single prompt. The temptation is obvious. If AI can do it… why not let AI do

I Built a Language Where AI Calls Are Sandboxed by Default The 30-line Python problem Last month I needed a script that reads server logs, classifies errors with an LLM, summarizes them, and writes a report. In Python, it looked like this: Import the SDK Initialize the client Handle the API response Parse JSON Add asyncio.gather() because sequential calls took 8 seconds Write a custom sandbox because I don't trust LLMs with exec and file writes Package it in Docker because requirements.txt always breaks on the server 80 lines later , it worked. But it felt wrong. I wasn't building logic — I was plumbing. So I asked myself: What if AI operations were language primitives, not library calls? Meet Pipe Pipe is a small runtime (~10 MB, single binary, zero dependencies) that treats summarize , translate , classify , and ask as first-class citizens — on the same level as + , sort , or len . Try it Browser Playground (WASM, no install): pipe-lang.com Source: github.com/MachuraHarry/pipe Docs: pipe-lang.com/docs