标签：#m

MAGA is loudly calling for the former White House chief medical adviser to end up in prison. WIRED asked legal experts to weigh in on whether that’s even possible.

How a branch-free loop and byte-space arithmetic let GitHub case-fold every byte of code search at >45 GiB/s on a single core. The post Don’t stop early: Case-folding source code at memory speed appeared first on The GitHub Blog .

security #api #domain #subdomaintakeover #defcon #whois #rapidapi #threatintel DEF CON 32 made one thing clear: open-source security chips and hardware keys are having a moment. But while badges get the spotlight, most real-world attacks still start with something far less glamorous — a forgotten DNS record, a dangling CNAME, or a missing DMARC policy. Subdomain takeover remains one of the most reliable paths from "benign misconfiguration" to "account compromise." If your organization owns dozens or hundreds of domains, manual checks do not scale. This is where an API-first domain intelligence tool becomes essential. In this post, we'll use the Domain WHOIS API to automate: WHOIS/RDAP lookups and domain-age checks DNS record enumeration and SSL certificate inspection Subdomain discovery and takeover-risk scoring Email-security validation (SPF, DMARC, DKIM, DNSSEC, MTA-STS) Historical snapshots via /history Why subdomain takeover still matters A subdomain takeover happens when a DNS record points to a third-party service — GitHub Pages, Heroku, AWS S3, Vercel, etc. — that is no longer registered under your account. An attacker can claim the dangling endpoint and suddenly serve content under your brand's domain. Bug bounty programs consistently rank subdomain takeovers as high-severity findings because they enable phishing, session hijacking, and reputation abuse. The root cause is usually an orphaned CNAME that nobody is monitoring. The fix is continuous monitoring. Instead of running dig , whois , and openssl by hand, we can consolidate everything into a single API call. What the Domain WHOIS API returns The API combines several data sources into one response: Capability Use case WHOIS via RDAP Ownership, registrar, creation/expiration dates DNS records A, AAAA, CNAME, MX, NS, TXT records SSL certificate Issuer, expiry, SANs, validity Subdomain discovery Asset inventory and shadow-IT detection Takeover risk Dangling CNAME/A-record scoring Email security SPF, DMARC,

I run a content pipeline that picks trending topics and publishes articles automatically. Last week I found out it had published the same story three times. Not the same title — the same exact topic, reworded each time. My dedup check was supposed to stop that. It didn't. Here's why, and how I killed the check. The Bug My pipeline had a similarity gate. Every candidate title got compared against the last 30 published titles, and anything scoring 0.58 or higher was rejected. Straightforward, right? from difflib import SequenceMatcher def jaccard_bigram ( a : str , b : str ) -> float : def bigrams ( s : str ) -> set [ str ]: return { s [ i : i + 2 ] for i in range ( len ( s ) - 1 )} x , y = bigrams ( a ), bigrams ( b ) return len ( x & y ) / len ( x | y ) if ( x | y ) else 1.0 def similarity ( a : str , b : str ) -> float : return max ( SequenceMatcher ( None , a , b ). ratio (), jaccard_bigram ( a , b )) THRESHOLD = 0.58 Here's the pair that slipped through. The candidate: 中国军队国际形象网宣片《当红》 And a title I had already published: 《当红》网宣片刷屏，普通人看到的中国军人是什么样 Same film. Same topic. Third time it was being covered. Watch what the algorithm did: candidate = " 中国军队国际形象网宣片《当红》 " published = " 《当红》网宣片刷屏，普通人看到的中国军人是什么样 " print ( similarity ( candidate , published )) # SequenceMatcher: 0.187 # jaccard bigram: 0.185 # max: 0.187 < 0.58 -> PASSED 0.187. The gate let it through with a five-fold margin to spare. Why It Failed The name 当红 is the same in both titles. That is the whole topic. But the algorithm does not care about that. SequenceMatcher matches in order. In the published title, 当红 sits at position zero. In the candidate, it is at the end. Reordered tokens break the match, so the ratio collapses to the shared fragments — 网宣片 plus the generic words around it. The bigram fallback does not save you either. Jaccard over character bigrams measures surface overlap, not meaning. Five shared bigrams out of twenty-seven total. 0.185. It "proves" the titles are unrelated because most of

Three frontier launches. Two weeks. One bad habit. The habit is crowning a winner from a press release. Claude Sonnet 5 on June 30. OpenAI's GPT-5.6 family rolling into general availability around July 9. Grok 4.5 on July 8, co-trained with Cursor and priced to make coding agents feel cheap. The charts moved. The posts multiplied. The claim underneath most of them was the same: this is the model you should standardize on. [The claim is nonsense. Standardization is the risk. Routing is the skill.] What actually shipped Strip the demos. Keep the operator facts. Model Maker Window Operator-relevant shape Claude Sonnet 5 Anthropic late June Balanced agent runs, coding, long reliable chains GPT-5.6 Sol / Terra / Luna OpenAI late June to mid-July Tiered family: flagship Sol, everyday Terra, cheap Luna Grok 4.5 xAI + Cursor July 8 Coding and agent work at aggressive API pricing OpenAI gated GPT-5.6 longer than the others. Safety review, staged partners, then broader access. That is part of the product story now, not a footnote. Anthropic and xAI moved faster to availability. Access policy is a feature. Open source did not wait. GLM-5.2, DeepSeek V4, Qwen 3.6 and peers kept closing the gap for hosted and self-hosted work. The frontier is crowded. The "one brain for everything" era is over as an architecture choice, even if the marketing still pretends otherwise. Ranked by Tuesday impact, not leaderboard theater 1. Cost and tiering matter more than the top score. OpenAI shipping Luna / Terra / Sol as a family is the real product decision. You can route a triage job to a cheap tier and a hard research job to a flagship without changing vendors. That is operator infrastructure. A single "best model" headline is not. 2. Grok 4.5 inside Cursor changes the default coding bill. A model trained with Cursor interaction data, sold at roughly $2 / $6 per million tokens, is not a vibe. It is a budget line. Teams that were bleeding token spend on heavier agents will try it this month wh

AI data center demand is fueling a multi-year chip shortage, pushing up component costs and retail device prices.

Nearly 22 percent of children are on Pinterest while there was "no statistically significant change" in AI chatbot use.

If you've built an MCP App — the HTML widget an MCP server hands a host to render inline — you may have hit this: the tool call succeeds, structuredContent comes back fine, the model announces that a widget rendered, and the user sees nothing. No error. No console output. Just a gap in the conversation. There's a long issue full of people with this exact symptom, all of them (me included) posting variations of "my server is spec-correct and nothing renders." That's a hard thing to act on. So I built a probe server designed to answer one question at a time and ran it 36 times. This post is mostly about method — how you experiment on a host whose source you can't read and whose renderer you can't attach a debugger to. The MCP specifics are the worked example. The most useful part is at the end, where my measurements lied to me twice. Everything behavioural here was measured on 31 July 2026 against claude.ai web. Host behaviour changes; treat the numbers as a snapshot, not a spec. The finding, up front The most-upvoted lead in that thread says claude.ai silently refuses to place the iframe unless your resource declares _meta.ui.domain , computed as sha256(<your endpoint URL>)[:32] + ".claudemcpcontent.com" . Here's what varying that one field actually does: _meta.ui.domain iframe mounted sandbox origin computed value 10/10 one stable origin, every render absent 10/10 host default — differs per conversation present but wrong 0/8 never created Omitting it doesn't stop anything. What it actually controls is origin stability , which is exactly what the SDK docs say it's for: a fixed origin your API server can allowlist for CORS. But a wrong value is fatal. And the easy way to produce one is hashing an endpoint string that differs slightly from the URL the client connected with — a trailing slash, a missing path segment, http vs https . So the advice inverts the risk: follow it imprecisely and you convert a working app into a broken one. The original comment wasn't wrong ab

TimescaleDB 2.27, released May 12 2026, extends bloom-filter batch pruning from reads to writes. UPDATE, DELETE, and UPSERT against compressed columnstore data can now skip decompressing batches that provably cannot contain the target rows. The reported gains are real: up to 160x for selective UPDATE/DELETE, and over 2x for UPSERT. The feature is automatic. Whether it is actually firing on your workload is not something you can assume, and the only way to confirm it is to read new EXPLAIN counters that the release notes mention but do not explain. Worse, the counter names are inconsistent between the write paths, so even a careful reader ends up guessing. This post is about reading those counters correctly, and about the two things in this release that will silently break a query if you upgrade without noticing them. What is actually being skipped A quick model of the mechanism, because the counters only make sense against it. Hypercore stores compressed data in batches, roughly a thousand rows each. For columns that are not the segmentby key, TimescaleDB maintains a sparse bloom filter per batch: a small probabilistic summary that answers one question, "could this batch contain column = X ?", without touching the compressed payload. A bloom filter has a useful asymmetry. A negative is certain: if the filter says no, the value is definitely absent, and the batch can be skipped whole. A positive is not: the filter says "maybe", you decompress, and sometimes the value is not there after all. That last case is a false positive, and it is the number that tells you whether the whole scheme is paying off. Before 2.27, a DELETE ... WHERE sensor_id = 'x' against compressed data decompressed every candidate batch to check. Now the bloom filter is consulted first, and batches that cannot match are never decompressed. The work you save is the decompression of the batches that get pruned. The work you waste, when the filter is poorly matched to your data, is the bloom check on

So you have heard people rave about Claude Code. Maybe you have also heard people mention OpenRouter in the same breath, usually followed by some combination of environment variables and a screenshot of a terminal. If you are new to any of this, it can feel like everyone skipped a step and jumped straight to the jargon. This guide is that missing step. We will go slow where it matters, explain the confusing bits, and by the end you will actually understand what is happening instead of just copy pasting commands and hoping. The two things, quickly Claude Code is Anthropic's terminal coding agent. It reads your files, edits code, runs commands. By default it talks straight to Anthropic's servers. OpenRouter is a switchboard. It a switchboard for AI models. Instead of every app needing its own separate connection to every AI provider, OpenRouter sits in the middle and lets you route requests to different models through one account, one dashboard, and one place to watch your spending. (Even free and open source models!) You can check out all the models provided by OpenRouter here . Important honesty check: OpenRouter's own docs say this combo is only guaranteed to work well with Anthropic's own models. You're not really swapping Claude's brain out here, you're mostly rerouting the pipe it talks through. Quick vocab check: "OpenAI compatible" Claude Code sends requests in Anthropic's format. Some servers only understand OpenAI's format instead. Point Claude Code at one of those by mistake and you get garbled errors, like mailing a French letter to someone who only reads Spanish. OpenRouter has an endpoint that speaks Anthropic's format natively, so no translation step, no separate proxy needed. Wait, do I use zsh or bash? How would I even know This question stops more beginners than anything else in this guide, and it is a fair one. Here is how to check in ten seconds. Open your terminal and type this, then press enter: echo $SHELL You will get one of these back: Somethi

SpaceX is building a new power plant for xAI's Colossus data centers, but it won't remove existing, unpermitted turbines for many more months.

Viral tales of good triumphing over evil are racking up millions of views. They’re almost entirely AI-generated clickbait.

A full-stack approach to making advanced AI more capable, more affordable, and more widely useful.

The startup is building voice models designed to make AI phone calls pass the Turing test.

WhatsApp will automatically move messages from large businesses to a new folder a few hours after you receive them.

Dropbox has integrated Model Context Protocol (MCP) with its internal knowledge platform, Dash, to surface security design context during AI assisted code reviews. The system retrieves threat models and security requirements for pull requests, helping reviewers validate implementation against design intent. An InfoQ Q&A explores the architecture and key lessons learned. By Leela Kumili

The AI chatbot was more effective at creating “exploitable trust” than the humans.

Tesla had already reportedly prepped for the idea in the event that Beijing invades Taiwan.

Meta's smart glasses are supposed to alert bystanders when they're recording. Bypassing those safety features is trivially easy, unfortunately.

If your Wi-Fi is a bit sluggish, there are some things you should check before upgrading your router.