标签：#os

Multi-tenancy is the decision that quietly shapes your entire SaaS backend. Get it right and you scale smoothly to thousands of accounts. Get it wrong and you're rewriting your data layer under load, mid-growth, with customers watching. The good news: for most products the right answer is simpler than the internet suggests. The three models There are three canonical ways to isolate tenants, and they trade isolation against operational cost: Row-level (shared schema). Every table has a tenant_id\ column, and every query filters on it. One database, one schema, all tenants together. Schema-per-tenant. Each tenant gets its own PostgreSQL schema inside a shared database. Stronger isolation, more objects to manage. Database-per-tenant. Each tenant gets a dedicated database or instance. Maximum isolation, maximum operational weight. Why row-level wins for most SaaS For the overwhelming majority of B2B SaaS products, row-level multi-tenancy is the right default. It's the cheapest to operate, the easiest to run migrations against, and it scales further than founders expect. The objection is always "but isolation" — and Postgres has a strong answer. Row-Level Security (RLS) lets the database itself enforce that a query can only see its own tenant's rows. With Supabase , RLS is the native model: you set a policy once, and even a buggy query can't leak across tenants. Combined with a tenant_id\ on every table and an index that leads with it, this pattern comfortably serves large customer bases. One caution from hard experience: write RLS policies so helper functions run once per query, not once per row . A policy that re-evaluates a lookup for every row will quietly turn fast endpoints slow as tables grow. Wrap the check so the planner runs it as an init-plan. When to reach for stronger isolation Escalate deliberately, not reflexively: Regulatory or contractual isolation — a customer requires their data in a physically separate database. Noisy-neighbor risk — one whale tenant'

Microservices have a marketing problem: they're associated with the engineering cultures of Netflix and Amazon, so ambitious teams assume adopting them is what serious companies do. But those companies moved to microservices to solve problems of enormous scale and huge headcount — problems you almost certainly don't have yet. For most products, splitting too early is one of the most expensive mistakes you can make. Here's the honest trade-off. What a monolith actually gives you A monolith is one deployable application. That simplicity is a feature, not a limitation, especially early: One codebase, one deploy. No orchestration, no service mesh, no distributed tracing just to understand a request. Simple debugging. A stack trace crosses your whole request. You're not correlating logs across five services to find one bug. Fast local development. Run the whole app on your laptop and iterate. Easy transactions. Data consistency is a database transaction, not a distributed saga you have to design and get right. The modern version isn't a big ball of mud. A modular monolith enforces clean internal boundaries — separate modules with clear interfaces — giving you much of the organization of microservices with none of the network overhead. What microservices actually cost Splitting into services doesn't remove complexity; it moves it from your code into the network, where it's harder to see and reason about. You inherit a long list of new problems: Distributed systems failure modes — partial failures, retries, timeouts, and eventual consistency become your daily reality. Data consistency across services — no more easy transactions; you're designing sagas and compensating actions. Operational overhead — every service needs deployment, monitoring, logging, and on-call. Slower local development and debugging — reproducing a bug can mean running half your architecture. For a small team, this overhead can consume the very velocity you were trying to gain. When microservices genuin

LLM features are cheap to prototype and surprisingly expensive to run at scale. A demo that costs pennies becomes a five-figure monthly bill once real users arrive, because every request pays per token and it's easy to send far more tokens than you need. The good news: most AI bills are bloated, and a handful of tactics reliably cut them without users noticing any drop in quality. Right-size the model per task The most expensive mistake is using your biggest, smartest model for everything. Most work in a product doesn't need it. Route by difficulty: Small, fast models for classification, extraction, routing, and simple rewrites. Frontier models only for genuinely hard reasoning or high-stakes output. Implement a model router : a cheap first pass decides how hard the task is, and only the hard cases escalate to the premium model. This single change often cuts spend dramatically because the long tail of easy requests stops paying frontier prices. Cache aggressively Many requests are repeats or near-repeats. Don't pay twice: Exact-match caching — identical prompts return a stored response instantly and for free. A simple PostgreSQL or Redis lookup keyed on the request works. Prompt caching — most providers let you cache a large, stable prefix (system prompt, retrieved context) so you're only billed full price for the changing part. Semantic caching — for questions that are similar but not identical, match on embeddings and reuse an answer when confidence is high. Trim the tokens You pay for every token in and out, so waste is literal money: Compress prompts. Cut boilerplate, redundant instructions, and bloated few-shot examples. Shorter prompts that keep quality are pure savings. Retrieve less, better. In RAG, don't stuff twenty chunks in when three well-chosen ones answer the question. Re-rank and send only what's needed. Cap output. Ask for concise responses and set a max length; unbounded generations quietly inflate bills. Batch and stream For work that isn't real-t

This developer didn't expect his side project to grow to 300,000 users, but people love Roost because it's an alternative to an always-on, fast-paced online culture.

Lost an evening to this, so you don't have to. The fix everyone hands you is a single checkbox that quietly downgrades how your Mac stores its password. The clean alternative — Kerberos, the exact thing your iPhone already uses — is "impossible" according to three sources I dug up, one of them Apple's own Heimdal source. They're wrong. What follows is the whole path: why it breaks, why the popular fix is the bad one, and the two setups that actually work (a one-shot command and a hands-off automount). My Mac mini shares a folder over SMB. My iPhone mounts it fine. My Linux box: $ smbclient -L 192.168.0.153 -U tmlr%remote session setup failed: NT_STATUS_LOGON_FAILURE Same username, same password, rejected. Every "fix" on the internet ends with "turn on Windows File Sharing for that user on the Mac." That works, and it's the wrong answer. Here's why, and what to do instead. The problem The credentials are correct — the iPhone's connecting just fine. The handshake even completes; run it with -d3 and you'll see the full NTLMSSP exchange finish before the Mac rejects you. So this isn't networking, isn't the password, isn't the SMB dialect. It's authentication, and only Linux hits it. Why: two doors, one account macOS keeps several credentials for a local account, not one. Look: $ dscl . -read /Users/tmlr AuthenticationAuthority AuthenticationAuthority: ; ShadowHash ; HASHLIST:<SALTED-SHA512-PBKDF2,SRP-RFC5054-4096-SHA512-PBKDF2> ; Kerberosv5 ;; tmlr@LKDC:SHA1.XXXX ; LKDC:SHA1.XXXX ; Two things matter in there: HASHLIST is SALTED-SHA512-PBKDF2 (login) and an SRP verifier. There is no NT hash. There's a Kerberosv5 identity in a realm called LKDC:SHA1.<40 hex> . SMB auth has two doors into this account: NTLMv2 — validates against a stored NT hash. Linux smbclient and mount.cifs knock here. Kerberos — validates against the Mac's built-in Local KDC (LKDC), which every Mac runs. Apple clients knock here. Your iPhone walks through the Kerberos door and never touches the NT hash

The feature can do things like apply cinematic relighting to brighten up a dark clip, swap out a plain background for something fun, or add artistic styles to videos.

Most agent demos are one-shot loops. You open a terminal, give the model a task, watch it call tools, and then the process dies. That is fine for coding sessions. It is a weak shape for an assistant that is meant to live in your actual workflow. Talon is built around the other shape: a persistent agent process with frontends, memory, tools, background jobs, and swappable model backends. What it runs on Talon can expose the same agent core through: Telegram Discord Microsoft Teams terminal chat a desktop/mobile companion bridge That means the agent is not tied to one UI. The chat app is just a mouth. The core state, tools, memory, goals, and model backend live behind it. Backends are swappable The same harness can run through: Claude Agent SDK OpenAI Agents Codex Kilo OpenCode Each backend implements the same capability interface, so the rest of the system does not need to care which model runtime is active. It has real operating machinery The important parts are not flashy. They are the things that let an agent keep working after the first message: MCP plugins for tools cron jobs for scheduled actions triggers for condition-based wakeups persistent goals for multi-session work long-term memory heartbeat mode for background progress dream mode for consolidation per-chat model and effort settings This is the difference between "chat with a model" and "run an assistant". Install npm install -g talon-agent talon setup talon start Repo: https://github.com/dylanneve1/talon If this is the kind of agent infrastructure you want more of, a GitHub star helps the project get found.

The company is raising $10 billion, leading to a valuation of $130 billion.

Quantum mechanics gave us the transistor before we understood it. The same pattern is happening with AI right now — and the builders who recognize this will define what comes next. The argument that never ended — and the lab that didn't care In 1927, the greatest minds in physics gathered in Brussels for the Solvay Conference. Albert Einstein, Niels Bohr, Werner Heisenberg, Erwin Schrödinger, Max Planck, Marie Curie — twenty-nine of the most brilliant humans who ever lived, in one room. They were arguing about quantum mechanics. Specifically: what does it mean for a particle to exist in multiple states simultaneously until observed? Does reality require an observer? Is the universe fundamentally probabilistic? Is God playing dice? Einstein said no. Bohr said yes. Neither convinced the other. That argument never fully resolved. Nearly a century later, physicists still debate the interpretation of quantum mechanics — the Copenhagen Interpretation, Many Worlds, Pilot Wave theory. We have not settled it. Meanwhile, in 1947 — twenty years after the Solvay Conference — three engineers at Bell Labs in New Jersey quietly invented the transistor. William Shockley, John Bardeen, and Walter Brattain did not wait for the philosophical debate to conclude. They did not need to understand why quantum tunneling worked at a fundamental level. They understood it well enough to build something with it. That transistor became the foundation of every computer, every smartphone, every server, every piece of digital infrastructure that exists today. We built the entire digital civilization on something we still don't fully understand. Not despite the uncertainty. With it. The pattern repeating right now Across the internet in 2025 and 2026, a remarkably similar argument is happening. Will AI take all the jobs? Is it conscious? Does it hallucinate too much to be trusted? Are we building something we cannot control? Should we slow down? Should we stop? These are not trivial questions. The r

Installing Docker on Ubuntu should be simple, but in practice several Docker-shaped options compete for the same command name, each with different packaging, upgrade behavior, and security implications. This guide compares every major install path so you can pick the one that fits your machine. The options you will encounter include: docker.io from Ubuntu repositories docker-ce from Docker's official APT repository Docker from Snap Docker Desktop manually downloaded .deb packages the Docker convenience script rootless Docker Although they all provide container tooling, they are not interchangeable packages. The best choice depends on whether the machine is a developer workstation, a CI runner, a small server, a self-hosting box, or a production host. My default recommendation is calm but firm: for most technical users on normal Ubuntu machines, install Docker Engine from Docker's official APT repository. Use Ubuntu's docker.io only when distribution integration matters more than upstream Docker packaging. Avoid the Snap package unless you specifically want Snap behavior and understand its limits. Rootless Docker is worth knowing about, but it is not automatically the best default for every machine. This guide explains the tradeoffs, covers post-install security, and gives you clean installation paths for each method. Once Docker Engine is running, the Docker Cheatsheet is your daily command reference, and the Docker Compose Cheatsheet covers multi-container setups. Both sit alongside Git, VS Code, and CI/CD guides in Developer Tools: The Complete Guide to Modern Development Workflows . Quick Recommendation The table below summarizes which install path fits common scenarios. Use case Recommended install Developer workstation Docker official APT repo CI runner Docker official APT repo, version pinned if needed Small self-hosted server Docker official APT repo Production server Docker official APT repo, controlled upgrades Ubuntu-only conservative system Ubuntu docker.

The help button is the most important button in your delivery app that your QA team almost never...

Cases have risen quickly as officials are working to identify a common source.

Azure Storage SFTP is Microsoft's managed file transfer service on top of Azure Blob Storage, convenient, but billed continuously per endpoint (roughly $0.30/hour, ~$220/month) and tied to Azure AD. SFTPGo is an open-source file transfer server offering SFTP, FTP/S, and WebDAV with pluggable storage backends (local disk, Azure Blob, S3-compatible, GCS) and no per-endpoint charge. This guide deploys SFTPGo with Docker Compose and Traefik, sets up user auth (password + SSH key + 2FA), connects S3-compatible object storage, and covers the migration path from Azure Storage SFTP. By the end, you'll have a self-hosted file transfer server with the same capabilities at zero endpoint cost. Azure Storage SFTP → SFTPGo Mapping Azure Storage SFTP SFTPGo Equivalent Notes SFTP Endpoint SFTPGo SFTP Server Configurable port, default 2022 Azure Blob Storage Azure Blob backend Native support; point at the same container, no migration needed Azure AD Authentication LDAP/OIDC plugin External identity provider via plugin Local Users Web UI / REST API user management Hierarchical Namespace Virtual directories No HNS requirement Azure Monitor Built-in logging + webhooks/syslog Prerequisite: Linux server with Docker + Compose, a DNS A record for your domain, and (if migrating) an existing Azure Storage account with SFTP enabled plus the Azure CLI installed locally. Deploy with Docker Compose 1. Create the project directories: $ mkdir -p ~/sftpgo/ { data,config } $ cd ~/sftpgo 2. Create the environment file: $ nano .env DOMAIN = sftp.example.com LETSENCRYPT_EMAIL = admin@example.com 3. Create the Compose manifest: $ nano docker-compose.yml services : traefik : image : traefik:v3.6 container_name : traefik command : - " --providers.docker=true" - " --providers.docker.exposedbydefault=false" - " --entrypoints.web.address=:80" - " --entrypoints.websecure.address=:443" - " --entrypoints.web.http.redirections.entrypoint.to=websecure" - " --certificatesresolvers.letsencrypt.acme.httpchallenge=tr

Momentic, the company behind an AI-driven software testing platform, recently rearchitected its caching system to handle over 2 million queries per day across 20 billion total entries, while maintaining an average response latency of around 250 ms. This improvement was made possible by transitioning from PostgreSQL to the column-oriented database ClickHouse. By Sergio De Simone

Microsoft is the latest Silicon Valley giant to cut back on its AI spending.

One-Command Deployment: Self-Host Your AI Wallet with Docker and GHCR Would you trust a third party with your AI agent's private keys? If that question makes you uncomfortable, you're already thinking about self-hosting your wallet infrastructure — and WAIaaS makes it genuinely practical with a single Docker command. This post walks through how to get a fully self-hosted Wallet-as-a-Service running on your own server, with your own keys, under your own rules. Why Self-Hosting Your AI Wallet Actually Matters The rise of autonomous AI agents changes the stakes around custody. When a human manages a wallet, they can pause, verify, and think before signing. An AI agent operates continuously, potentially making hundreds of transactions — so the infrastructure holding those keys becomes critically important. Hosted wallet services make a trade-off: you get convenience in exchange for trusting someone else's server, someone else's rate limits, and someone else's uptime SLA. For many teams building experimental agents, that's fine. But for anyone running production workloads, handling real funds, or operating in environments with strict data residency requirements, the calculus shifts. Self-hosting gives you: Full key custody — private keys never leave your infrastructure No rate limits imposed by a third party — your server, your throughput Auditability — WAIaaS is open-source, so you can read every line of code handling your keys Network control — bind to localhost, put it behind a VPN, restrict egress however you want WAIaaS is built specifically for this use case: a self-hosted, open-source Wallet-as-a-Service designed for AI agents, deployable in one command. The One-Command Start The Docker image is published to GitHub Container Registry (GHCR) at ghcr.io/minhoyoo-iotrust/waiaas:latest . The fastest path to a running instance is: git clone https://github.com/minhoyoo-iotrust/WAIaaS.git cd WAIaaS docker compose up -d That's it. The daemon starts on port 3100 , bound to

AI law startup Norm has raised a $120 million Series C round led by Khosla Ventures, valuing the startup at $1.2 billion.

Microsoft is addressing a Windows 11 bug that caused a folder to take up several gigabytes of storage space. As spotted earlier by Windows Latest, Microsoft included the patch in its optional June 2026 update (KB5095093), which "improves disk space usage for the CapabilityAccessManager.db-wal file." The CapabilityAccessManager.db-wal file is installed on Windows 11 PCs by […]

"I'll just write a quick button style... and a text field with validation... and a card component..." Two weeks later you have a bespoke design system that only half the app uses, three slightly different buttons, and nothing shipped. If you're building with an AI coding agent, the drift problem is worse, not better. Ask Claude, Cursor, or Codex to "add a settings screen" three separate times and you'll get three different paddings, three different corner radii, and a button style that quietly forked itself somewhere around commit 40. Agents are great at writing plausible SwiftUI and bad at remembering what the rest of your app already decided. DesignFoundation is an open-source SwiftUI package that gives you a token-based theming engine, 25 components, and 6 feedback/overlay modifiers that all read from the same theme. You set it once at the app root, and everything underneath updates. That's the whole idea — and it ships with CLAUDE.md , AGENTS.md , and Cursor rules already written, so an agent working in your repo reaches for DFButton instead of inventing a new one. In this tutorial you'll go from zero to a themed, consistent SwiftUI UI — without writing a single custom button style. What We're Building By the end you'll have: A working app that uses DesignFoundation's theme system A themed form with inputs, validation states, and feedback components A custom theme built from tokens An understanding of how the style system composes Requirements: Xcode 16+, iOS 18+ / macOS 15+ target, Swift 6. Installation Via Xcode File → Add Package Dependencies Paste https://github.com/NerdSnipe-Inc/design-foundation Set the version rule to Up to Next Major from 1.0.0 Add DesignFoundation to your target Via Package.swift dependencies : [ . package ( url : "https://github.com/NerdSnipe-Inc/design-foundation" , from : "1.0.0" ) ], targets : [ . target ( name : "YourApp" , dependencies : [ "DesignFoundation" ]) ] Step 1: One Line Instead of a ThemeManager Singleton Every app that

Top robotics researchers and founders explain how robot autonomy is evolving.