标签：#p

The Quest Begins (The "Why") Hey friend, picture this: you’re happily writing a Node.js service, passing objects around like they’re candy at a parade. Everything works until one day you mutate a shared object in a helper function and suddenly your UI shows stale data, or worse, you get a mysterious Cannot read property 'map' of undefined that only appears in production. You spend hours tracing the flow, adding console.log s everywhere, and you start to wonder if there’s a hidden contract you missed. I’ve been there. I spent an entire afternoon debugging a race condition that only showed up when two async requests touched the same user profile. The fix felt like a band‑aid, and I kept thinking, “There has to be a better way to reason about who owns what.” That curiosity led me to Rust, and more specifically, to its ownership system—a set of rules that, at first glance, feels like a strict teacher with a red pen, but ends up being the most reliable compass I’ve ever had for writing safe, concurrent code. The Revelation (The Insight) Rust’s ownership model isn’t just another syntax quirk; it’s a philosophy that answers three simple questions for every piece of data: Who owns it? How long can it live? Who can read or change it while it’s alive? If you can answer those, the compiler guarantees you won’t have dangling pointers, use‑after‑free, or data races— without a garbage collector pausing your thread. For a JavaScript developer, that sounds like magic, but the rules are surprisingly concrete once you see them in action. Surprising Feature #1: Move Semantics (The “Give Away” Rule) In JavaScript, when you do let b = a; you’re copying a reference. Both a and b point to the same object, and mutating one affects the other unless you clone. Rust treats assignment differently for types that own resources (like String , Vec<T> , or custom structs). Assigning b = a moves the ownership; after that, a is considered uninitialized and you can’t use it again. let s1 = String .fro

The runtime boundary behind RocketRide's crash isolation, task lifecycle, and Cloud operations. By Krish Garg and Mithilesh Gaurihar At 9 a.m., with ten thousand users mid-session, a node in an AI pipeline dereferences a bad pointer. The process running it is gone before Python can raise a useful exception. That is an unpleasant failure, but it is not the question we care about most. The question is what happens next. Does that crash take unrelated pipelines with it? Does the server need a restart? Does the on-call engineer walk into a system-wide incident, or into one failed task and a useful record of why it failed? In RocketRide, a failed task is meant to be contained and recorded. The server sees the child process exit, updates the task's state and exit code, releases the task's ports and connections, and sends status updates to subscribed monitors. The run stops. Its history does not vanish. Other task processes are not sharing its memory, interpreter, or worker threads. That behavior comes from a decision we made early: every pipeline run gets its own isolated process. It is not the cheapest or fastest possible architecture. Starting a process has a cost, and keeping one around has a cost too. We accepted those costs because the alternative makes failures much harder to reason about once Python code, native libraries, model runtimes, and user-defined nodes are all running in the same service. One Process, One Blast Radius An AI pipeline does not fail like a typical request handler. A normal exception is one thing. A segfault in a C extension, a crash in a media decoder, or a broken native inference library is another. Once a process has corrupted memory, application-level error handling is no longer a reliable line of defense. So each RocketRide task starts as a fresh child process with its own embedded Python interpreter. It loads one pipeline, initializes that pipeline's nodes, and owns the work for that run. The parent runtime keeps the task registry, alloc

Climate change is upping the odds of major wildfires, creating a need for new tools to combat them.

JWT authentication has more failure modes than most developers realise. Correct signature verification is necessary but far from sufficient. This checklist is what I run through before every production JWT deployment. 1. Secret Is Generated With a CSPRNG Not a password. Not a UUID. Not a timestamp. A cryptographically secure pseudorandom number generator output. In Node.js: crypto.randomBytes(32).toString('hex') In Python: secrets.token_hex(32) In the browser: jwtsecretgenerator.com/tools/jwt-secret-generator A 256-bit CSPRNG secret takes 10^59 years to brute force at current GPU speeds. 2. Algorithm Is Explicitly Specified in verify() // Wrong jwt . verify ( token , secret ); // Right jwt . verify ( token , secret , { algorithms : [ ' HS256 ' ] }); 3. exp Claim Is Present and Validated Short-lived tokens (15 minutes) limit the damage from leaks. Verify your library is actually checking exp — some require explicit configuration. 4. iss and aud Claims Are Validated Validates the token was issued by your service and intended for your API. Prevents token reuse across services. 5. Tokens Are in httpOnly Cookies, Not localStorage localStorage is readable by any script on the page. httpOnly cookies are invisible to JavaScript. 6. HTTPS Is Enforced JWT in a query parameter over HTTP is visible in every proxy, CDN, and server log on the path. Use the Authorization: Bearer header over HTTPS only. 7. Refresh Tokens Are Server-Side Revocable Short access tokens + server-side refresh tokens = the ability to end sessions immediately. Long-lived access tokens without refresh logic cannot be revoked. 8. The jti Claim Is Used If You Need Immediate Revocation Store revoked jti values in Redis with TTL matching token expiry. Check on every request. Adds one Redis lookup per request — worth it for high-security endpoints. 9. Different Secrets for Each Environment Dev secret leaks should not compromise production. Keep them separate. 10. Secret Is Not in Source Code or Version Control

Kennedy has focused on nutrition but has neglected food safety, critics say.

Fusion power startup Thea Energy snagged a $20 million award from ARPA-E to scale production of its high-temperature superconducting magnets.

The deal means content will be integrated into the YouTube experience, allowing viewers to discover and watch Peacock content without leaving the platform.

Give Claude Code missions to spawn a team of agents Discussion | Link

The outgoing executive director of the Office of Homeland Security Statistics is one of very few federal officials to speak out against the Trump administration’s immigration crackdown.

These are likely the last updates of note before Apple's bigger fall updates.

A second gremlin is rolling through Spotify this evening.

Postmortem after several rounds of performance work on a Laravel site, trying to push concurrent user capacity up. Ended up putting Varnish in front of Nginx. submitted by /u/noweh95 [link] [留言]

The screwup shows how tricky it can be to stop web crawlers from making ostensibly private conversations with AI chatbots entirely too public.

Apple's latest software updates are primarily focused on security fixes.

Nanoleaf’s Blocks Combo XL Smarter Kit is a fun back-to-school buy that can add pops of customizable light and storage to your wall. It combines colorful smart lighting panels with a low-profile shelf and pegboard, and right now you can buy the kit for half off at $99.99 from Nanoleaf, which marks a new low […]

Age verification is okay, but filtering is preempted by Section 230, judges find.

I run a consumer product company by myself. Physical inventory, two storefronts, multiple marketplaces, subscription billing, bookkeeping, tax filings, government paperwork, content in two languages, and a codebase that ships to production most weeks. Headcount: one. Not "one plus a virtual assistant." One. Three years ago this was not possible. It is also not possible today by keeping a chat window open and asking it questions. The thing that changed is not that models got smarter in the abstract. The thing that changed is that agents can now operate software the way an employee does : click through admin dashboards, fill in government forms, read email, write and deploy code, remember what happened last Tuesday, and run on a schedule without being asked. Once that is true, most of what a small company's staff does becomes a workflow you can write down, hand to an agent, and audit weekly instead of doing daily. Everything I run sits on five primitives. Tool names will churn every six months. These won't. 1. A browser-operating agent An agent that drives a real browser session with my real logins: seller dashboards, banking portals, government sites, ad platforms, email. This is the highest-leverage primitive, and it is the one most people skip. The reason is uncomfortable: roughly 90% of small-business operations live behind a login wall with no usable API. Your marketplace seller console. Your payment provider's merchant dashboard. Your country's tax portal. The grant program that still ships application forms as attachments. If your automation strategy requires an official API for everything, you will automate the 10% that already had one, and you will still be doing the other 90% by hand at 11pm. The browser agent is my hands. It logs in, navigates, reads what's on screen, fills forms, downloads documents, and reports what it found. 2. A coding agent An agent that reads my repositories, writes changes, opens a review pass, and deploys. I treat it exactly like a

Poland runs a national e-invoicing system called KSeF (Krajowy System e-Faktur). Business-to-business invoices are submitted to a government API in a schema called FA(3) , and the system hands back an official confirmation of receipt. If you sell software to Polish companies, you will meet it. The Ministry of Finance publishes official SDKs for Java and .NET . There is nothing for JavaScript. A full client is a real project: authentication, session handling, certificates, XML signing. But a large share of rejected invoices have nothing to do with any of that. They are structural. A tax ID with a bad checksum. Net plus VAT that does not add up to gross. A date that does not exist. Those are worth catching on your side, before you build a session with anyone. So I pulled that layer out of a product I work on, rewrote it standalone, and published it: ksef-invoice-validate . Zero dependencies, no network calls, runs in the browser. npm i ksef-invoice-validate import { validateInvoiceForKsef } from " ksef-invoice-validate " ; const result = validateInvoiceForKsef ({ invoice_number : " FV/2026/07/1 " , issue_date : " 2026-07-01 " , seller_nip : " 1111111111 " , buyer_nip : " 1111111111 " , amount_net : 1000 , amount_vat : 230 , amount_gross : 1230 , }); Three things in it were more interesting than I expected. The NIP checksum A Polish tax identification number (NIP) is ten digits. The tenth is a checksum over the first nine, each weighted and reduced modulo 11. const weights = [ 6 , 5 , 7 , 2 , 3 , 4 , 5 , 6 , 7 ]; const digits = cleaned . split ( "" ). map ( Number ); const checksum = weights . reduce (( sum , w , i ) => sum + w * digits [ i ], 0 ) % 11 ; if ( checksum !== digits [ 9 ]) { // invalid } There is a small elegance here. The remainder can be 10, and no single digit equals 10, so those numbers simply cannot exist as valid NIPs. You do not need a special case. The comparison rejects them on its own. This alone catches a surprising amount. Most bad tax IDs in t

NASA has not made substantial investments in thermal protection research for decades.

A few months ago I got obsessed with a question: can you run a real LLM entirely inside a browser tab, with zero backend, zero GPU, and zero install? The answer is yes. Here's what I built. ghost is a single HTML file that downloads a quantized language model into your browser's cache on first visit, then runs inference locally in WebAssembly forever after. Fully offline after that first download. No API key. No npm. No build step. Open the file, pick a model, chat. How it works The inference engine is wllama — a WebAssembly binding for llama.cpp. It runs GGUF quantized models directly in the browser using WASM SIMD. I pin it to a specific version so the JS and WASM files always match (learned this the hard way after a fun debugging session involving mismatched memory imports). Models are downloaded from HuggingFace on first load and cached via the browser's Cache API. On every subsequent visit they load instantly from cache, no network needed. Features Three models: Qwen2.5 1.5B (smart), Qwen2 0.5B (fast), TinyLlama (lightweight) Markdown rendering from scratch — no library, just regex transforms RAG: drag a .txt or .pdf onto the chat window. It chunks the text, embeds each chunk using wllama's embedding API, stores vectors in memory, and retrieves the top-3 relevant chunks on each message. Fully local, fully offline Voice input via the Web Speech API — mic button auto-sends on silence Multi-turn conversation memory capped at 10 turns PWA installable — works on mobile home screen too The hard parts Getting wllama to load from a cached model was genuinely tricky. Blob URLs created in the main thread aren't accessible from wllama's internal Web Worker. IndexedDB chunk reconstruction hit a 2GB ArrayBuffer limit on Windows Chrome. The final solution was using wllama's built-in loadModelFromHF with useCache: true which handles everything internally. The embeddings API requires toggling a flag (embeddings: true) that conflicts with normal chat completion — so I toggle it