标签：#p

The Token Bucket Algorithm: Server-Side API Rate Limiting in ~40 Lines Plenty of tutorials teach you how to survive someone else's rate limit with retries and backoff. Far fewer show you how to build one. If you run an API, you need rate limiting on your side too — to protect your database from a runaway client, keep one noisy tenant from starving everyone else, and give abusive traffic a polite 429 instead of a melted server. The cleanest algorithm for the job is the token bucket . Let's implement it from scratch, then make it production-ready. How token bucket works Picture a bucket that holds up to capacity tokens. Every request removes one token. The bucket refills at a steady refillRate (tokens per second), up to its cap. If a request arrives and the bucket is empty, it's rejected. This gives you two useful properties at once: A sustained rate — the long-run average, set by refillRate . A burst allowance — clients can spend the whole bucket at once, set by capacity . That burst tolerance is why token bucket feels fair. A user who's been quiet for a minute can fire off a batch of requests without being punished for it. A minimal implementation Here's a self-contained bucket in JavaScript. No dependencies, no timers — we compute refill lazily based on elapsed time, which is both simpler and more accurate than a background interval. class TokenBucket { constructor ( capacity , refillRatePerSec ) { this . capacity = capacity ; this . refillRate = refillRatePerSec ; this . tokens = capacity ; this . lastRefill = Date . now (); } _refill () { const now = Date . now (); const elapsedSec = ( now - this . lastRefill ) / 1000 ; this . tokens = Math . min ( this . capacity , this . tokens + elapsedSec * this . refillRate ); this . lastRefill = now ; } take ( cost = 1 ) { this . _refill (); if ( this . tokens >= cost ) { this . tokens -= cost ; return { ok : true , remaining : Math . floor ( this . tokens ) }; } const deficit = cost - this . tokens ; const retryAfter = Mat

Web Scraping with Python in 2026: Best Libraries and Anti-Bot Strategies Web scraping in 2026 looks very different from 2020. Sites are smarter, anti-bot systems are more aggressive, and the legal landscape has evolved. Here's what actually works now. The 2026 Scraping Landscape Challenge 2020 Solution 2026 Solution Bot detection Rotate User-Agent Fingerprint randomization + residential proxies CAPTCHAs Manual solving Turnstile/hCaptcha solvers JavaScript rendering Selenium Playwright (faster, more reliable) Rate limiting Sleep between requests Adaptive pacing + request signing IP blocking VPN rotation Residential proxy pools Best Libraries in 2026 1. Playwright (Best for JS-heavy sites) from playwright.sync_api import sync_playwright def scrape_with_playwright ( url ): with sync_playwright () as p : browser = p . chromium . launch ( headless = True ) page = browser . new_page () page . goto ( url , wait_until = " networkidle " ) data = page . query_selector_all ( " .job-item " ) results = [] for item in data : title = item . query_selector ( " h2 " ). text_content () results . append ( title ) browser . close () return results 2. httpx + Selectolax (Fast, no JS needed) import httpx from selectolax.parser import HTMLParser def scrape_static ( url ): resp = httpx . get ( url , headers = { " User-Agent " : " Mozilla/5.0 " }) tree = HTMLParser ( resp . text ) for node in tree . css ( " .listing " ): print ( node . text ()) 3. API-First Approach (Always check first!) Many sites have hidden or public APIs that make scraping unnecessary: url = " https://www.freelancer.com/api/projects/0.1/projects/active/?query=python " data = httpx . get ( url ). json () Anti-Bot Strategies That Work 1. Request Fingerprint Randomization import random def get_random_headers (): browsers = [ " Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 " , " Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 " , ] return { " User-Agent " : random . choice ( browsers ), " A

GitHub Trending Digest: Optimasi Agent, Parsing Gambar Skala Besar, dan Evolusi Sistem Operasi Selamat datang di edisi digest GitHub Trending minggu ini (30 Juni 2026). Pasar pengembangan perangkat lunak di tengah tahun 2026 menunjukkan pergeseran menarik dari sekadar "membuat model AI lebih pintar" menjadi "membuat sistem AI lebih efisien dan terintegrasi secara mendalam". Tren utama minggu ini didominasi oleh dua tema besar. Pertama, optimasi biaya dan komputasi untuk AI Agents . Kita melihat alat-alat yang berfokus pada pengurangan latency dan peningkatan efektivitas kode yang dihasilkan, dengan filosofi bahwa kode terbaik adalah kode yang tidak perlu ditulis sama sekali. Kedua, kemampuan pemrosesan visual skala enterprise yang melampaui batas konvensi image-to-text tradisional, memungkinkan parsing dokumen kompleks dalam satu langkah ( one-shot ). Di sisi infrastruktur, ada gerakan balik menuju sistem operasi yang minimalis dan deterministik, yang ditunjukkan oleh meningkatnya minat terhadap dokumentasi dan basis kode dari proyek Astrid OS. Berikut adalah lima repository paling populer minggu ini yang merefleksikan tren tersebut. 1. DietrichGebert/ponytail (JavaScript) Star: 68,413 | Tagline: Makes your AI agent think like the laziest senior dev. Repository ponytail telah mengambil alih posisi puncak dengan jumlah bintang yang sangat signifikan. Seperti namanya, alat ini bekerja untuk membuat agen AI berpikir seperti "senior developer termalas" di ruangan tersebut. Filosofi intinya sederhana namun revolusioner: The best code is the code you never wrote (Kode terbaik adalah kode yang tidak pernah Anda tulis). Kenapa Trending? Di era di mana penggunaan LLM untuk generating code sudah menjadi standar, bottleneck baru muncul: hasil generate yang terlalu verbose, kurang efisien, atau bahkan redundan. Ponytail bertindak sebagai lapisan optimasi yang agresif. Alat ini tidak hanya menghasilkan kode, tetapi juga meragukan kebutuhan akan kode tersebut, mencari celah untuk

Breaking long documents into overlapping chunks, preserving context, and reassembling with FastAPI At LectuLibre, we’ve built an AI‑powered platform that translates entire books—EPUBs and PDFs—using large language models. When we first hooked up Claude’s API, we naively fed it a 300‑page PDF in one request. It failed immediately. Claude 3 Opus has a 200K token window, but a 300‑page book can easily run to 300K tokens or more. Even if we squeezed it in, the output would be truncated and the quality would degrade at the extremes of the context window. So we faced a classic long‑document problem: how do you translate a book that’s larger than the model’s context window? Here’s the real approach we ended up with, the code we wrote, and the lessons we learned. The Problem: Token Limits Are Real Claude 3 Opus and Haiku models (and most LLMs) have a maximum context length—200,000 tokens for Opus. A token is roughly ¾ of a word. A 300‑page novel with ~75,000 words translates to about 100K tokens, so it should fit, right? But translations from English to Spanish can expand by 15–20%, and the prompt instructions, system message, and the user message itself all eat into that budget. Plus, we needed to send the entire source text in every call to give the model full context. That’s not feasible. We could have tried a simple split: cut the book at arbitrary page boundaries and translate piecemeal. That fails spectacularly. Narrative breaks mid‑sentence, and phrases like “the previous chapter” lose their referents. We needed a more intelligent chunking strategy. Our Approach: Sliding Window with Overlapping Paragraphs We settled on a sliding window chunking algorithm based on paragraphs, with a generous overlap. Here’s the idea: Split the source text into paragraphs (using \n\n ). Build chunks of max_chunk_tokens (we used 180,000 to keep a safety margin), adding paragraphs one by one and counting tokens with tiktoken . When the chunk exceeds the limit, we start a new chunk but we

Wayve’s offering is part of a growing trend of AI startups using employee tenders as a strategic tool to attract and retain talent.

What happens when network calls stop behaving like clean request/response interactions. Timeouts, retries, duplicate side effects, idempotency, backoff, circuit breakers, load shedding, degraded states, observability, etc. submitted by /u/OtherwisePush6424 [link] [留言]

It's pretty common to throw a layer of HTTP Basic auth on a WordPress site: a staging environment before launch, an internal test instance only employees should see, or any environment that wants an extra gate before the WordPress login screen itself. From a maintenance-tool point of view, this setup creates a peculiar "half-working, half-broken" asymmetry. The SSH/WP-CLI side runs fine. But everything HTTP-based — visual checks, thumbnail generation, browser-based fallback updates — hits 401 and dies. This post walks through how we resolved that asymmetry. What was breaking — two parallel paths, both blocked A maintenance tool actually touches a Basic-auth-protected site through two distinct paths: Playwright path : visual checks, thumbnail capture, browser fallback updates when SSH isn't available. browser.new_context() → navigation → screenshot urllib path : HTTP status checks (pre/post-update 200/5xx/4xx monitoring, rollback decisions) With no credentials, both paths see a 401 Unauthorized from the protected site. The Playwright symptom is the obvious one: the screenshot you save is the browser's "authentication required" dialog. The thumbnail grid fills with dark auth-prompt images, and you start wondering whether anything actually works. The urllib symptom is much worse — it silently breaks rollback decisions . A 401 baseline followed by another 401 after the update looks like "nothing changed = healthy." Real failures can hide behind that match, and the rollback that should have fired never does. The design — consolidate credential extraction into one helper When the same credentials need to flow through multiple code paths, picking them out of the site dict separately at each call site invites format-mismatch and missed-update bugs. So the first thing we did was build a small core/basic_auth_utils.py module that owns every form of credential extraction . # core/basic_auth_utils.py def get_basic_auth_tuple ( site ): """ Return (user, password), or None if not

This continues from Part ① . In Part ②, we'll configure the common settings and the internal-processing Power Automate flows. Common Settings Setting Up Connections Open Power Automate ( https://make.powerautomate.com ) Go to "Data" → "Connections" → "New connection" and create a Microsoft Dataverse connection Do the same to create an Office 365 Outlook connection Basic Flow Creation Steps Click "Create" → select "Automated cloud flow" (event-triggered) or "Scheduled cloud flow" (recurring) Name flows in the format [Zone]-[Number] [Description] (e.g., "A-1 Opportunity Stage Stall Alert") Always run a test after creating a flow to verify it works 2. Internal-Processing PA Flows — 4 Flows (Write-back portions of A-4, C-5, C-6, D-3) Once the common settings are done, it's time to build. A-4: Write Back Stage Changed Date Without this flow, the stall-day calculations in A-1 and B-1 will not work. Implement this first. In Microsoft Dynamics 365 (D365), a "stage" refers to a major milestone in a process — such as a sales deal or customer engagement — that guides the responsible person through what needs to happen next. It's how a series of activities is visualized and managed. From here, all work is done in Power Automate. Step Task Details 1 Create the flow "Automated cloud flow" → select trigger "When a row is added, modified or deleted (Dataverse)" 2 Configure trigger Table: Opportunities / Change type: Modified 3 Add condition Add a "Condition" action: "When Status Reason (statuscode) has changed" 4 Write-back action "Update a row (Dataverse)" → set cr917_stage_changed_date to utcNow() C-5: Auto-Set Renewal Date + Auto-Create Renewal Opportunity (on Won) On Won close, two things happen: ① auto-set the renewal date to close date + 365 days, and ② auto-create a new Opportunity for the renewal cycle and add it to the pipeline. Step Task Details 1 Create the flow "Automated cloud flow" → trigger "When a row is added, modified or deleted (Dataverse)" 2 Configure trigger Ta

Every open-source CVE backlog has that one line item you keep sliding into next quarter. The library is a couple of majors behind, the upgrade breaks four services, and the fix upstream ships against a version you cannot ride to. So you file the ticket again. (Everyone's doing great, thanks for asking.) On June 30, Aikido Security said it had acquired Root, whose whole pitch is to make that ticket go away by another route: patch the vulnerability directly into the version already resolved by your build, and skip the upgrade entirely. Per The New Stack, the deal is worth $70 million, and Root's patching technology gets folded into a new Aikido product. Let me phrase what has just moved as plainly as I can. A vendor now edits open-source packages on your behalf and hands you back a version string upstream never shipped. If that sentence made you flinch, hold the flinch. It is doing useful work. The problem this is actually solving The dirty secret of dependency remediation is that a lot of "known" CVEs sit unfixed because remediating them means a version bump that carries breaking changes. You do not get a security patch for the 2.x line, you get a "fixed in 4.0" release note and a laugh track. Backporting the fix is the right operational move: keep the API surface, change only the vulnerable bytes. Linux distributions have done exactly this for decades. The reason your app team is not doing it too is that nobody has the muscle to maintain a patched fork of every transitive dependency in a lockfile. If Aikido now makes that muscle available to the average CI/CD owner, teams get a lever they simply did not have. That is the honest upside. Own it. Who is signing what, exactly Here is the part I care about, which is trust. When your build resolves a package by name and version, you rely on a chain: the registry answers, the digest matches what upstream published, the SBOM you generate downstream still refers back to that same identity. A backported build breaks that chai

You've got a rough draft. Bullet points, half-finished paragraphs, maybe some notes you pasted from a meeting. It needs to become a real document — but rewriting takes time you don't have. That's exactly where AI Assist comes in. What AI Assist Does AI Assist lives inside PaperQuire's editor. Select any text, right-click, and choose an action: Rewrite — Rephrase your selection for clarity and tone, keeping the meaning intact Expand — Turn bullet points or short notes into full paragraphs Summarize — Condense a long section into a concise summary Fix grammar — Clean up spelling, punctuation, and awkward phrasing Translate — Convert your text to another language Custom prompt — Tell the AI exactly what you want ("make this more formal", "add examples", "simplify for a non-technical audience") Every action works on your selection — you stay in control of what gets changed and what doesn't. Bring Your Own Key PaperQuire doesn't route your content through our servers. You plug in your own API key from any supported provider: OpenAI (GPT-4o, GPT-4o mini) Anthropic (Claude Sonnet, Claude Haiku) Google (Gemini Pro) Local models (Ollama, LM Studio — for fully air-gapped workflows) Your documents, your key, your choice. Nothing leaves your machine unless you explicitly configure an external provider. A Real Workflow: Meeting Notes to Executive Summary Here's a concrete example. You come out of a 45-minute meeting with this: - Q2 revenue up 12% vs forecast - APAC expansion delayed, regulatory issues - New pricing tier launching Aug 1 - Customer churn down to 3.2%, lowest ever - Engineering headcount: 3 open roles, 2 offers out - Board meeting moved to July 18 Select all, click Expand , and AI Assist turns it into: Q2 revenue came in 12% above forecast, driven primarily by enterprise upsells in North America. The planned APAC expansion has been delayed due to unresolved regulatory requirements in two target markets; the team is working with local counsel to clear the path for a

Existe um desconforto generalizado na área de desenvolvimento. Uma sensação de que o chão mudou, mas ninguém deu o mapa novo. A IA generativa entrou no dia a dia, e de repente aquilo que antes levava horas: escrever funções, montar queries, criar componentes, resolver bugs triviais. Agora passou a levar minutos. Às vezes, segundos. A reação mais comum é: ou "a IA vai substituir todo mundo", ou "não muda nada, é só mais uma ferramenta". As duas posições estão erradas. A primeira é alarmismo. A segunda é negação. O que aconteceu foi uma mudança de papel . O desenvolvedor não deixou de ser necessário. O tipo de contribuição que se espera de um desenvolvedor mudou. E entender essa mudança cedo, especialmente para quem está no início da carreira, é a diferença entre se tornar um profissional de pouco impacto e um profissional indispensável. O modelo que conhecíamos Durante muito tempo, a indústria funcionou com uma divisão razoavelmente clara de responsabilidades: O ciclo tradicional de uma demanda: Alguém identifica um problema → alguém de produto investiga e define o escopo → um arquiteto ou pleno projeta a solução → um desenvolvedor implementa. Cada etapa tinha suas pessoas, suas cerimônias, seus rituais. Refinamento, sprint planning, design review, code review. Não que isso fosse ruim, só era uma estrutura que fazia sentido quando cada etapa era custosa. Dentro desse modelo, a progressão de carreira era mais ou menos assim: Junior recebia tarefas pequenas e bem definidas. Codificava, testava, corrigia. A maior parte do tempo era gasto na execução: a parte braçal . Pleno pegava demandas mais complexas, começava a pensar em como o código se encaixa no sistema. Refatorava, participava de decisões técnicas . Senior definia arquitetura, avaliava trade-offs, mentorava. Codava menos, pensava mais . A IA comprimiu isso. Muito do trabalho braçal que servia como treinamento para o junior agora é automatizado. E isso gerou a pergunta que paira no ar: "Se a IA faz o que eu fazia

After weeks of negotiating with the Trump administration, Anthropic is finally going to be able to bring Claude Fable 5 back online. In a post on X, Anthropic said it plans to begin restoring access tomorrow. Anthropic: We've received notice that the Department of Commerce has lifted export controls on Claude Fable 5 and Mythos […]

A reviewer that flags the same known issue on every run trains you to ignore it. The fix can't be "hide findings," because a tool that silently drops things is worse than one that nags. CommitBrief has two ways to accept a finding and move on — a per-developer baseline and an in-source suppression marker — and both are built so that what they remove is always counted, never quietly swallowed. The interesting part is how a finding keeps its identity when the code around it moves. TL;DR Baseline ( .commitbrief/baseline.json , gitignored): accept the current findings once; later runs drop anything whose fingerprint is already in the file. Inline suppression : a commitbrief-ignore: <reason> comment on or above a line removes that finding — and lives in committed source, so a reviewer sees it. A finding's fingerprint deliberately excludes its line number , so accepting it survives the code drifting up and down the file. Both are TRUE removals — they affect --fail-on and the JSON findings[] , not just the display — and both print what they removed. The limit. The baseline is per-developer, not a shared team policy; it quiets your runs, not CI's. The fingerprint that survives code drift The whole design rests on one question: when is a finding "the same finding" you already accepted? If the answer included the line number, a baseline would evaporate the moment you added an import above the issue. So it doesn't. A finding's identity is three fields, hashed: func normalizeTitle ( title string ) string { return strings . ToLower ( strings . Join ( strings . Fields ( title ), " " )) } func Fingerprint ( f render . Finding ) string { h := sha256 . New () h . Write ([] byte ( f . File )) h . Write ([] byte { 0 }) h . Write ([] byte ( f . Severity )) h . Write ([] byte { 0 }) h . Write ([] byte ( normalizeTitle ( f . Title ))) return hex . EncodeToString ( h . Sum ( nil )) } File, severity, and a normalized title — and nothing else. Line is out, so the same issue keeps its finger

A narrativa atual da tecnologia está fortemente inclinada para a automação. Com agentes de IA escrevendo boilerplate , gerando componentes e até estruturando projetos inteiros, é fácil olhar para o futuro do desenvolvimento de software e assumir que o elemento humano está diminuindo. Mas se você mantém ou contribui ativamente para um projeto open source , sabe que a realidade é bem diferente. A IA pode escrever código, mas não consegue validá-lo contextualmente contra décadas de edge cases obscuros. Ela não sabe dizer por que uma regra de negócio específica falha em produção. Mais importante ainda: a IA não constrói comunidade. A evolução de um software robusto ainda depende inteiramente de pessoas colaborando, quebrando código, reportando bugs e validando se o código realmente funciona no mundo real. Para ver isso na prática, precisamos olhar para projetos que tentam fechar lacunas geracionais gigantescas na tecnologia. Um exemplo perfeito disso é o AxonASP . A Filosofia do AxonASP: Modernizando o Legado Por muito tempo, o ASP Clássico e o VBScript foram considerados presos a um modelo de servidor obsoleto — amarrados ao IIS e deixados para trás pelas práticas modernas de deploy . O AxonASP muda esse cenário. É um runtime open source e cross-platform que trata o ASP Clássico como uma Aplicação moderna, em vez de uma relíquia do passado. Ele traz o VBScript, o ASP e, principalmente, o suporte ao JavaScript Síncrono para o futuro. Construir um runtime que lida com código legado enquanto opera em um ecossistema moderno e multiplataforma não é algo que você consegue simplesmente pedindo para um LLM. Exige um ciclo de feedback agressivo. O AxonASP está em franca evolução e apresenta altíssima compatibilidade com o ASP Clássico. Mas essa compatibilidade não é mágica — ela é o resultado direto de usuários pegando seus scripts legados de 15 a 20 anos atrás, rodando no motor, vendo onde falham e reportando exatamente o que aconteceu. Cada issue aberta e cada bug reportado p

June was not about making the most contributions -- it was about becoming a better collaborator. This month I had: ✅ 1 PR merged 🔄 1 PR still open 👀 3 PR reviews completed 🐞 1 issue opened I am making this graph all green... Biggest Learning The biggest milestone wasn't writing code. It was reviewing pull requests. One review led the author to update their PR based on my feedback. That experience taught me that open source isn't just about contributing code; it's also about helping improve someone else's work through discussion and constructive feedback. Working Alongside AI Reviewers I also had an interesting experience interacting with automated reviewers like Vercel Bot and Copilot. Rather than accepting every suggestion, I tested them, evaluated the trade-offs, and explained why I chose a different approach. It was a good reminder that AI can assist reviews, but engineering judgement still matters. Looking Ahead My biggest challenge is still finding a larger project that I can consistently contribute to over the long term. That's my main goal for July, alongside publishing my OSS Contribution Toolkit repo and making my CaaS project usable for others. Small, consistent steps continue to move the journey forward. What was your biggest open source learning in June? Transparency Note: I used AI as an editor—not as the author. For this article, it helped refine the structure and improve the English grammar. The technical content, experiments, opinions, and conclusions are my own and were reviewed by me before publishing.

The White House is easing restrictions on Anthropic’s most advanced AI models weeks after ordering the company to suspend access for foreign nationals.

What if one pitch changed everything? The next company nobody has heard of yet is building something that will matter. It could be yours.

Also, the science of poop's distinctive shape, boron buckyballs, and the secret to a soccer feint.

Most "agent memory" and "agent context" tools today require sending your data to someone else's cloud. If you operate in a regulated, air-gapped, or simply privacy-conscious environment, that rules them out before you've even tried them. I build the opposite: two MIT-licensed, local-first MCP servers that do this work entirely on your own hardware. The problem Agent memory and context assembly are converging on a cloud-only default. That's a non-starter for defense, healthcare, finance, legal, and any team that can't or won't let agent context leave their VPC. It's also just slower and less deterministic than it needs to be: agents re-discover the same facts about your repo and services every session, burning tokens and turns before doing any real work. Mimir: persistent memory, fully offline Mimir is a single ~8MB Rust binary. It encrypts everything at rest with AES-256-GCM, and it works with no API key, no model download, and no network access at all, because the embeddings used for dense search are bundled directly into the binary. It's bi-temporal: every fact carries a validity window, so you can query memory "as of" any past point and supersede facts without deleting history. 43 MCP tools, SQLite + FTS5 hybrid search under the hood. One honest tradeoff worth naming: the FTS5 index needed for fast keyword search currently sits over plaintext, even though the underlying record is encrypted at rest. We're upfront about this in the docs rather than overstating the encryption story. Perseus: compile-before-context Perseus takes a different approach to context than runtime tool-call discovery. Instead of letting an agent rediscover your git state, running services, and test status through a chain of tool calls every session, it compiles all of that into a ready briefing the moment a session starts. The result is deterministic and byte-stable: the same repo state always produces the same compiled context. Honest, reproducible benchmarks On paraphrased queries, Mimir's

The free open source agentic program is finally invading your phone.