标签：#ses

It’s one of the best times of the year to buy a mattress, and our top tested picks are on sale.

A lot gets said about models. Hardly anything about the surroundings. Yet in daily work the surroundings are what decide. What is described here is not a product and not something we sell. It is the answer to the question we get asked most in conversation, mostly by people who work with AI themselves: how is this set up at your place. The Editor Is The Stage The work happens in a normal code editor, not in a chat window in the browser. That is the single most important difference. A chat window in the browser only sees what you paste into it. An assistant inside the editor sees the files, can run commands, read results and derive the next step from them. The difference between "explain how I change this" and "change it, run the tests and show me the result" is not convenience, it is a different way of working. Two Model Families, On Purpose Assistants from two different houses run side by side. That is not indecision but the most effective quality lever we have found. Models from the same family make similar mistakes. When builder and reviewer come from the same house, the reviewer reliably overlooks exactly what the builder overlooked. They share the blind spots. Run a model from a different family over the same work, with the explicit assignment to refute it, and different findings come back. Not more findings, different ones. That is now our standard route for anything non-trivial: one builds, a second attacks, and it keeps going until nothing substantial comes back. Recipes Instead Of Explaining Again The second layer is recipes for recurring procedures. A deploy, a blog post, a client onboarding, a server check. The point of them is not automation. The point is that each recipe carries the traps we already fell into. For publishing a site, for instance, it holds the order of checks that are due before the switch. Knowledge like that otherwise disappears. It lives in the head of somebody who is not around that day. In a recipe it is written down and gets followe

When you are building something from scratch, speed feels noble. It feels disciplined. Necessary. Mature, even. You tell yourself you are being practical. The customer does not care if the code is beautiful. The market is moving. Cash is finite. Momentum matters. So you make the trade that almost every founder makes at some point: ship now, clean up later. I understand that instinct very well because I have lived inside it. As a founder, you are not operating in the comfort of theory. You are making decisions with incomplete information, limited time, and a product that still needs to prove it deserves to exist. In that stage, a lot of engineering advice sounds suspiciously like it was written by people who have never had to get a real product out before the window closes. So yes, you move fast. You hardcode things that feel temporary. You defer cleanup. You choose the version that works over the version that would make your future self proud. You call it pragmatism, which it often is. The trouble is that pragmatism has a habit of overstaying. And that is the trap. Because some shortcuts buy you speed. Others quietly sell off your future ability to move. It took me time to really understand that distinction. Founding teaches you that speed has layers Before I started building products as a founder, speed felt simple. Ship the feature. Get the customer. Keep going. Later, I learned that there are at least two kinds of speed. The first kind gets you to launch. The second kind lets you keep moving after the launch. The first kind is exciting. It is visible. It gives you demos, momentum, first users, first revenue, first proof that you are not completely hallucinating the opportunity. The second kind is quieter. It shows up months later when the product has more customers, more complexity, and more reasons to break. It is the speed of a system that can still change safely. A team that can still ship without fear. An architecture that has not turned every roadmap discuss

Onur Satici explains how Vortex, an open-source columnar file format under the Linux Foundation, revolutionizes high-throughput data loading. He details how cascading lightweight encodings, layout-based segment pruning, and zero-copy memory pipelines eliminate CPU/NVMe bottlenecks to stream S3 data straight to GPUs at speeds up to 60 Gbps without requiring upfront data reprocessing. By Onur Satici

Enterprise resource planning has traditionally been associated with large vendors, complex implementations, long contracts, and significant licensing investments. For decades, companies evaluating ERP systems were likely to encounter names such as SAP, Oracle, Microsoft Dynamics, and other established commercial platforms. That model is not disappearing. But the assumptions behind it are changing. In 2026, enterprises have more choices than simply selecting between competing proprietary ERP vendors. Open-source platforms such as ERPNext, Odoo, and other business application ecosystems have become credible alternatives for organizations that want greater control over their software, more flexible customization, and different approaches to total cost of ownership. At the same time, SaaS pricing, vendor lock-in, integration complexity, cloud adoption, data ownership, and increasingly capable development tools are changing how businesses think about enterprise software. This does not mean open-source ERP is automatically better. It means the ERP decision deserves to be reconsidered. The question is no longer simply: Which ERP vendor should we buy from? Increasingly, organizations are asking: How much control should we retain over the software that runs our business? What Is Open-Source ERP? Open-source ERP is enterprise resource planning software whose source code is made available under an open-source license that grants defined rights to use, inspect, modify, and distribute the software. The practical implications depend heavily on the specific project's license. For an enterprise buyer, however, the important distinction is that open-source software can provide a level of visibility and extensibility that proprietary software may not. A simplified comparison looks like this: Proprietary ERP Business │ ▼ Vendor Software │ ├── Vendor controls source ├── Vendor controls roadmap ├── Vendor controls licensing └── Vendor controls many upgrade decisions Open-Source ERP Busi

When businesses outgrow spreadsheets and disconnected SaaS tools, the next question is often whether they should buy another application, customize an existing platform, or build a system specifically around their workflows. For many organizations, building custom business software can appear expensive and technically demanding. A development team has to think about authentication, permissions, database models, APIs, user interfaces, background jobs, reporting, audit trails, and deployment. This is where open-source application frameworks can change the equation. Instead of building every foundational capability from scratch, a framework can provide the underlying architecture while developers focus their effort on the business problems that actually differentiate the organization. One example is the Frappe Framework , an open-source web application framework used to build business applications such as ERPNext. But what exactly is Frappe, and why would an organization consider using it for custom enterprise software? What Is Frappe Framework? Frappe is an open-source, Python- and JavaScript-based web application framework designed to make it easier to build database-driven business applications. Rather than being simply a collection of programming utilities, Frappe provides a broader application foundation. It includes capabilities for: Data modeling Authentication Role-based permissions REST APIs Web forms Background jobs Reporting Workflow management Notifications File attachments Activity and audit information User interfaces Database access Application configuration This means a development team can start with an application architecture that already understands many of the requirements common to business software. The important distinction is this: Frappe is a framework for building applications. ERPNext is an application built using that framework. That distinction matters when evaluating Frappe for custom software development. Frappe vs ERPNext Frappe and ERP

Short answer: for a server-rendered learning app, create a short-lived session only after the phone code is verified, keep refresh as a separate state transition, and make recovery a deliberate path rather than an accidental logout loop. The useful design artifact is an auditable session record tied to a learner, device context, and recovery status. I build RAG and agent features in Python, so I tend to move from a notebook test to a production boundary quickly. Authentication deserves a slower handoff. In an edtech app, a learner may lose a phone while a parent, teacher, or school administrator still needs a safe way to recover the account. The browser should receive only an opaque session cookie; the server owns the lifecycle and records why each transition happened. How should server-rendered login handle session creation, refresh, and logout? Treat the four actions as different state changes. Code verification proves possession of a phone channel. Session creation establishes a browser session. Verification checks whether that session is still active. Refresh extends a valid session under a stricter policy. Logout revokes one session, while an account-recovery event may need to revoke every session. That separation makes failure visible. A refresh request must not silently create a new account. A logout request must not be interpreted as proof that the phone number is still controlled. For a school district, the audit trail should answer: which learner was affected, which session changed, what policy allowed it, and when the change took place. The request flow is intentionally plain: The existing login form sends a verified learner identifier and a server-held code-verification result to the application backend. The backend calls the session creation boundary and stores the returned session identifier in a secure, HttpOnly cookie. Each protected request verifies that session before loading learner data. A still-valid session may refresh through the refresh bound

When a support agent is trying to recover an account after a suspicious login, JWKS verification and session verification define different trust boundaries for API requests. The distinction decides which recovery path the agent can offer and how much damage a stolen credential can do. Short answer: use JWKS verification for a stable, distributed signature boundary, and session verification when the request must reflect current session state; most customer-support systems need both, with an explicit recovery policy between them. 1. Separate the two trust boundaries before scoring a device JWKS verification checks a token signature with a public key set. The verifier never needs a copy of the issuer's private key, which keeps key material out of every API service. That is a good fit for a high-volume edge where the identity claim should remain stable while requests cross service boundaries. Session verification asks a different question: is this particular session still valid right now? Revocation, expiry, or a changed recovery decision can make a previously well-signed token unsuitable for a sensitive action. A valid signature is necessary, but it does not satisfy the business constraints by itself. That distinction is the invariant. Device-fingerprint risk scoring should not silently turn a cryptographic result into an account-recovery decision. Keep it explicit. 2. How should JWKS and session verification govern API requests? Start with the least surprising path. Verify the token signature at the request boundary, then apply issuer, audience, expiry, and device-risk rules. For password reset, email change, or an agent-assisted recovery, perform session verification as a second check when the policy requires current state. The operational catch is key rotation. A JWKS client needs a bounded cache, a refresh trigger for an unknown key identifier, and telemetry for fetch failures. In capacity planning, that means sizing the refresh path separately from ordinary reques

I spent years supporting WorkMail and SES at AWS, and even became a Subject Matter Expert in both services. Here's how I moved my own mail off it, start to finish... and got sentimental doing it. Level: 200 (intermediate). Assumes you're comfortable with the AWS CLI, IAM roles, S3, and KMS. Amazon WorkMail is winding down... AWS has announced end of support for March 31, 2027. If you're running a mailbox or two on WorkMail, now is a good time to think about where that mail is going to live next. In my case, I'm moving my domain's mail over to Google Workspace, and I wanted to bring years of old email along for the ride. I'll be straight with you up front, though... this one's personal, and writing a guide to leave WorkMail behind is genuinely bittersweet. I'll get into why at the end... but first, let's do the work. Here's the important part... WorkMail gives you a clean, supported way to get your mail out: the StartMailboxExportJob API. It drops every message into an S3 bucket as a KMS-encrypted .zip of standard .eml files. From there, getting those messages into Gmail is just a matter of speaking IMAP. In this post, we're going to walk through the whole path... exporting the mailbox, wiring up the IAM and KMS pieces the export needs, downloading and inspecting the archive, uploading everything into Gmail with a small Python script, bringing the calendar over, tearing WorkMail down when you're done, and finally locking the domain down with SPF, DKIM, and DMARC so your new Gmail-hosted mail actually lands. Along the way I'll call out the gotchas that cost me time, so they don't cost you any. The shape of the solution Before we touch a command, let's set the mental model. There are two halves to this migration: Get the mail out of WorkMail. StartMailboxExportJob writes an encrypted .zip to S3. This needs a KMS key and an IAM role the WorkMail export service can assume. Get the mail into Gmail. Gmail speaks IMAP, and IMAP has an APPEND command that uploads a raw messa

It’s one of the best times of the year to buy a mattress, and our top tested picks are on sale.

Are XREAL's smart glasses the way of the future for home entertainment?

Meta fixes AI glasses to stop recording any time users cover up the safety light.

Report shows Meta's challenges replacing people with AI agents.

DuckDB Labs has previewed DuckDB v2.0, codenamed "Cyanoptera." This release includes over 10000 commits and introduces a client/server mode, enabling network connections. Improvements also encompass extension portability, advanced data types, and a new parser. Performance enhancements include asynchronous I/O and storage optimisations. General availability is expected in fall 2026. By Olimpiu Pop

Young employment in AI-impacted fields down 19% compared to more AI-resistant occupations.

Tethered display glasses are truly practical face computers. They trade bulky spatial computing for simplicity: Plug in, recline, and get a massive screen right in front of your nose.

Ars looks at Zuckoff, the latest free app detecting Meta AI glasses amid privacy backlash.

I expected the audit to find broken code. That's what I was bracing for going in — a pile of half-working features, sloppy logic, the kind of mess you'd assume from software built at maximum speed with no human reviewing every line. That's not what I found. Almost everything Claude built actually worked, taken piece by piece. What I found instead was something I didn't expect at all: the agent had made the exact same mistakes I've watched human startup teams make, over and over, when they move fast and nobody's job is to say no. That's the real story here, and it's more interesting than "AI wrote bad code" would have been. The experiment The project is called GetPricePulse — a SaaS pricing intelligence product. It's Claude's entry from The $100 AI Startup Race , the season-long challenge I run where seven AI agents each get $100 and full autonomy to build a real startup from scratch, with no human coding and no product manager in the loop. Each agent picked its own idea and ran with it. Claude picked SaaS pricing intelligence, named it PricePulse, and kept building on it for the entire race. That "no product manager in the loop" part is the thing that made this interesting to watch. Nobody was deciding what PricePulse should be. Nobody was saying "we have enough pricing tiers now" or "this feature doesn't belong here." Claude got to build exactly what its own priorities told it to build, at whatever speed it chose, for the length of the race — optimizing, as far as I could tell from the commit history, for speed, feature creation, shipping, and monetization experiments. Not correctness. Not coherence. Not "does this still make sense in three weeks." I've written before about what all seven agents in this race said, independently, when I asked them what AI agents still can't do — they converged on the same answer without seeing each other's responses. This piece is narrower: a full production audit of Claude's specific build, PricePulse, done after the race, before I

Fusion power startup Inertia Enterprises reduced the fuel filling process from a week to just a few hours. It's one of ten hurdles the company must overcome to make a profitable power plant.

Conclusion first: a free model drafted a working C++17 directory hasher in one pass. The draft compiled, ran, and was still wrong. A differential test against standard system tools found three real bugs before the tool ever touched a production cache. Generation was the cheap part. Verification was the deliverable. Background I needed a deterministic hash of a directory tree. The use case was cache invalidation for a small build pipeline: if any file content, name, or symlink target changes, the cache key must change. If nothing changes, the key must stay identical across machines and across checkouts. Hand-writing the tool is maybe 200 lines of std::filesystem code. The happy path is easy. The risk lives in ordering, symlinks, and metadata leaking into the hash. I turned the task into an experiment. MonkeyCode's free model access and free server option meant the model ran on a remote server while I kept verification on my laptop. Disclosure: This article was prepared as part of MonkeyCode's product outreach. The plan: let the model write the first version, then prove or disprove it against a reference oracle. The Contract The goal was not "a tool that compiles." The goal was a tool that matches a reference implementation on every input I could generate. I wrote the contract in three sentences: Same tree → same hash, on any machine. Different content, name, or symlink target → different hash. File metadata (mtime, inode) must not affect the hash. Implementation Step 1: the prompt. I gave the model the contract, the C++17 standard, and one constraint: a single file with no dependencies beyond the standard library. Step 2: the draft. The model returned one .cpp file in a single response. It compiled on the first try. That is the exact moment where most workflows stop. This one did not. Step 3: the reference oracle. Instead of reviewing the code line by line, I built a harness that compares the tool against a shell pipeline: find " $tree " -printf '%P\0' | sort -z | wh