标签：#t

Google is changing how manual actions under its Site Reputation Policy affect search visibility by region. From August 30, 2026 , the ranking impact of these actions will not apply to search results shown to people in the European Economic Area (EEA), while results shown outside the EEA may still be affected. For site owners with international audiences, that makes region-specific SEO monitoring more important than a single global view of performance. The change does not remove Google's Site Reputation Policy or its effort to address site reputation abuse . Instead, it changes how the consequences of a manual action are experienced in EEA search results. Google announced the update in its official Site Reputation Policy update , linking the regional change to its ongoing discussions with the European Commission and considerations related to the Digital Markets Act. What Google changed Google introduced its Site Reputation Policy in 2024 to address situations in which third-party content takes advantage of a host site's established ranking signals. The policy targets content that is published primarily to exploit a site's reputation in Search rather than to provide value consistent with the host site's purpose and oversight. The policy remains in place globally. What changes is the effect of a manual action for people searching from the EEA. Google says that when it applies a manual action under this policy, the impact will not apply to results displayed to users inside the EEA. Outside the EEA, the manual action can continue to affect the relevant site's search results. Enforcement consideration Search results in the EEA Search results outside the EEA Impact of a Site Reputation Policy manual action Does not apply to results shown to users in the EEA May continue to apply Potential treatment of the affected site portion Google may separate it in its systems so it can rank independently over time Google's announcement does not describe an equivalent regional change S

TL;DR : some questions don't have a fixed path through your data (search docs, hit a table, compute, verify, answer — in whatever order/combination the question needs), and drawing a graph for that class of question means either enumerating every path up front or hiding an if/else forest inside one node. ctxloom replaces the graph with typed artifacts and agents that react to their appearance — below is the same use case built both ways, side by side. The problem Picture a typical question from a finance lead in an internal chat assistant: "Why did our infra costs jump in Q2?" Answering this honestly requires: Finding relevant documents — the pricing guide, the discount policy (Confluence/docs). Pulling structured data — a CSV/table of monthly spend (GitLab/S3/DB). Computing an aggregate — not "roughly", an exact number from the table. Cross-checking textual claims against the numbers — not letting the model invent a cause the data doesn't support. Returning the answer together with proof: where each part came from. The next question — "what if we hadn't moved to the Pro plan?" — needs a different path: a different source, a different calculation, a different verification chain. There is no universal graph for this class of questions — you can draw a graph for one specific question, but not for the class. This is exactly what typical graph frameworks (LangGraph, CrewAI, etc.) make you pay for in complexity: either you draw a graph for every possible path up front, or you end up with a hidden branching if/else inside one node that nobody can later explain. How this looks in ctxloom ctxloom has no execution graph — it has artifacts (typed, versioned objects) and agents that react to their appearance . The breakdown above is just a chain of artifacts: Question │ ▼ SourceRef (ranked references to sources) │ ▼ TypedDoc / Spreadsheet (lazily resolved content) │ ├──► Evidence (facts extracted from text) │ │ │ ▼ │ Claim (a statement + verification against Evidence) │ └──► C

Audacity 4 has been in the works for some time, and had its own mini controversy last year when an unfortunate redesigned logo started making the rounds. The final version of the new icon isn't nearly as bad as the early rendition that was circulating last October. But more importantly, all the promised improvements to […]

If you're using Claude to build websites or applications, one of the biggest improvements you can make is to stop treating Claude like a chatbot where you simply copy and paste code. Instead, you can set up a development workflow where Claude works on the project, GitHub stores the code, and Vercel handles deployment. The basic workflow looks like this: You → Claude → Code → GitHub → Vercel → Live Website Claude works on the project, GitHub keeps the source code and its history, and Vercel can automatically deploy new code pushed to the connected repository. Here's how I approach the setup. Start by discussing the project with Claude Don't immediately tell Claude: "Build me a website." First explain what you're actually trying to build. Tell Claude: What the product is Who the target users are What problem you're solving The main features How the business will operate What you already know What you don't know You can also give Claude examples of existing websites or products that are similar to what you're trying to build. The purpose of this stage isn't to generate code yet. It's to make sure Claude understands the project before development begins. Plan the technical side Once Claude understands the idea, decide how you're going to build it. This is where you determine things such as: Programming language Framework Database Authentication APIs Hosting Folder structure Major features Development priorities For example, you might choose JavaScript/TypeScript with Next.js, PHP with Laravel, or another stack depending on your project. The important thing is to make these decisions deliberately instead of letting the AI randomly choose technologies as the project develops. So my basic AI development process is: Discuss → Plan → Build → Test → Deploy → Improve Create a GitHub repository Next, create a repository for your project on GitHub. Think of GitHub as the central home for your project's source code and its change history. Once the repository exists, your developm

Choosing a thread-safe collection is not simply a matter of replacing Dictionary<TKey, TValue> with ConcurrentDictionary<TKey, TValue> . The right choice depends on the operations you need to make atomic, the ratio of reads to writes, whether consumers must block, and whether the data can become immutable after construction. This guide explains how ordinary generic collections fail under concurrent access, then compares the main types in System.Collections.Concurrent with immutable and frozen collections. The goal is to give you enough mechanical detail to defend the choice in code review—not just a catalog of APIs. C# Concurrent Collections: Quick Selection Guide Requirement Start with Concurrent FIFO processing ConcurrentQueue<T> Concurrent LIFO processing ConcurrentStack<T> Concurrent key-based reads and updates ConcurrentDictionary<TKey, TValue> Unordered items produced and consumed by the same workers ConcurrentBag<T> Blocking or bounded producer-consumer flow BlockingCollection<T> Snapshot-style updates System.Collections.Immutable Build-once, read-many lookup data System.Collections.Frozen The table is a starting point, not a substitute for checking which compound operations must be atomic. The sections below explain the mechanics and tradeoffs behind each choice. Why C# Needs Thread-Safe Collections C# 1.0 introduced System.Collections , which includes ArrayList , Hashtable , Stack , Queue , and other collection classes. The problem is that these collections are not type-safe. They store elements as object , which can lead to type-mismatch exceptions and to performance costs from boxing and unboxing. C# 2.0 then introduced the System.Collections.Generic namespace and collection classes such as List<T> , Dictionary<TKey, TValue> , Stack<T> , and Queue<T> . These collections are type-safe, but not thread-safe. Type safety means that when you create a generic collection, you specify the type it stores as a generic type parameter. Reading an element then returns

The Shift from Syntax to “Vibe Coding” Writing code used to be the bottleneck. Now, code is free and that’s precisely the problem. If you had told me Five years ago that my terminal would routinely spin up background execution agents, draft full-stack features, and push PRs before I finished my morning coffee, I would have assumed you were selling a tech startup pipe dream. Back then, GitHub Copilot was a neat trick: an glorified tab-completion tool that occasionally saved you from typing out a boiler-plate fetch request or regex string. Fast forward to today, and we’ve entered the era of “Vibe Coding.” You state intent in natural language. You direct agents in your editor. You prompt terminal workflows. Code manifests at conversational speed. You aren’t typing out syntax line-by-line; you’re steering an autonomous orchestra. The developer experience feels almost magical, fluid, and dizzyingly fast. But as the velocity of code creation hits lightspeed, an uncomfortable truth is beginning to surface across engineering teams: the cognitive load of software engineering hasn’t disappeared — it has simply shifted. We traded the friction of writing syntax for the far more taxing chore of evaluating architectural integrity, managing context drift, and catching silent edge-case failures in code we didn’t actually write. Code is easier to generate than ever, but system comprehension is at an all-time low. And nowhere is this trade-off creating more friction than in the middle tier of the software engineering workforce. The “Middle-Tier” Squeeze Senior engineers act as directors; AI handles the grunt work. Where does that leave everyone in between? For decades, the career progression of a software engineer followed a reliable, well-trodden path. You entered the industry as a junior, grinding away on bug fixes, writing unit tests, and building basic CRUD endpoints. Slowly, through hundreds of hours of raw syntax exposure, you built up mental models. You learned how state manag

I built a checker for a configuration directory. The time went not into adding rules, but into deciding what not to add . Things you could detect are easy to think of. That was never the constraint. One false positive is enough to get the tool thrown out A checker is asymmetric. A miss goes unnoticed. The cost is only that you did not learn something you could have. A false positive stops the reader and demands a decision: is this actually wrong? And once someone has been burned, they read every finding with suspicion . Twice, and the tool comes out of CI. So a checker that calls a valid configuration broken is worse than no checker. Better ten rules with no false positives than thirty with one. That is obvious in the abstract and hard in practice, because while you are writing the code, every "oh, I could check that too" pulls in the other direction. No citation, no rule So I fixed one condition for adding a rule: Only check what the official documentation states outright — as an error, as skipped, or as ignored. If the documentation does not say it, the rule does not go in, however wrong the pattern looks. What this buys is that the judgement stops living in my memory. "I'm fairly sure that form was invalid" is not a citation, and my memory goes stale the moment the tool it describes releases a new version. In the implementation, every finding carries its reason: export interface Finding { severity : " error " | " warn " ; file : string ; line ?: number ; /** what is wrong, in one sentence */ message : string ; /** why that can be claimed — includes the source URL */ because : string ; } Making because required is the point. A rule you cannot justify cannot be written , because the type will not let you leave the field out. If no source comes to mind, the rule never gets implemented. The tests enforce it too: for ( const f of findings ) { if ( ! f . because . includes ( " https:// " )) fail ( `no source: ${ f . message } ` ); } One finding without a source URL fai

Nscale, which recently struck a $45 billion deal with Anthropic, is in talks to raise additional funds in anticipation of an upcoming IPO.

The Transactional Outbox Pattern: Dual-Write Consistency in Distributed Systems One of the most dangerous anti-patterns in microservices architecture is the Dual-Write Vulnerability : updating a database record and immediately publishing an event to a message broker (e.g., RabbitMQ, Kafka) in the same API call. If the network fails or the broker is unavailable after the database transaction commits, the event is lost forever. Conversely, if the event publishes but the database rollback triggers, downstream consumers process a phantom event that does not exist in the source of truth. In this deep dive, we architect the Transactional Outbox Pattern with Change Data Capture (CDC) to guarantee At-Least-Once delivery with zero distributed locking overhead. Technical & Interview Cheat Sheet Approach Consistency Guarantee Failure Mode Overhead Dual Write (Naive) None (Eventual inconsistency) Message lost if broker drops Low 2-Phase Commit (2PC / XA) Strict Atomicity Blocking locks, single point of failure Very High Transactional Outbox (Polling) At-Least-Once Polling query table contention Moderate Outbox + CDC (Debezium) At-Least-Once (Zero Table Locking) Requires WAL decoder plugin Optimal 1: Database Schema Design The business entity change and the outbox event MUST commit within the exact same database transaction: -- Business Entity CREATE TABLE orders ( id UUID PRIMARY KEY DEFAULT gen_random_uuid (), customer_id UUID NOT NULL , total_amount NUMERIC ( 12 , 2 ) NOT NULL , status VARCHAR ( 32 ) NOT NULL , created_at TIMESTAMPTZ NOT NULL DEFAULT NOW () ); -- Transactional Outbox Table CREATE TABLE outbox_events ( id UUID PRIMARY KEY DEFAULT gen_random_uuid (), aggregate_type VARCHAR ( 64 ) NOT NULL , aggregate_id VARCHAR ( 64 ) NOT NULL , event_type VARCHAR ( 64 ) NOT NULL , payload JSONB NOT NULL , created_at TIMESTAMPTZ NOT NULL DEFAULT NOW () ); -- Index for high-throughput CDC streaming CREATE INDEX idx_outbox_created ON outbox_events ( created_at ); 2: Atomic C# Tra

Architecting Enterprise Angular with Signals: Zoneless Reactivity and 60fps Performance For nearly a decade, Angular relied on Zone.js to intercept asynchronous browser events and trigger top-down dirty checking across the entire component tree. In large enterprise dashboards displaying live telemetry, grid streams, and complex forms, this model leads directly to frame drops and memory leaks. With Angular 19+, fine-grained Signals provide a reactive paradigm where the framework tracks exact DOM dependencies at compile-time and updates only the precise DOM nodes that changed, unlocking 60fps zoneless execution . Architecture & Interview Cheat Sheet Feature Legacy RxJS / Zone.js Angular Signals (Modern) Change Detection Dirty-checks entire component tree Fine-grained single DOM node updates Memory Lifecycle Manual takeUntilDestroyed subscriptions Automatic graph cleanup without memory leaks Derivations Complex combineLatest / switchMap Lazy, memoized computed(() => ...) Zone.js Overhead Monkey-patches all browser async APIs 0 overhead ( provideExperimentalZonelessChangeDetection() ) 1: Clean Reactive State with Signals import { Component , computed , signal , effect , inject } from ' @angular/core ' ; export interface TelemetryPacket { id : string ; latencyMs : number ; status : ' healthy ' | ' degraded ' | ' critical ' ; } @ Component ({ selector : ' app-telemetry-monitor ' , standalone : true , template : ` <div class="card"> <h3>Live Ingestion Monitor</h3> <p>Total Packets: {{ packetCount() }}</p> <p>Average Latency: {{ averageLatency().toFixed(2) }}ms</p> <span [class.badge-warn]="isDegraded()"> {{ isDegraded() ? 'DEGRADED PERFORMANCE' : 'NOMINAL' }} </span> </div> ` }) export class TelemetryMonitorComponent { // Primary Writable Signal readonly packets = signal < TelemetryPacket [] > ([]); // Derived Computed Signals (Memoized, evaluated lazily on read) readonly packetCount = computed (() => this . packets (). length ); readonly averageLatency = computed (() => {

Four algorithms. Same grid. Very different dungeons. I implemented BSP trees, cellular automata, random walk, and room placement, ran each one 20 times on an 80x40 grid, and measured everything: connectivity, open space, path length, speed. The Results Algorithm Open Space Connected Rooms Path Length Speed BSP Tree 42.1% 100% 1.0 105 steps 0.88 ms Cellular Automata 55.8% 0% 15.2 78 steps 52.8 ms Random Walk 35.0% 100% 1.0 73 steps 274.7 ms Room Placement 18.9% 100% 1.0 81 steps 0.29 ms The big surprise: cellular automata never produces a connected map. Zero percent connectivity across 20 runs. Every single cave system has unreachable areas. The Maps BSP Tree (structured rooms, always connected) ################################################################################ ################################################################################ #####.........#####.............###################################....#......## #####.........#####.............##..........##############........#....#......## #####...........................##..........##############....................## #####.........#####.............##..........##############.............#......## #####.........#####.............##..........##############........#....#......## ##########.#######################..........##############........#....#......## ##########.#######################..........################..################## ######..........##################..........################..################## ######..........##################..........################..######..........## ######..........##################..........################..######..........## ######..........##################..........################..######..........## ######.............###############..........################..######..........## ######..........##.###############..........################..######..........## ######..........##.###############..........################..######..........##

Looks tasty . As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered. Blog moderation policy.

"It’s long past time for RFK to stop playing games with people’s lives."

Florida joins a growing list of cities and states responding to the license plate reader backlash.

The PR masterminds at the White House just released a series of vaguely policy-themed "arcade" games, some of which are racist - and modeled on real games whose copyright holders may not be too happy to be associated with the MAGA agenda. The Tetris Company has already responded to "Build the Wall," which is obviously […]

Other archives and libraries around the world may also contain genetic traces of past disease outbreaks.

I have spent more than six years shipping production software and I have no public repositories worth showing you. Everything substantial I have written at work lives in private repositories belonging to the companies I wrote it for, and confidentiality obligations do not lapse when a role ends. So I cannot hand you the code, and I am not going to. That is not caution for its own sake. An engineer who sends a prospective employer another company's source code has told you exactly what they will do with yours. The restraint is part of what you are assessing, and I would want the same restraint applied to my work later. Which leaves a real problem. "I was the principal author of the web application" and "I contributed to the web application" are the same sentence to a reader who cannot check either. Most engineering CVs resolve this by getting louder. I think the only honest resolution is to publish the measurement method rather than the artefact, in enough detail that someone familiar with the tools can judge the figure on its own terms without ever seeing the repository. Here is the method I actually used, what it does badly, and the places where applying it forced me to shrink a claim I would have preferred to keep. Three measurements, in increasing order of rigour All-branch commit count. Total authored activity. Do not use this. It counts abandoned branches, spikes and experiments, and it inflates — usually in favour of whoever is most willing to commit. It is the number that makes contribution graphs look impressive and says the least about a codebase. Production-branch commit count, scoped to tenure. What reached customers, while you were there. Better, because it excludes work that never shipped, and because scoping to tenure stops you either taking credit for years of history that predate you or being penalised for them. But it still counts commits, and a commit is a unit of activity, not a unit of code. Commit share rewards granular committers and punishes p

The standard objection to writing the design down is that it is what you give up in exchange for speed. Early-stage companies are meant to be the place where you skip it: no specifications, no plans, just build the thing and find out. Documentation is treated as a tax that mature organisations can afford and small ones cannot. I have worked the other way round, and I want to make the argument properly rather than just assert it. At Cendra , across a twelve-month tenure as one of two founding engineers, the work produced 255 design specifications, 207 implementation plans and 17 production runbooks. Over the same period: 377 production releases coordinated across four repositories, and 482 merge commits across those repositories (an all-merges count, broader than the frontend-only first-parent integration figure on the Cendra page), across 239 active development days. That release figure works out at roughly one every twenty-two hours. All of those figures are tenure-scoped, and self-measured against private repositories while I held authorised access to them, which is a caveat I will come back to. But the shape is the point: the documents and the shipping happened together, at the same time, by the same person. What I am not claiming I cannot prove the specifications caused the cadence. There is no control group. It is entirely possible to imagine a version of that year with no documents and more releases, and I have no way to rule it out. What I can do is describe precisely what the artefacts removed from the critical path, and let you judge whether that is worth the hours. The mechanism matters more than the correlation, because the mechanism is the part that transfers to your codebase rather than mine. The specification is a comprehension test I administer to myself The honest reason I write a design down before building it is not communication. It is that writing it is how I find out whether I actually understand the problem. There is a specific and reliable exp

Almost everything written about proactive AI is about the generating half. How the system notices a pattern, how it phrases the insight, which model reads the calendar. That half is not the hard part. The hard part is the decision immediately after: having noticed something true, do you say it? A proactive assistant has an asymmetric cost function. Surfacing something useful earns a little trust. Interrupting at the wrong moment loses a great deal, and users do not give a second chance to a notification stream they have already learned to ignore. Once attention has been trained away from a channel, it does not come back. So the interesting engineering sits on the restraint side, and it is systematically the side that gets built last. I know that because on the first notification system I owned, I built it last. The design that does not work The common shape is: generate candidate insights, score them, and filter against a threshold. It fails in two specific ways. The threshold is a single scalar standing in for many unrelated reasons to stay quiet. "Not this person", "not at three in the morning", "not in the first week", "not again, they have dismissed this three times" and "not today, the budget is spent" are different rules with different owners and different failure modes. Compressing them into one number means none of them can be reasoned about, and tuning any one of them moves all the others. And nothing records why anything was suppressed. A threshold returns false. The suppression behaviour — the most important behaviour in the product — becomes the one part of the system that generates no data, and therefore the one part that cannot be improved. Two questions, two places The design I settled on in LILA separates the questions completely. Is this worth saying at all is a reasoning problem. It depends on the content, the evidence behind it, and whether the observation is one a product should be making. It has nothing to do with the time of day. Should it be s

A green test suite is evidence. It is not independent evidence. The current release of badBANANA Threat Observatory passes all 108 automated tests in its own development and CI environments. That tells me the implementation satisfies the assertions I wrote against the conditions I expected. It does not tell me whether an independent developer can check out the same commit in a clean environment and obtain the same result. That distinction matters more than the number 108. The dangerous failure is a believable one The Observatory presents source-backed threat-intelligence records, freshness information, and material-change events. In that kind of interface, an obvious crash is not necessarily the worst outcome. A more dangerous failure is one that looks healthy: An expired cached snapshot presented as current An invalid expiry value treated as usable A failed upstream source displayed as a successful zero-result response Demo or fallback data appearing without explicit disclosure A disabled or offline state silently normalized into success Those failures do not merely inconvenience the user. They change what the interface appears to know. For v1.2.2, the intended behavior is deliberately fail\ closed: Condition Required behavior Cached snapshot has expired Report it as stale Expiry value is invalid Fail closed to stale Source is offline, disabled, or failed Preserve that state Source data is missing or unavailable Do not present a successful zero result state Ingestion requests overlap Enforce the runtime concurrency limit deterministically Feed credentials are configured Keep them server side and absent from client output The test suite exercises these boundaries. The remaining question is whether the release reproduces cleanly outside the environment in which it was built. Passing tests and independent verification are different claims When the source, tests, build assumptions, and execution environment all come from the same maintainer, a successful run demonstrat