标签：#t

At the beginning of my Engineering career, I worked in a place where I had a lot of freedom to implement and experiment any technology I found interesting. I tried many technologies like PHP, Java, EJBs, SOAP, Rest and JavaScript. This gave me a lot of perspective, but I lacked the guidance and mentoring from more experienced developers. One of the most problematic things I built was a login. I would like to share in this document things that I did in the past so you understand why it is problematic and how I would build them today. Earlier Mistakes My First PHP Login. This is not a terrible option when using a single host, small project, but the biggest problem comes when we need to scale horizontally. Session variables exist only on the servers they are created. If you add more servers + Load Balancer, there is no guarantee that your requests go to the same server. In terms of vulnerabilities, if somebody manages to read your session id, they can impersonate you, act on your behalf. This is not really different from other methods like JWT so it is important to set up SameSite cookies or CSRF tokens, but do you think I did that for my first login ? of course NOT! My first Password storage. If you are thinking on implementing a login please NEVER do what I am about to describe: The first time I implemented a password, I was worried that somebody would find out the "actual" password. I wasn't actually thinking about using HTTP (instead of HTTPs), so my take on this was "encrypting" the password into MD5. Then the password was saved in MD5, but I was NOT doing anything different than just sending the password AS is. Let me explain the problems with this approach: Over HTTP an MD5 password can be read, and anybody can simply replicate the request with the same MD5 MD5 was actually NOT encrypting, it was a hashing. There are databases all over the internet mapping MD5 and other hashed passwords available so finding an MD5 can actually be translated to an actual password

Six months ago I got tired of switching between apps to talk to AI. ChatGPT in the browser. Claude in another tab. Local models in a terminal. It was like having five friends who all live in different cities and refuse to visit each other. So I did what any developer with too many GPUs and too little patience would do: I built my own assistant and put it where I already spend my day — Telegram. It's not a chatbot for customers. It's not a business automation tool. It's just... my assistant. It lives in a private chat on my phone and handles the stuff I used to do manually. Here's what six months of actually using it has looked like. What I Actually Built (And Why Telegram) I already had three machines running Ollama at home — a Mac Mini M4, a Windows PC with an RTX 3060, and an Ubuntu box. Three endpoints, eight models, and me constantly forgetting which model was good for what. Telegram was the obvious choice because: I'm already there all day (friends, family, a few dev groups) It works on my phone, my Mac, and my watch The Bot API is dead simple I can send voice messages, photos, documents — and the bot can handle all of them The setup: a Python bot running on the Mac Mini, connected to all three Ollama endpoints. When I message it, the bot classifies what I want, routes to the right model on the right machine, and replies in the same chat thread. Sounds simple. Took three evenings to get right. Took six months to make actually useful. The Things I Actually Use It For Here's the honest list. Not the marketing pitch — the real daily usage: 1. Quick questions without context switching "Summarize this article" (I paste a link). "Explain this error" (I paste a stack trace). "Rewrite this email less formally." These used to mean opening a browser tab, logging in, maybe hitting a rate limit. Now I just... send a message. The reply comes back in 2-8 seconds depending on which model handles it. The routing is simple but effective: quick chat → small model on the Mac. Cod

Before this week, NFTs on Solana weren't new to me. I've previously worked with Programmable NFTs ( pNFTs ) and even built projects that integrate them. However, most of my experience was centered around the Metaplex ecosystem, so I tended to think about NFTs through that lens. What surprised me during this learning arc was discovering how much can be built directly with Token Extensions. By creating NFTs from the token level upward, I gained a much deeper understanding of the underlying primitives that make digital assets work on Solana. The Mental Model: What Is an NFT on Solana? As developers, we often interact with NFTs through SDKs , frameworks , and marketplace tooling. Those abstractions are useful, but they can hide what's actually happening on-chain. This week helped me simplify the model: An * NFT * is fundamentally a token mint configured with: A supply of one Zero decimals Metadata describing the asset Optional relationships to collections or groups Using Token Extensions, many of these capabilities can be attached directly to the token itself rather than relying on additional programs or infrastructure. That shift in perspective was one of the biggest takeaways from this challenge. What I Built Over the course of this arc, I created an NFT on Solana Devnet using Token Extensions and explored several capabilities that I had never implemented directly before. The process included: Creating a mint configured as an NFT Adding metadata using the Metadata Extension Minting a single token Creating a collection using the Group Extension Associating the NFT with the collection through the Member Extension Auditing the account structure and extension data on-chain Updating metadata after the NFT had already been created One of the most valuable parts of the exercise was inspecting the accounts directly instead of relying solely on SDK abstractions. For example: spl-token initialize-metadata \ <NFT_MINT> \ "My First NFT" \ "MNFT" \ https://example.com/metadata.jso

If you use Cursor, Claude Code, or Windsurf daily, you've probably had this experience: You open a fresh chat, ask for a small fix, and twenty minutes later the AI has rewritten your API layer, added three new dependencies, and switched your data-fetching pattern "for consistency." The model isn't broken. It's contextless. Every new session starts from zero. It doesn't know your stack, your conventions, or the things it must never touch. So you spend the first ten minutes re-explaining — and the last hour undoing. Here's what fixed it for me. The real problem isn't prompts Most devs collect prompts. Notes app, Slack snippets, old chat threads. That helps for one-off tasks, but it doesn't solve the session problem. What you need is persistent context — rules that load automatically before you type anything. Two files do this: CLAUDE.md — read by Claude Code (and usable as project context elsewhere) .cursorrules — loaded by Cursor on every session (rename to .windsurfrules for Windsurf) Drop them in your project root. Done. What goes in a good config file A useful config is not ten lines of "use TypeScript and write clean code." That's too vague to change behavior. Mine include: Project structure — where pages, components, and API routes live Stack + versions — Next.js 14 App Router, not Pages; Zod; shadcn/ui Commands — npm run dev, npm run typecheck, npm run test Coding conventions — naming, import aliases, Server vs Client Components DO NOT section — the most important part (more on this below) Workflow notes — use @folder, prefer editing existing files, minimal diffs Here's an excerpt from the DO NOT section that saved me the most time: DO NOT — Critical Anti-Patterns Do NOT create a pages/ directory or use the Pages Router Do NOT rewrite the entire API layer — extend existing route handlers Do NOT add new npm dependencies without stating why Do NOT make drive-by refactors in unrelated files Do NOT fetch data in useEffect when Server Components can fetch directly T

NVIDIA's cuda-python , the official Python bindings for the CUDA toolkit, recently added automatically-generated .pyi stub files using stubgen-pyx . Their description of why: "This allows IDE auto-completion to work (which is also used by IDE-integrated coding agents). This has also found 2 real bugs in our code already. The ability to catch a certain class of bugs with this will be really helpful going forward, especially since our linting abilities with cython-lint are a bit behind what they are in pure Python." When you commit .pyi stubs alongside a Cython extension, you get an artifact your normal Python linting and type-checking pipeline can analyze. Inconsistencies between what the Cython source does and what the stub claims become visible. NVIDIA found two real bugs this way before they were reported. I'm the author of stubgen-pyx, and this post is a technical walk-through of how those stubs are produced. The problem with existing stub generators When you compile a Cython module, the source disappears. What you get is a .so (or .pyd ) file: a compiled extension with no type information readable by a language server. Tools like mypy's stubgen can generate stubs for these by importing the compiled binary and using runtime introspection. The results are usually disappointing. Take this typed Cython module: """ Mathematical utilities for scientific computing. """ cdef class Matrix : """ A simple matrix class. """ cdef int rows cdef int cols def __init__ ( self , int rows , int cols ): """ Initialize a matrix. """ self . rows = rows self . cols = cols def shape ( self ) -> tuple [ int , int ]: """ Get matrix dimensions. """ return ( self . rows , self . cols ) cpdef scale ( self , double factor ): """ Scale all elements. """ pass cdef int _validate ( self ): """ Internal validation (not exposed). """ return 0 def matrix_product ( Matrix a , Matrix b ) -> Matrix : """ Compute matrix product. """ return Matrix ( a . rows , b . cols ) Running stubgen on the compiled

The 30-second version Anthropic shipped Claude Opus 4.8 a few hours ago. Every benchmark on the announcement page is up: SWE-bench Verified, GPQA, MATH-500, the agentic tool-use evals. The marketing copy reads as it always does — "our most capable model", "strongest coding performance", "better instruction following". If you have been around since 4.5, you know the shape of this announcement by heart now. The announcement skipped the only question that matters for teams running Claude in production: should you upgrade today, next week, or next month, and which of your workloads should stay on Opus 4.7 indefinitely? Anthropic does not write that part. They cannot — it is workload-dependent, and the answer for a code-review agent is different from the answer for a customer-facing chat product. This post is the decision tree I am applying to my own stack today. It is opinionated. Three of the workloads I run are staying on 4.7 until at least mid-July, and I will explain exactly why. Your mileage will vary, but the reasoning shape should transfer. What actually shipped in Opus 4.8 Let me anchor on the facts before the opinion. Opus 4.8 is the third release in the Opus 4.x family this year. The pattern across 4.6 (March), 4.7 (April), and 4.8 (today) has been roughly monthly. Each release has shipped a 2-4 point bump on SWE-bench Verified and a similar bump on the agentic evals. 4.8 follows the pattern: roughly 3 points on SWE-bench, about 2 points on the multi-step tool-use benchmark, and a more visible jump on the long-context retrieval evals — the 'needle in a haystack at 200K tokens' style tests. Three changes are worth pulling out of the announcement: Better long-context coherence . The 4.8 release notes specifically call out improved behavior on tasks that span more than 100K tokens of context. Concretely: less mid-context summarization, fewer instances of the model 'forgetting' early-context instructions, better citation of source material when retrieved chunks sp

Retry storms turned 1 timeout into 340 duplicate calls billed in 90 seconds Infinite tool loop ran 1,200 iterations before I noticed at 2am Partial stream cleanup stopped half-written DB writes corrupting records Trap every error class with a circuit breaker and a hard iteration cap Five Claude API errors quietly drained my account before I built guards around them. None of them threw a loud crash. They just kept billing while I slept. Here is exactly what broke, what it cost, and the traps I now run on every project. The Retry Storm That Billed 340 Times in 90 Seconds The most expensive mistake I made was naive retry logic. A single request timed out. My code caught the timeout and retried. The retry also timed out, so it retried again. Within 90 seconds I had fired 340 requests for one piece of work. The problem was that the Claude API had actually received and processed several of those requests. The timeout happened on my side waiting for the response, not on Anthropic's side. So I was paying for completed work I never saw, then paying again for the retry. My first version of the retry looked harmless. A while loop, a counter set to 5, a sleep of one second between attempts. The flaw was that the sleep was constant and the counter reset on every new job. Under load, jobs stacked, and each one spawned its own retry chain. That is how 1 timeout became 340 calls. The fix was exponential backoff with a hard ceiling and a request ID. I now generate a unique idempotency-style key per logical job and refuse to issue a second call for the same key until the first fully resolves or hard-fails. Backoff starts at 2 seconds and doubles up to 32 seconds, then gives up after 5 total attempts. attempt = 0 delay = 2 while attempt < 5 : try : return call_claude ( job_key ) except Timeout : attempt += 1 sleep ( delay + random_jitter ()) delay = min ( delay * 2 , 32 ) raise GiveUp ( job_key ) The jitter matters more than it looks. Without it, ten failed jobs all retry at the exact

Have you ever wondered how Discord keeps your channel messages available even when a server goes down? Or how Amazon DynamoDB serves petabytes of data with single-digit millisecond latency? The unsung hero powering almost all these distributed systems is hashing — a simple but powerful technique that makes even load distribution, fast lookups, and seamless scaling possible. As more applications move to distributed cloud architectures, understanding hashing for distributed systems is no longer optional for developers. Choosing the wrong hashing algorithm can lead to cascading failures, cache stampedes, and expensive downtime. This guide breaks down every core hashing technique, real-world use cases, best practices, and common pitfalls to avoid in 2026. Table of Contents What is Hashing in Distributed Systems? Core Hashing Algorithms Explained Traditional Modulo Hashing Consistent Hashing Virtual Nodes (VNodes) Rendezvous Hashing (HRW) Jump Consistent Hash Maglev Hashing Multi-Probe Consistent Hashing Consistent Hashing with Bounded Loads Real-World Applications of Distributed Hashing Head-to-Head Algorithm Comparison Best Practices for Distributed Hashing Common Pitfalls to Avoid Conclusion References What is Hashing in Distributed Systems? Hashing in distributed systems is the practice of mapping data keys (e.g., user IDs, object keys, channel IDs) to server nodes using a deterministic hash function. The core goals are: Distribute load evenly across all nodes to avoid hotspots Enable fast lookups (O(1) or O(log N)) without a central coordinator Minimize data movement when nodes are added or removed during scaling Support fault tolerance by simplifying replication across nodes The simplest implementation is modulo-based hashing , where node_id = hash(key) % N and N is the total number of nodes. While trivial to implement, it suffers from a fatal flaw: the rehashing problem. When N changes (a node is added or removed), nearly all keys are remapped to new nodes, causin

Nearly a year after it was announced, Instagram says it's delivering the ability to rearrange the posts in your profile grid. It had been available to some people in test groups, but as of June 8th, it's rolling out widely via the Android and iPhone mobile apps. Until now, the posts on your Instagram profile […]

A pattern keeps repeating itself in AI projects. The model works. The demo works. The proof of...

Apple spending a big chunk of its WWDC keynote on parental controls was surprising for several reasons. But the biggest is that, despite all the airtime, it didn't announce much new beyond a redesigned interface. Almost all the features touted already exist or are upgrades to current options. Why Apple chose to do this isn't […]

I’ve been trying different AI tools lately, and I’m starting to notice that each one has its own strengths and weaknesses. Some feel better for writing. Some are better for research. Some are stronger for coding, image generation, brainstorming, or organizing messy ideas. For people who use AI regularly, what tool do you trust most for specific tasks, and which ones do you avoid for certain work? submitted by /u/GlobalOpsNotes [link] [留言]

iOS 27 has only been out for a few hours, and I've been messing around with the developer beta on my iPhone 16 Pro. I was most interested in trying out the new Siri AI, but unfortunately, I'm still on Apple's waitlist for that. In the meantime, I've been poking around a bunch of features […]

Can't a multi-trillion-dollar company have secrets any more?

Is it just me, or does anyone else find they can't help themselves troll AI sometimes. Like I will use Claude for a long research project, write and refine a report, and once done I just love fucking with it. Like asking it to rewrite the report because I am going to send it over to a 4 year old to review, so if you could please put the whole thing in baby talk. Or ask it what I can put on the slides when I present it in order to guarantee that anyone who sees it will become incredibly attracted to me. Or ask it to find the closest tattoo shop near me because I am going to get this whole report tattooed on my ass and moon people on the street as a guerilla marketing experiment. Is my life so dull that I have to resort to fucking with a robot to feel feelings? submitted by /u/musicheadspace [link] [留言]

The 'disappearing into the bushes like Homer Simpson' strategy is a bold choice.

Tools for Humanity, Sam Altman's identity verification company, is reportedly struggling to generate revenue and will downsize its staff.

The vibe of Apple's 2026 WWDC keynote felt like a spouse proudly listing all the honey-do-list items tackled. One subtle example: the many AI demos of someone standing, phone in hand.

The FTX CEO was sentenced for fraud in 2024.

Apple is trying to solve one of Safari's biggest weaknesses with AI. Safari has long lacked the robust library of extensions that its rivals have, mainly due to the stringent development requirements from Apple. But now, Apple is inviting users to essentially vibe-code their own extensions. In a demo shared by Apple, the company showed […]