标签：#tor

VeraCrypt is easy to use badly. You can choose an unnecessarily complicated cipher cascade, forget a custom PIM, leave the only copy of a keyfile on a dying USB stick, sync a mounted container through two computers, or discover during a boot failure that your recovery media was never tested. None of those failures means the cryptography was broken. They mean the surrounding system was badly designed. This guide focuses on both sides of VeraCrypt: how to operate it and how to make defensible decisions about passwords, key derivation, filesystems, backups, system encryption, hidden volumes, SSDs, and recovery. The instructions and terminology here were checked against VeraCrypt 1.26.29 , released on June 9, 2026, and current as of September 2026. Version 1.26.29 is especially significant because it adds Argon2id for non-system volumes and fixes a plausible-deniability issue affecting some hidden volumes created by versions 1.26.6 through 1.26.28. ( veracrypt.io ) TL;DR If you want the short version: Use an encrypted file container for a manageable collection of sensitive files. Encrypt an entire USB stick or external drive when everything on it should be protected. Use VeraCrypt system encryption only on supported Windows x64 systems, and only after creating and testing recovery media. Use FileVault for a Mac startup disk and LUKS for a Linux system disk. VeraCrypt does not provide macOS or Linux system encryption. For a new non-system volume in VeraCrypt 1.26.29, use the default AES encryption algorithm and Argon2id KDF unless you need compatibility with an older VeraCrypt installation. Leave PIM at its default unless you understand the security, memory, performance, and recovery consequences. Prefer a long, unique password over unusual cipher combinations. Treat keyfiles as additional credentials that must be backed up perfectly. Never store your only backup inside the encrypted volume it is supposed to protect. Unmount a volume before unplugging its device, copying

An approval rule becomes useful when you can test what happens on both sides of it: the forbidden action is refused, and the permitted decision leaves evidence. A happy-path demo alone cannot show that distinction. Here is a runnable example using Accordo, the open-source framework coding agents use to build custom CRMs. A synthetic customer wants 30 seats of an Enterprise Plan and requests 25% off. The existing policy permits automatic approval through 10%; above that, through 50%, it requires a user decision. Run it locally You need Git, Node.js 22.16 or newer, npm, and internet access for cloning and dependency installation. Start in an empty working directory: git clone https://github.com/khaoss85/agent-crm.git framework-source cd framework-source git checkout 3b5b5f0c4c3e582e48d54501136024b064756daa node --no-warnings examples/recipes/quote-approval/run.mjs ../my-quote-crm The pinned recipe source creates a project, installs its dependencies and composes the existing commercial package. It then starts a temporary server on localhost and drives the public SDK through HTTP. The catalog is a fixture; the business journey does not call an external provider. It uses source from the checkout, independently of the npm scaffolder release. Check the refusal, then the decision The script contains assertions for each transition: Server pricing produces EUR 3,750 once and EUR 2,400 per month after discount. These are synthetic quote amounts, kept in separate periods. Submission under policy version 1 freezes a commercial snapshot and enters pending_approval . An approval request from the simulated agent receives HTTP 403 with HUMAN_APPROVAL_REQUIRED . The quote and approval remain pending, and no business audit entry is added. A simulated user approves. The quote becomes approved , with one user decision audit and a completed trace. The submitted snapshot remains unchanged. There is one quote version and one approval record. The refusal also has a failed trace. That is a u

The short version NextAuth (now Auth.js) creates 4 tables in your database: users , accounts , sessions , and verification_tokens . The users and accounts tables have a one-to-one relationship via accounts.user_id . Sessions link to users via sessions.user_id . Verification tokens are short-lived and self-cleaning. The 4 tables users Column Type What it means id text / UUID Primary key. Generated by NextAuth. name text Display name from the OAuth provider (Google, GitHub, etc.) email text User's email. May be null if the provider doesn't share it. email_verified timestamp When the email was verified. Null if never verified. image text Profile picture URL from the provider. created_at timestamp When the user first signed in. updated_at timestamp Last profile sync from the provider. accounts This table links a user to an OAuth provider. One user can have multiple accounts (e.g., Google + GitHub). Column Type What it means id text / UUID Primary key. user_id text Foreign key → users.id . type text Always "oauth" or "oidc" . provider text "google" , "github" , "discord" , etc. provider_account_id text The provider's unique ID for this user. refresh_token text OAuth refresh token (encrypted in production). access_token text OAuth access token (encrypted in production). expires_at integer When the access token expires (Unix timestamp). token_type text Usually "Bearer" . scope text Permissions granted by the provider. id_token text OIDC ID token (if using OIDC). session_state text Provider-specific session state. sessions Active sessions for each user. NextAuth creates a new row here on every sign-in. Column Type What it means id text / UUID Primary key. session_token text The session token stored in the user's cookie. user_id text Foreign key → users.id . expires timestamp When this session expires. verification_tokens Short-lived tokens for email verification, password reset, etc. Self-cleaning old tokens are deleted automatically. Column Type What it means identifier te

The reason I started this project is to learn more about C++, as we all know the best way of learning a programming language is to do projects, DO PROJECTS!! I used Austin Morlan's website to learn how to build it, it's quite good ( https://austinmorlan.com/posts/chip8_emulator/ ). I made some tweaks which I found to be better for me. I will not be posting the whole codebase here, it's too long. What I will be sharing are snippets of code, what I learned from it, and what I found amazing or funny (projects can have their own jokes). What is an Emulator ? An emulator is just hardware or software that lets the host system replicate conditions like the CPU, memory systems, clock cycles, etc., of the guest system whose functions/behaviour they want to simulate. It helps to bridge the architectural gap by making sure that each instruction code can be executed. In the case of Chip8, we have to simulate the hardware restrictions of the 1970s: a 64x32 screen, a 16-key keypad, timers, and a buzz sound. If you google Chip8, you will see that it is not actually a real physical device. It is a virtual machine/interpreter where you can interpret games (that was the intended purpose), like Pong or Space Invaders. It was a virtual language created in 1977 AD for a computer called COSMAC VIP. Building in C++ I wanted to get familiar with C++, that's why I am here. Building a Chip8 emulator in C++. Well, I learned you need headers, classes to define objects, the standard library, built-in objects like std::ifstream, std::streampos, and so on. I will explain some parts that left a mark in my memory. Header Files Well, before C++, I had only used a header file for an FPGA (Tang Nano 9K) project which I did. It made the LED blink in intervals. But now I understand more, such as how we create a blueprint of the class which we will be using to create objects in the future. Two modes: Public: The attributes and methods of the said class can be accessed by other functions or parts of the p

Half a day lost is the honest cost of treating an AI model like a document. I discovered that the hard way: a CAPA opened for a data-provenance gap rolled forward into missing documentation, which then exposed weaknesses in change control and supplier traceability. This is what happened, what we changed, and the small automation that stopped the loop from repeating. The trigger: a CAPA that looked simple and wasn't An engineer flagged a discrepancy between on-device inference behaviour and the validation test bench. The CAPA looked routine: reproduce, find root cause, correct datasets or model weights. Quickly it turned into: We couldn't identify which training dataset produced the deployed model (no manifest, only folder names). Preprocessing steps changed between runs (different label encodings, a silent resampling step). Model binaries were overwritten in a shared location without an immutable model registry entry. Change control only referenced a release ticket number — not the dataset or container image digest. What began as a data-provenance finding became a documentation finding, then a change-control finding. Auditors would call this a traceability gap. The EU AI Act (and notified bodies increasingly expect traceability for high‑risk AI components) means you must show how a model version ties to the data, the training pipeline, the verification evidence, and the approval record. We didn't have that linkage. By midday my filter coffee was cold and I had a long list of evidence to assemble. Why CMOs see this differently As a CMO handling components and supplier networks, our "models" are often supplier-provided (analytics, inspection classifiers, OCR of COAs), or built from datasets stitched from multiple vendors. The usual eQMS workflows assume a device maker controls the full pipeline. They rarely fit a supplier-heavy reality where: Sub-tier suppliers supply datasets or models. Incoming inspection depends on vendor-provided models for automated checks. Suppl

The quiet mistake most new mentors make is assuming the person in front of them wants your life. It is an easy mistake, because your path is the one you understand best. You know where the shortcuts were. You know which turn cost you two years. Of course you want to hand that map over. But it is a map of your terrain, not theirs. I have watched good mentors accidentally push someone toward management because management worked for them, when the person across the table lit up talking about deep technical work and went flat every time the org chart came up. I have also watched the reverse. A mentor who loved staying hands on, telling someone who was clearly born to run a team that leadership is a trap. Both were generous. Both were giving real, hard won advice. Both were answering a question nobody asked. So ask first, and ask properly. Not what do you want to be in five years, which almost nobody can answer honestly. Ask what part of last month did you enjoy most. Ask which meeting you would keep if you could delete all the others. Ask what you would do on a Tuesday with nothing on the calendar. The answers tell you far more than a stated ambition, because ambitions are usually borrowed and preferences rarely are. Then hold your own story loosely. Tell it as one data point, not as the route. I did this and it worked for me, for these specific reasons, and here is why it might not apply to you. That last clause is the whole job. Your value is not that you know where they should go. You almost never do. Your value is that you have seen more of the landscape than they have, so you can describe what is over each hill and let them choose the climb. The measure of good mentoring is not that they end up like you. It is that they end up more like themselves, faster than they would have alone. – Asael Shinder

This week's Java roundup for August 31st, 2026, features news highlighting: the GA release of TornadoVM 6.0; point releases of JReleaser, LangChain4j, Java Operator SDK, JHipster, Kotlin Toolchain and Yupiik Fusion; and maintenance releases of Micronaut and GraalVM Development Kit. By Michael Redlich

Most countries tax immovable property, and most of them argue about it badly. The argument usually skips the part that decides the answer: before any map is coloured, someone has to choose what is added up, what it is divided by, over which territory it is aggregated, and which cases are left out . Change any of those and the map can change while the underlying data stay identical. This post works through that problem with Chilean data, because Chile happens to publish the pieces needed to do it honestly: a national cadastre of every taxable property, and an official index that ranks small civic territories by socio-territorial vulnerability. The mechanics, though, are not Chilean. Any jurisdiction that assesses property for tax and then maps the result against a deprivation measure faces exactly the same four choices. The question fits in one small fraction: territorial indicator the unit you compare it against the total you want to describe ​ Adding up the assessed value inside a territory answers how much administrative value was allocated there. Dividing that same total by households, by residents or by square metres answers different questions. None of them is «the correct one» by nature; the error appears when one is presented under another's name. The arithmetic is usually innocent. The narrative is not always. Reading contract I cross two Chilean administrative registers: the real-estate cadastre of the Servicio de Impuestos Internos (SII) —Chile's tax authority, roughly the counterpart of the IRS or HMRC— and the Índice Global de Vulnerabilidad Socioterritorial (IGVUST) , a socio-territorial vulnerability index published by the Ministry of Social Development and Family. The unit of analysis is the neighbourhood unit , not the parcel, the household or the person. A word on that unit, because it has no clean equivalent elsewhere and it drives half of what follows. A Chilean unidad vecinal (UV) is a civic territory drawn for neighbourhood organisation and loca

Schiller reportedly had reservations about new CEO John Ternus' goal of bringing in more recurring revenue from the App Store.

In every project, someone says it sooner or later: "we have too much technical debt." Everyone agrees. Nobody asks how much. One day I tried to do the math for real. I learned very little about my code, and a lot about the metaphor. The bank statement If my technical debt were a loan, it would have the same structure: At the bank In the code The principal The shortcut taken to ship on time The interest The extra cost of every new feature Repayment Refactoring Bankruptcy A full rewrite So I listed my lines: a 3,000-line service with no tests, a framework three major versions behind, billing logic copied in four places, and one module everyone avoids. Every feature costs me about 30% more time. And the principal, the amount I would need to pay to reach zero, is measured in months of work that nobody will ever give me. The verdict: I am insolvent. And yet I ship every week, and I have been shipping for years. This is where the analogy breaks. Four reasons why it is not a debt I don't know the amount. A bank debt is a number written in a contract. Technical debt has no number, it has opinions. Ask three developers to rate the same module and you get three answers. I never signed anything. You choose to take a loan. Most of my technical debt arrived on its own: a library abandoned by its author, a business rule that changed, a project I inherited. Ward Cunningham, who created the term in 1992, was talking about a loan you take on purpose, to learn faster. He then spent twenty years repeating that he never meant "badly written code." The interest does not arrive every month. You only pay for the code you touch. I have terrible files that have not cost me a single minute in three years, because nobody goes there. And I have an 80-line file, changed twice a week, that is ruining me. There is no zero balance. The refactoring I do today will be out of date in two years. I never repay anything. I just trade one debt for another one with a better rate. The word itself is a prob

Modern price monitoring systems need to do more than tell you that a price changed. A single abnormal listing, a scraped error, or a temporary outlier can make a traditional threshold-based detector fire an alert when nothing meaningful happened. In this project, I built a lightweight real-time price anomaly detector in Python that combines: A rolling median baseline Median Absolute Deviation (MAD) Robust Z-scores Short-term percentage returns Trend confirmation Alert cooldowns The goal is simple: detect meaningful price movements without overreacting to noisy observations. Note: This project monitors retail prices from Google Shopping results through SerpApi. It is a retail-price monitoring example, not a financial exchange-data feed. What we're building The pipeline looks like this: ┌──────────────────────┐ │ SerpApi / Shopping │ └──────────┬───────────┘ │ ▼ ┌──────────────────┐ │ Price Extraction │ │ + Validation │ └────────┬─────────┘ │ ▼ ┌────────────────────┐ │ Rolling Price │ │ History │ └────────┬───────────┘ │ ┌───────────┼───────────┐ ▼ ▼ ▼ Median MAD Return % │ │ │ └───────────┼───────────┘ ▼ Robust Z-score │ ▼ Trend Confirmation │ ▼ Signal Engine │ ▼ Alert Cooldown The implementation is intentionally small and interpretable. The complete engine is built around a single PriceAlertEngine class and a compact AnomalyResult data structure. Why not just use standard deviation? A common first implementation is: price > mean + 3 * standard_deviation The problem is that standard deviation is sensitive to extreme observations. Suppose your historical prices are: 990, 995, 999, 1001, 1005 Then one bad observation such as: 1500 can distort the mean and standard deviation. That can move your detection boundary away from the actual market behavior you are trying to model. For a noisy retail environment, a more robust baseline is useful. That's where median and Median Absolute Deviation come in. 1. Building a rolling median baseline Instead of storing an unlimited stre

If you have ever tried to programmatically get the current RBA cash rate, you know the drill. You open the RBA F1 statistical table, download f01hist.xls, write a pandas.read_excel call, fight with the multi-row header (Series ID on row 11, units on row 6), filter, sort, take the last row. That is 30 lines of code to get a single number that changes 11 times a year. One line (MIT, no key) from rba_mcp import client print ( client . latest ( " F1_1 " , series = " cash_rate_target " ). records [ - 1 ]. value ) # live AU.CASHRATE as of 2026-09-03: 4.35 pip install rba-mcp No key. MIT-licensed. Attribution and source URL come back with the number. Hosted gateway Use GET /v1/series/AU.CASHRATE/latest on api.ausdata.io with a free key from ausdata.io (500 calls/mo). Live 2026-09-06: cash 4.35 percent, trimmed-mean CPI 3.6 percent (2026-Q2), real rate 0.75 percent. Why the hosted path exists The RBA publishes the nominal cash rate. The ABS publishes inflation. Neither publishes the real cash rate (nominal minus trimmed-mean CPI). Use /v1/real-rate-regime for that join. Same envelope across nine AU sources: source, source_url, attribution, retrieved_at. MCP Wire ausdata-mcp via npx in Claude Desktop or Cursor. Sisters on PyPI run fully local with no key. What this is not Suburb-level property prices Live KYC / company-officer lookup 5-minute wholesale electricity bid stacks AU macro public data, one envelope, citations done for you. R users readrba by Matt Cowgill is the R equivalent. This is the Python / JS / agent path. Links Canonical: https://ausdata.io/blog/rba-cash-rate-python-api/ Free key: https://ausdata.io Series: https://ausdata.io/series/AU.CASHRATE PyPI: rba-mcp

Adapted from my original Japanese article , with AI-assisted translation and editing. My manager: “Test this device.” (Doesn't really know the product or the technology.) Me: “Sure.” (Also doesn't really know the product or the technology.) If you've worked in infrastructure, that may sound familiar. I'm Goda, a network engineer sharing things I learned while figuring out the job. SNMP comes up in a lot of network device testing. For a while, my idea of an SNMP test was simple: Run snmpwalk . Watch a pile of OIDs and values scroll past. Mark SNMP as working. A screen full of output is reassuring. It certainly looks like something is being monitored. Then I was asked to write a test plan for a device. I added an item along the lines of “Confirm that information can be retrieved using SNMP” and sent it for review. The feedback was: Which OIDs will you use for CPU and memory? The customer will probably ask. You should at least cover those. That was when it clicked: a successful walk and successful retrieval of the metrics we need are two different things. My other thought was, “Fine, you write the test plan, then.” But the feedback was fair. Getting something back is not the same as getting what you need. What did the successful walk actually prove? snmpwalk is useful. Net-SNMP's tool uses GETNEXT requests to walk through a subtree starting from a specified OID. Net-SNMP manual If it successfully returns values, you've established that you could read those values under those test conditions . That matters. It does not, by itself, establish that your CPU and memory monitoring requirements are satisfied, or that every required OID is available. I had been treating a successful command as a much broader result than it actually was. Break “SNMP testing” into specific checks Today, I'd separate at least these questions: Question What to check Can I communicate over SNMP? Whether the device responds to the intended request under the defined conditions Can I monitor CPU? The

A process supervisor can tell you that a process exists. It cannot, by itself, tell you that a Minecraft player can join. I work on ChunkCraft, a Minecraft hosting project. Here is a small state model that helps keep operational status separate from player-facing guidance. Separate three questions Is the process alive? The container or service manager owns this signal. Has the game finished starting? Startup logs or a game-level probe provide this evidence. Can this player join? Client version, edition, whitelist and network reachability still matter. A useful state model is stopped → starting → ready , with failure and unknown states represented explicitly. Avoid converting a failed probe into “stopped”: a timeout means the observation failed, not necessarily that the server died. Tie each state to a next action Observed state Useful guidance Starting Wait for world loading; show recent startup progress Ready Show the complete connection address and expected version Unreachable or unknown Show when the last successful observation happened and offer diagnostics Player rejected Read the actual join error; check version and whitelist The same principle applies to control buttons. A copy-address action is helpful when the address exists and startup has completed. Showing it as the only instruction during startup invites repeated failed joins. Do not confuse observation with proof Even a successful game-level probe does not prove every player can reach the server. Likewise, a positive player-count sample proves someone was connected at that sample time; it does not identify that person or establish uninterrupted availability. Store observation timestamps alongside values. When a collector fails, preserve historical observations but mark them stale. A freshly rendered dashboard is not evidence of fresh underlying data. A small review checklist Does every status describe an observation we actually have? Is an unknown state distinguishable from a confirmed failure? Does th

A library isn't code. A library is thirty or forty decisions somebody already made, correctly,...

Hello, fellow version-bumping enthusiasts, sleep-deprived Rustaceans, and accidental software...

Now that we have a mental model of how Solana works, it’s time to actually use it. We’ve talked about accounts holding state, programs containing the logic, instructions telling those programs what to do, and transactions bringing those instructions together. Creating an SPL Token Mint is a good place to see all of those concepts working together. In this part, we’ll create and initialize an SPL Token Mint on Solana Devnet, but more importantly, we’ll break down what is actually happening underneath the code. So, what exactly is a Mint? If I tell Solana to give someone 100 of a particular token, Solana first needs to know what that token is. What defines it? How divisible is it? How many units currently exist? Who has the authority to create more? That is where the Mint Account comes in. A Mint Account represents a particular type of token on Solana. It stores information about that token such as its current supply, decimals, mint authority and optional freeze authority. It does not store how many tokens I personally own. That belongs somewhere else, which we’ll get to when we talk about Token Accounts and ATAs. A simple way to separate the two is this: the Mint tells us what token exists, while a Token Account tells us how much of that token a particular owner holds. Before looking at any code, the complete process for creating our Mint looks like this: Connect to Solana Devnet Load our wallet Generate a new keypair for the Mint Calculate how much space a Mint Account needs Calculate the lamports required for the account Ask the System Program to create the account Ask the Token Program to initialize it as a Mint Put both instructions inside a transaction Sign the transaction Send and confirm it on Solana There are quite a few SDK functions involved when implementing this, but underneath all that syntax, this is really what the entire spl_init.ts file is doing. Starting with the wallet and Mint address We first load our wallet and turn it into a signer. The wallet

A familiar production failure looks like this: an AI support agent reads a ticket, decides the customer deserves compensation, calls the refund tool, and refunds the full annual subscription instead of the $12 add-on. The model did not crash. The API did not throw an exception. The tool worked exactly as designed. The postmortem usually starts with the wrong question: “How do we stop the model from making bad decisions?” The better question is: which layer should have stopped the mistake before it became damage? AI agents fail in many different ways. They misunderstand intent. They create dangerous plans. They pass malformed arguments. They exceed permissions. They loop. They leak data. They take irreversible actions. Each failure mode belongs to a different layer, and each layer has a different job. If your only defense is a prompt that says, “Be careful,” you do not have a safety architecture. You have a hope. TL;DR: AI agent mistakes should not be stopped by the model alone. Use layered defense: intent classification stops wrong missions, plan validation stops forbidden sequences, tool schemas stop invalid arguments, authorization stops unauthorized actions, execution controls limit blast radius, output validation catches harmful results, runtime monitors stop loops, and human approval guards asymmetric risk. The best stopping layer is the earliest deterministic layer that can prevent harm, with the final brake closest to irreversible side effects. 📋 Table of Contents The Mistake Is Not One Failure Mode 1. The Prompt Layer Should Persuade, Not Enforce 2. The Intent Layer Should Catch the Wrong Mission 3. The Planning Layer Should Reject Forbidden Paths 4. The Tool Contract Layer Should Make Invalid Actions Unrepresentable 5. The Authorization Layer Should Veto Even Correct-Looking Actions 6. The Execution Layer Should Make Side Effects Boring 7. The Output Layer Should Catch Harmful Results Before They Ship 8. The Runtime Monitor Should Stop Slow-Motion Failures

During Naomi Osaka's match against Anastasia Zakharova at this year's US Open earlier this week, a gaggle of ring light-wielding influencers who were packed in a luxury suite became enough of a distraction that the umpire paused the match and repeatedly asked them to quiet down. Elsewhere in the USTA Billie Jean King National Tennis […]

By Michael Nocito , data analyst · Published August 9, 2026 By the end of this page you can add an extension to a dashboard, tell the two hosting kinds apart, and read the permission box well enough to know what you're agreeing to. You'll also know the one behavior that surprises people after publishing, which is what an extension looks like in a PDF. It's about twelve minutes. Here's what to do before you add your first one. Find out where it runs. An extension you drop onto a dashboard is a web application, and some of them are hosted on Tableau-managed servers while others are hosted by whoever built them. That single fact decides how much thought the rest of the decision needs. The short version: an extension is a third-party web application running inside a dashboard object, and one of the two permission levels gives it your full underlying data along with table and field names. Where the code actually runs is the thing the panel doesn't show you, so it gets the picture. The original carries a diagram here. In words: A large rectangle labeled your dashboard contains four panels that all look alike. Three of them are shaded the same and marked as ordinary views. The fourth, in the lower right and outlined in a warning color, is labeled extension. A line runs from that fourth panel, crosses the boundary of the dashboard rectangle, and continues out to a separate box drawn outside and to the right labeled third-party host. The three ordinary views have no lines leaving the rectangle. The drawing shows that the extension panel sits inside the dashboard visually while its code and its data traffic reach outside it, which the other three panels never do. 1. What an extension actually is Before the explanation: you drop an extension onto a dashboard and it draws a chart type Tableau doesn't have. Where did that chart come from? From a web application, written by somebody else, running inside a panel on your dashboard. Tableau's own description is that extensions "let