标签：#try

Problem My script failed when try lacked an explicit import from dw::Runtime . The runtime reported Unable to resolve reference of: try during execution. The documentation describes try as a function that returns a Result object for handling errors docs . Input { "order" : { "id" : "ORD-2001" , "total" : "12.5O" } } Working configuration %dw 2.0 // try() lives in dw::Runtime — not imported by default import try from dw::Runtime // RFC 7807 media type is accepted as-is by the JSON writer output application/problem+json var attempt = try(() -> payload.order.total as Number) --- if (attempt.success) { total: attempt.result } else { "type": "https://example.com/problems/invalid-total", "title": "Invalid order total", "status": 400, "detail": attempt.error.message, "instance": "/orders/" ++ payload.order.id, "errorKind": attempt.error.kind } Output { "type" : "https://example.com/problems/invalid-total" , "title" : "Invalid order total" , "status" : 400 , "detail" : "Cannot coerce String (12.5O) to Number" , "instance" : "/orders/ORD-2001" , "errorKind" : "InvalidNumberException" } The detail field contains the string Cannot coerce String (12.5O) to Number . The errorKind field holds the value InvalidNumberException . The trap The missing import causes a resolution failure when the script executes. Running fail_noimport.dwl produces an exit code of 255 and reports Unable to resolve reference of: try . What I do now I always add import try from dw::Runtime at the top of every script that uses the function. I verify the import exists before running the transformation to prevent resolution errors. Runs shown: DataWeave CLI 2.12.2 102 DataWeave patterns + 8 Exchange modules with 208 MUnit tests: github.com/shakarbisetty/mulesoft-cookbook | 60-second walkthroughs: youtube.com/@SanThaParv

Yao Yue discusses the fundamental limitations of standard line charts for system observability. Drawing from 15 years of operating large-scale systems, she shares how engineering leaders and software architects can transform telemetry data - moving beyond simple time-series defaults - to build visualizations that directly answer critical capacity, latency, and fleet-sizing questions. By Yao Yue

Understanding unique photochemistry of such materials will help in conservation, storage, and exhibition.

Image changes that would get a paper retracted are widespread among suppliers.

TL;DR In generative video pipelines, running cheap low-step sketches to pick parameters sounds like free optimization. But when prompts go out-of-distribution, surrogate scorers return noise, turning a \$0.002 check into a bad decision that triggers a \$15 compounding failure. Here's why skipping the cheap step is sometimes the cheapest option. Three numbers run Scenematic's generation loop. A think-frame costs \$0.002. A full render costs \$0.50. A bad scene that slips through and gets built on costs about \$15.50, because the scene chain compounds it before anyone looks. The constant in lib/generation-loop.ts carries the arithmetic in a comment: 15.502, // CALIBRATION_TARGET: 0.002 + 0.50 + 15.00 . Most of the pipeline exists to keep spend at the cheap end of that ladder. One module decides when the cheap step should be skipped entirely. A hundred-contract baseline then put numbers on how often that decision was wrong. 1. The rehearsal lib/think-frames.ts generates quick, low-inference-step sketches before committing to a full-quality keyframe. The file header credits DeepGen's think tokens as the inspiration. Each sketch tries a different preservation focus, character, environment, mood, composition, or atmosphere, with its own image-to-image strength and seed. The reward mixer scores the batch and the winner's parameters go to the full render. The economics only work if those scores mean something. That assumption fails quietly, and it fails hardest on the prompts where a rehearsal looks most useful. 2. Where the scores stop meaning anything Scoring a sketch of A detective leans forward across a metal table, interrogating a nervous suspect under fluorescent lights works fine. The scorer has seen a thousand shots like it. Scoring A sentient equation writes itself across a blackboard that extends infinitely in all dimensions does not fail loudly. It returns a number, and the number is noise. Both prompts are verbatim from the baseline harness. lib/ood-detector.ts

Contractor rates are falling, contract durations are shrinking, and the freelance labor market is flooding with senior talent — and the problem isn't the market, it's that contractors keep letting companies define the terms. A senior backend engineer — eight years of production experience, solid Go and Kubernetes chops, three reference clients — recently told a recruiter she was looking for £650 a day. The recruiter called back two days later to say the client had found someone at £450. The counter-offer was presented as good news. That's the state of independent tech work right now. Not a crisis, not a correction — something more mundane and more insidious: a slow, structural re-anchoring of what contractor labor is worth, driven less by any single market force than by the compound effect of layoff volumes, budget caution, and platform-mediated price visibility. Rates are going down. Engagements are getting shorter. And the freelancers accepting this are — not entirely without blame — helping it stick. Here's the uncomfortable claim: the ongoing compression of tech contractor rates is as much a self-inflicted wound as a market inevitability. The conditions that caused it are real. But the capitulation that maintains it is a choice. How We Got Here: The Supply Side Exploded The overrecruitment of 2021 and 2022 didn't just hurt the permanent hiring market when the hangover hit. Software developer jobs saw the biggest boom and bust in vacancies of any sector. No other segment saw hiring more than double in 2022, and hiring has since fallen faster in software development than anywhere else. The engineers who got caught in that bust didn't all disappear. Many turned to contracting. More than 100,000 people were laid off in the technology industry in 2024 alone, and at least some of them are not heading back into exclusively full-time work. LinkedIn's Services Marketplace, launched in 2021 to catch exactly this cohort, saw 10 million people create pages on the platform,

I ran a penetration test on my own infrastructure last week. No Burp Suite, no exploit fired at production, no CVE popped. The whole engagement came down to one habit: refusing to believe a control was working until I had watched it work. The target is a small observability hub I built for my own AI-assisted coding. Six services in one compose file: a tunnel, an OpenTelemetry Collector taking metrics and logs from Claude Code, Prometheus, Grafana, Loki, and a status API. The public surface is three aggregate numbers. Everything else stays private. That boundary, three numbers out and nothing else, was the whole thing I was testing. The word "pentest" carries a picture that does not match, so: no attack traffic at the live system. The platform bills by usage and there is a WAF in front, so a flood of probes would have cost money and poisoned its own results. What I did was a read-only audit of the code and config, plus a dynamic run against the whole stack brought up locally in Docker. I expected the findings to cluster around the parts nobody had looked at. They did the opposite. Nearly every serious defect sat inside a control written days or hours earlier, usually by me, usually with a comment beside it naming what it protected against. Old code has been observed: it has run against real traffic and somebody has been surprised by it. A defence written yesterday has only been reasoned about, which feels like the same thing and is not. "Independent" is a measurement, not a comment The privacy boundary is an allow-list rather than a deny-list, and that part was right. Claude Code was measured sending five identity attributes, user.email among them carrying a real address, and no flag turns them off. A delete_key for each works until the client adds a sixth, and this telemetry is beta: its attribute set is not a contract. - context : resource statements : - keep_keys(resource.attributes, ["service.name"]) - set(resource.attributes["service.name"], "claude-code") The s

A Chinese agency says the two recalls affecting some 3 million vehicles can mostly be fixed by over-the-air updates—but they will also require physical warning stickers and camera-related updates.

Cloudflare launched agent tracing, adding spans for agent invocations, model calls, tool runs, and approvals to existing Workers traces. Sessions replay turn by turn, though the docs warn traces are not lossless and payloads may be truncated. Payload recording defaults differ by framework, and from October 1, 2026 every span counts as a billable event. By Steef-Jan Wiggers

For a long time, my mental model of observability was this: you import an SDK, sprinkle some calls through your code, each call fires off data to a server somewhere, and a dashboard reads it back. A logging system with extra steps. That model is wrong in a specific, interesting way. And I couldn't see how it was wrong until I stopped looking at the dashboards and started looking at what actually gets emitted, and how. The seductive wrong model The wrong model is seductive because the plumbing really does look identical. Logging: emit, store, search. Observability: emit, store, query. Same loop, right? So my working theory became: observability is logging plus some fancy logic to analyze the logs. Close. But no. The difference isn't in the analysis. It's in the emission — and it splits into three mechanisms that have almost nothing in common with each other. Descent one: metrics aren't events at all A metric is not a record you write. It's a number sitting in your app's memory . requests_total . increment () // 1, 2, 3... request_duration . record ( 0.23 ) // adds to a histogram Nothing is sent when this line runs. The number just changes in RAM. Periodically — every 15 seconds, say — either a backend scrapes an endpoint your app exposes, or a collector ships the current values out. That's why metrics are absurdly cheap: a million requests is one counter reading "1,000,000", not a million records. You could never reconstruct a clean p99 latency graph by parsing log text. The histogram was built for it at write time. And the stateless-container objection answers itself: the in-memory counter is disposable. Each instance flushes to the backend on a schedule (on serverless, a sidecar collector even does a final flush at shutdown), and the backend sums across instances. The durable truth never lived in your app. Descent two: logs are the familiar part Logs work exactly the way I always assumed everything worked: an event, written out, shipped, searched. The only upgrade

CryptoCabana: Azure Cloud CTF Walkthrough 🏖️ Introduction Room: TryHackMe - CryptoCabana Category: ☁️ Cloud Difficulty: Medium Objective: Exploit a misconfigured Azure cloud environment to retrieve a hidden flag. This writeup details a classic cloud privilege escalation path: an exposed SAS token → storage enumeration → credential discovery → Key Vault access → secret reconstruction. The challenge simulates a real-world scenario where poor security practices lead to a complete compromise. Table of Contents Reconnaissance & Initial Access Cloud Enumeration Service Principal Discovery Key Vault Exploration The "Freshly Rotated" Clue Reconstructing the Flag Key Security Takeaways Tools Used Reconnaissance & Initial Access Action: Visited the target website: https://cryptocabanaf5scjagc.z13.web.core.windows.net/ Finding: The website offered to back up seed phrases. Right-clicking and selecting "View Page Source" revealed critical information in the JavaScript code. JavaScript Code: javascript const STORAGE_ACCOUNT = "cryptocabanaf5scjagc"; const BACKUPS_CONTAINER = "backups"; const BACKUP_SAS = "?sv=2022-11-02&ss=b&srt=sco&sp=rl&se=2099-12-31T23:59:59Z&st=2024-01-01T00:00:00Z&spr=https&sig=ZAo05W8KXdSLM9afYCNGogNRV2N5a6aB4dQI3LXz%2Fh0%3D"; Analysis: The SAS (Shared Access Signature) token was hardcoded in client-side JavaScript. Permissions: Read (r) and List (l) Expiration: 2099 – far too long! This token grants anyone access to the storage account. bash az storage container list --account-name cryptocabanaf5scjagc --sas-token "$BACKUP_SAS" -o table Cloud Enumeration Action: Listed all containers in the storage account. Command: bash az storage container list --account-name cryptocabanaf5scjagc --sas-token "$BACKUP_SAS" -o table Output: Name Lease Status Last Modified $web 2026-07-16T18:26:22+00:00 backups 2026-07-16T18:26:22+00:00 vault 2026-07-16T18:26:23+00:00 Analysis: $web: Standard container for Azure Static Website hosting. backups: Appeared empty. vault: Hidden

Angular is well served for icons. Material Symbols alone runs to thousands of glyphs, and the community wrappers pull in dozens of other sets on top. Geography is where the shelf runs out. You get globes and map pins, sometimes a set of flags, rarely the outline of Japan and almost never the six states of the GCC. GeoIcons ships country and area icons as Angular standalone components, 422 of them at the time of writing. Adding one takes three steps: install the package, import the component by its ISO code, and render its selector. npm i @geoicons/angular import { Component } from ' @angular/core ' ; import { Us } from ' @geoicons/angular/countries ' ; @ Component ({ selector : ' app-root ' , imports : [ Us ], template : `<geoicon-us aria-label="United States" />` , }) export class App {} See it live on geoicons.io → That is the whole path. Below: inputs, styling, accessibility, and picking an icon when you only know the country at runtime. Key takeaways Install @geoicons/angular , import each country by its ISO 3166 alpha-2 code in PascalCase, and add it to the component's imports array. The class is Us ; the selector you write in the template is <geoicon-us /> . Styling props are explicit inputs, because Angular has no rest spread. Everything else goes on the host element. Icons render as decorative unless you name them, so reach for aria-label only where no adjacent text says the country. Step 1: Install the Angular package Add the package to your project: npm i @geoicons/angular It needs @angular/core and @angular/common 15.1 or newer, plus rxjs 7 or newer. That 15.1 floor comes from hostDirectives , which the icons use to share their styling inputs and which landed in that release alongside standalone components . The package sets "sideEffects": false , so the CLI can drop what you never import. List three icons in a component and you ship three. Why that matters for icon libraries . Step 2: Import by ISO code Every country ships as a named export under its ISO

Any application that ships across borders needs a way to name a country. You reach for a two-letter code, write US , JP , DE , and move on. Then a support ticket arrives. A user in Belfast picked "United Kingdom" and your shipping API rejected UK . Someone in Pristina found no option at all. Your analytics dashboard shows a country called AN that dissolved in 2010. These bugs share one root: ISO 3166-1 alpha-2 carries more rules than its two characters suggest. Let's walk through the parts that break real applications, and how to model country data so the next revision of the standard does not break yours. Key takeaways ISO 3166-1 defines 249 officially assigned alpha-2 codes. UK is not one of them. The United Kingdom is GB . Four other status categories exist: user-assigned, exceptionally reserved, transitionally reserved, and indeterminately reserved. They follow different rules. Kosovo uses XK , a code from the user-assigned range that ISO has never officially assigned. Codes get recycled. CS meant Czechoslovakia, then Serbia and Montenegro. Country names change far more often than their codes. Store the code, resolve the name at render time. What alpha-2 covers ISO 3166 splits into three parts. Part 1 names countries and their dependent territories. Part 2 names subdivisions inside them. Part 3 records codes that fell out of use. Part 1 gives you three code sets for the same entity: Format Japan Notes Alpha-2 JP Two letters. Used by ccTLDs, BCP 47 language tags, payment APIs. Alpha-3 JPN Three letters. Easier to read on its own. Numeric-3 392 Digits from UN M49. Script-independent, survives alphabet changes. Alpha-2 is the set you meet most often. Two characters fit anywhere, and the Internet Assigned Numbers Authority (IANA) draws the country-code top-level domains straight from the alpha-2 list, which puts these codes in front of everyone who ever registered a domain. That reach explains the misuse. Five kinds of code The 249 official codes get the attention.

A follow-up to How Old Is My Data? The failure mode that gets worse when a machine is reading the data In a classic dashboard, stale data is a human problem: someone looks at a number that's six hours old and makes a slightly worse decision. Annoying, rarely catastrophic. Now hand that same data to a retrieval-augmented-generation (RAG) pipeline, or to an autonomous agent. The stakes change. The system doesn't pause to sanity-check the timestamp — it acts. And when the data it acts on is stale, three things are true at once: The answer is confidently wrong. There is no error to fire on — the query succeeded, the model responded, latency was normal. Every other signal on your dashboard is green. That's the worst combination in observability: a real failure that is completely invisible to the signals we currently emit. Where staleness hides in AI systems RAG: index vs. corpus. Your vector index was built from a corpus at some point in time. The corpus keeps changing — documents get added, edited, retracted. If the re-embedding job stalls or falls behind, the index quietly drifts out of date. The retriever still returns plausible chunks; the model still writes a fluent answer. It's just answering from a version of reality that no longer exists. The quantity you care about is the age of the index relative to its source — not the age of either one alone. Feature stores: online–offline skew. The features your model trained on and the features it serves on are supposed to match. When the online store lags the offline pipeline, predictions degrade in a way that looks like model drift but is actually data staleness wearing a costume. Agents: stale shared state. Multi-agent systems coordinate through shared memory, scratchpads, and context. An agent reasoning over state that another agent updated ten steps ago — but which never propagated — makes locally reasonable, globally wrong decisions. This isn't a new or exotic problem: it's exactly the regime that Age of Information t

If you run more than a handful of OpenTelemetry Collectors, you already know the pain: a config change means SSHing into boxes, redeploying DaemonSets, or babysitting a Git pipeline per cluster, and you never quite trust that every agent is running the config you think it is. OpAMP fixes exactly that. It is a protocol that lets a central server push configuration to a fleet of Collectors, watch their health, and roll changes out in stages, without you touching each host. This post walks through how OpAMP works, the two ways a Collector can speak it, and the config you need to wire one up. The problem OpAMP solves A single Collector is easy. A hundred of them, spread across clusters, VMs, and edge nodes, is a fleet-management problem that has nothing to do with telemetry itself. Every observability team eventually builds some version of the same thing: a way to ship a new pipeline config, confirm it actually applied, and back it out when a processor starts dropping spans. Without a management protocol you end up gluing that together from ConfigMaps, Ansible runs, and dashboards that only tell you an agent is alive, not what config it is actually running. Config drift creeps in. One node keeps an old sampling rate for months because its rollout quietly failed and nobody noticed. OpAMP, the Open Agent Management Protocol, is the OpenTelemetry answer to this. Splunk donated it to the project in 2022, and it has since become the standard control channel for the Collector. It is worth pairing with a clear-eyed view of what a Collector actually is versus lighter agents; the OpenTelemetry Collector vs Grafana Alloy comparison covers that trade-off if you are still choosing a data plane. What OpAMP actually is OpAMP is a client/server network protocol for remote management of large fleets of data-collection agents. It is transport-flexible: agents connect to the server over either plain HTTP or a WebSocket, and the WebSocket path gives you a persistent bidirectional channel

This is a submission for DEV's Summer Bug Smash: Smash Stories powered by Sentry. The...

Modern applications don't just need features—they need observability . When an API becomes slow, a database query takes too long, or an unexpected error occurs, developers need answers quickly. That's where SigNoz and OpenTelemetry come in. For the Agents of SigNoz Hackathon 2026 , I integrated SigNoz into my existing MERN Stack e-commerce application called Ram Store and transformed it into a fully observable application. In this blog, I'll walk through what I built, how I instrumented it, the challenges I faced, and what I learned. About the Project Ram Store is a full-stack e-commerce platform built using the MERN Stack. Features User Authentication Product Management Categories & Subcategories Shopping Cart Address Management Order Management MongoDB Database Tech Stack React (Vite) Node.js Express.js MongoDB Docker OpenTelemetry SigNoz Winston Logger Why Observability? Before integrating SigNoz, I could only rely on: console.log() Manual debugging Browser Network tab When something failed, I had questions like: Which API is slow? Why is the response delayed? Which MongoDB query is taking time? How many requests is my backend serving? Where exactly did the error happen? Without observability, finding answers takes time. I wanted a single place where I could monitor everything. That's why I chose SigNoz . Setting Up SigNoz I self-hosted SigNoz locally using Docker. Once all the containers were running successfully, the dashboard became available. After the initial setup, the next step was instrumenting my backend. Integrating OpenTelemetry I added OpenTelemetry to my Node.js backend. Using the Node SDK together with automatic instrumentation, I configured: Express instrumentation HTTP instrumentation MongoDB instrumentation OTLP gRPC exporter Now every request automatically generates telemetry without modifying every route. Distributed Traces One of my favorite features is Distributed Tracing . Whenever I perform an action in Ram Store—like opening products or ad

Google's AlphaFold can help ID what parts of a gene editing protein enable mistakes.

Expedia Group has introduced STAR, an internal AI-assisted observability platform that helps engineers investigate production incidents using service telemetry and LLMs. Built with FastAPI, Datadog, Celery, Redis, and Langfuse, STAR follows structured workflows to analyze telemetry, generate root cause assessments, and support incident response while keeping engineers in the loop. By Leela Kumili

Ben O'Mahony discusses building custom AI-powered Language Server Protocols (LSPs) that go beyond standard rule-based checkers. He explains how to instrument AI agents natively with OpenTelemetry to track concrete user actions (accepting, dismissing, or regenerating code fixes) as implicit labels, creating a continuous data flywheel to distill frontier capabilities into cheaper, local SLMs. By Ben O'Mahony