标签：#tutorial

VeraCrypt is easy to use badly. You can choose an unnecessarily complicated cipher cascade, forget a custom PIM, leave the only copy of a keyfile on a dying USB stick, sync a mounted container through two computers, or discover during a boot failure that your recovery media was never tested. None of those failures means the cryptography was broken. They mean the surrounding system was badly designed. This guide focuses on both sides of VeraCrypt: how to operate it and how to make defensible decisions about passwords, key derivation, filesystems, backups, system encryption, hidden volumes, SSDs, and recovery. The instructions and terminology here were checked against VeraCrypt 1.26.29 , released on June 9, 2026, and current as of September 2026. Version 1.26.29 is especially significant because it adds Argon2id for non-system volumes and fixes a plausible-deniability issue affecting some hidden volumes created by versions 1.26.6 through 1.26.28. ( veracrypt.io ) TL;DR If you want the short version: Use an encrypted file container for a manageable collection of sensitive files. Encrypt an entire USB stick or external drive when everything on it should be protected. Use VeraCrypt system encryption only on supported Windows x64 systems, and only after creating and testing recovery media. Use FileVault for a Mac startup disk and LUKS for a Linux system disk. VeraCrypt does not provide macOS or Linux system encryption. For a new non-system volume in VeraCrypt 1.26.29, use the default AES encryption algorithm and Argon2id KDF unless you need compatibility with an older VeraCrypt installation. Leave PIM at its default unless you understand the security, memory, performance, and recovery consequences. Prefer a long, unique password over unusual cipher combinations. Treat keyfiles as additional credentials that must be backed up perfectly. Never store your only backup inside the encrypted volume it is supposed to protect. Unmount a volume before unplugging its device, copying

An approval rule becomes useful when you can test what happens on both sides of it: the forbidden action is refused, and the permitted decision leaves evidence. A happy-path demo alone cannot show that distinction. Here is a runnable example using Accordo, the open-source framework coding agents use to build custom CRMs. A synthetic customer wants 30 seats of an Enterprise Plan and requests 25% off. The existing policy permits automatic approval through 10%; above that, through 50%, it requires a user decision. Run it locally You need Git, Node.js 22.16 or newer, npm, and internet access for cloning and dependency installation. Start in an empty working directory: git clone https://github.com/khaoss85/agent-crm.git framework-source cd framework-source git checkout 3b5b5f0c4c3e582e48d54501136024b064756daa node --no-warnings examples/recipes/quote-approval/run.mjs ../my-quote-crm The pinned recipe source creates a project, installs its dependencies and composes the existing commercial package. It then starts a temporary server on localhost and drives the public SDK through HTTP. The catalog is a fixture; the business journey does not call an external provider. It uses source from the checkout, independently of the npm scaffolder release. Check the refusal, then the decision The script contains assertions for each transition: Server pricing produces EUR 3,750 once and EUR 2,400 per month after discount. These are synthetic quote amounts, kept in separate periods. Submission under policy version 1 freezes a commercial snapshot and enters pending_approval . An approval request from the simulated agent receives HTTP 403 with HUMAN_APPROVAL_REQUIRED . The quote and approval remain pending, and no business audit entry is added. A simulated user approves. The quote becomes approved , with one user decision audit and a completed trace. The submitted snapshot remains unchanged. There is one quote version and one approval record. The refusal also has a failed trace. That is a u

The short version NextAuth (now Auth.js) creates 4 tables in your database: users , accounts , sessions , and verification_tokens . The users and accounts tables have a one-to-one relationship via accounts.user_id . Sessions link to users via sessions.user_id . Verification tokens are short-lived and self-cleaning. The 4 tables users Column Type What it means id text / UUID Primary key. Generated by NextAuth. name text Display name from the OAuth provider (Google, GitHub, etc.) email text User's email. May be null if the provider doesn't share it. email_verified timestamp When the email was verified. Null if never verified. image text Profile picture URL from the provider. created_at timestamp When the user first signed in. updated_at timestamp Last profile sync from the provider. accounts This table links a user to an OAuth provider. One user can have multiple accounts (e.g., Google + GitHub). Column Type What it means id text / UUID Primary key. user_id text Foreign key → users.id . type text Always "oauth" or "oidc" . provider text "google" , "github" , "discord" , etc. provider_account_id text The provider's unique ID for this user. refresh_token text OAuth refresh token (encrypted in production). access_token text OAuth access token (encrypted in production). expires_at integer When the access token expires (Unix timestamp). token_type text Usually "Bearer" . scope text Permissions granted by the provider. id_token text OIDC ID token (if using OIDC). session_state text Provider-specific session state. sessions Active sessions for each user. NextAuth creates a new row here on every sign-in. Column Type What it means id text / UUID Primary key. session_token text The session token stored in the user's cookie. user_id text Foreign key → users.id . expires timestamp When this session expires. verification_tokens Short-lived tokens for email verification, password reset, etc. Self-cleaning old tokens are deleted automatically. Column Type What it means identifier te

Modern price monitoring systems need to do more than tell you that a price changed. A single abnormal listing, a scraped error, or a temporary outlier can make a traditional threshold-based detector fire an alert when nothing meaningful happened. In this project, I built a lightweight real-time price anomaly detector in Python that combines: A rolling median baseline Median Absolute Deviation (MAD) Robust Z-scores Short-term percentage returns Trend confirmation Alert cooldowns The goal is simple: detect meaningful price movements without overreacting to noisy observations. Note: This project monitors retail prices from Google Shopping results through SerpApi. It is a retail-price monitoring example, not a financial exchange-data feed. What we're building The pipeline looks like this: ┌──────────────────────┐ │ SerpApi / Shopping │ └──────────┬───────────┘ │ ▼ ┌──────────────────┐ │ Price Extraction │ │ + Validation │ └────────┬─────────┘ │ ▼ ┌────────────────────┐ │ Rolling Price │ │ History │ └────────┬───────────┘ │ ┌───────────┼───────────┐ ▼ ▼ ▼ Median MAD Return % │ │ │ └───────────┼───────────┘ ▼ Robust Z-score │ ▼ Trend Confirmation │ ▼ Signal Engine │ ▼ Alert Cooldown The implementation is intentionally small and interpretable. The complete engine is built around a single PriceAlertEngine class and a compact AnomalyResult data structure. Why not just use standard deviation? A common first implementation is: price > mean + 3 * standard_deviation The problem is that standard deviation is sensitive to extreme observations. Suppose your historical prices are: 990, 995, 999, 1001, 1005 Then one bad observation such as: 1500 can distort the mean and standard deviation. That can move your detection boundary away from the actual market behavior you are trying to model. For a noisy retail environment, a more robust baseline is useful. That's where median and Median Absolute Deviation come in. 1. Building a rolling median baseline Instead of storing an unlimited stre

If you have ever tried to programmatically get the current RBA cash rate, you know the drill. You open the RBA F1 statistical table, download f01hist.xls, write a pandas.read_excel call, fight with the multi-row header (Series ID on row 11, units on row 6), filter, sort, take the last row. That is 30 lines of code to get a single number that changes 11 times a year. One line (MIT, no key) from rba_mcp import client print ( client . latest ( " F1_1 " , series = " cash_rate_target " ). records [ - 1 ]. value ) # live AU.CASHRATE as of 2026-09-03: 4.35 pip install rba-mcp No key. MIT-licensed. Attribution and source URL come back with the number. Hosted gateway Use GET /v1/series/AU.CASHRATE/latest on api.ausdata.io with a free key from ausdata.io (500 calls/mo). Live 2026-09-06: cash 4.35 percent, trimmed-mean CPI 3.6 percent (2026-Q2), real rate 0.75 percent. Why the hosted path exists The RBA publishes the nominal cash rate. The ABS publishes inflation. Neither publishes the real cash rate (nominal minus trimmed-mean CPI). Use /v1/real-rate-regime for that join. Same envelope across nine AU sources: source, source_url, attribution, retrieved_at. MCP Wire ausdata-mcp via npx in Claude Desktop or Cursor. Sisters on PyPI run fully local with no key. What this is not Suburb-level property prices Live KYC / company-officer lookup 5-minute wholesale electricity bid stacks AU macro public data, one envelope, citations done for you. R users readrba by Matt Cowgill is the R equivalent. This is the Python / JS / agent path. Links Canonical: https://ausdata.io/blog/rba-cash-rate-python-api/ Free key: https://ausdata.io Series: https://ausdata.io/series/AU.CASHRATE PyPI: rba-mcp

Hello, fellow version-bumping enthusiasts, sleep-deprived Rustaceans, and accidental software...

Now that we have a mental model of how Solana works, it’s time to actually use it. We’ve talked about accounts holding state, programs containing the logic, instructions telling those programs what to do, and transactions bringing those instructions together. Creating an SPL Token Mint is a good place to see all of those concepts working together. In this part, we’ll create and initialize an SPL Token Mint on Solana Devnet, but more importantly, we’ll break down what is actually happening underneath the code. So, what exactly is a Mint? If I tell Solana to give someone 100 of a particular token, Solana first needs to know what that token is. What defines it? How divisible is it? How many units currently exist? Who has the authority to create more? That is where the Mint Account comes in. A Mint Account represents a particular type of token on Solana. It stores information about that token such as its current supply, decimals, mint authority and optional freeze authority. It does not store how many tokens I personally own. That belongs somewhere else, which we’ll get to when we talk about Token Accounts and ATAs. A simple way to separate the two is this: the Mint tells us what token exists, while a Token Account tells us how much of that token a particular owner holds. Before looking at any code, the complete process for creating our Mint looks like this: Connect to Solana Devnet Load our wallet Generate a new keypair for the Mint Calculate how much space a Mint Account needs Calculate the lamports required for the account Ask the System Program to create the account Ask the Token Program to initialize it as a Mint Put both instructions inside a transaction Sign the transaction Send and confirm it on Solana There are quite a few SDK functions involved when implementing this, but underneath all that syntax, this is really what the entire spl_init.ts file is doing. Starting with the wallet and Mint address We first load our wallet and turn it into a signer. The wallet

A familiar production failure looks like this: an AI support agent reads a ticket, decides the customer deserves compensation, calls the refund tool, and refunds the full annual subscription instead of the $12 add-on. The model did not crash. The API did not throw an exception. The tool worked exactly as designed. The postmortem usually starts with the wrong question: “How do we stop the model from making bad decisions?” The better question is: which layer should have stopped the mistake before it became damage? AI agents fail in many different ways. They misunderstand intent. They create dangerous plans. They pass malformed arguments. They exceed permissions. They loop. They leak data. They take irreversible actions. Each failure mode belongs to a different layer, and each layer has a different job. If your only defense is a prompt that says, “Be careful,” you do not have a safety architecture. You have a hope. TL;DR: AI agent mistakes should not be stopped by the model alone. Use layered defense: intent classification stops wrong missions, plan validation stops forbidden sequences, tool schemas stop invalid arguments, authorization stops unauthorized actions, execution controls limit blast radius, output validation catches harmful results, runtime monitors stop loops, and human approval guards asymmetric risk. The best stopping layer is the earliest deterministic layer that can prevent harm, with the final brake closest to irreversible side effects. 📋 Table of Contents The Mistake Is Not One Failure Mode 1. The Prompt Layer Should Persuade, Not Enforce 2. The Intent Layer Should Catch the Wrong Mission 3. The Planning Layer Should Reject Forbidden Paths 4. The Tool Contract Layer Should Make Invalid Actions Unrepresentable 5. The Authorization Layer Should Veto Even Correct-Looking Actions 6. The Execution Layer Should Make Side Effects Boring 7. The Output Layer Should Catch Harmful Results Before They Ship 8. The Runtime Monitor Should Stop Slow-Motion Failures

By Michael Nocito , data analyst · Published August 9, 2026 By the end of this page you can add an extension to a dashboard, tell the two hosting kinds apart, and read the permission box well enough to know what you're agreeing to. You'll also know the one behavior that surprises people after publishing, which is what an extension looks like in a PDF. It's about twelve minutes. Here's what to do before you add your first one. Find out where it runs. An extension you drop onto a dashboard is a web application, and some of them are hosted on Tableau-managed servers while others are hosted by whoever built them. That single fact decides how much thought the rest of the decision needs. The short version: an extension is a third-party web application running inside a dashboard object, and one of the two permission levels gives it your full underlying data along with table and field names. Where the code actually runs is the thing the panel doesn't show you, so it gets the picture. The original carries a diagram here. In words: A large rectangle labeled your dashboard contains four panels that all look alike. Three of them are shaded the same and marked as ordinary views. The fourth, in the lower right and outlined in a warning color, is labeled extension. A line runs from that fourth panel, crosses the boundary of the dashboard rectangle, and continues out to a separate box drawn outside and to the right labeled third-party host. The three ordinary views have no lines leaving the rectangle. The drawing shows that the extension panel sits inside the dashboard visually while its code and its data traffic reach outside it, which the other three panels never do. 1. What an extension actually is Before the explanation: you drop an extension onto a dashboard and it draws a chart type Tableau doesn't have. Where did that chart come from? From a web application, written by somebody else, running inside a panel on your dashboard. Tableau's own description is that extensions "let

When a checkout form receives a card number, the first useful question is often not whether the payment will be approved. It is whether the input is structurally plausible and which network rules should be shown to the user. The open-source credit-card-brand-detector package provides that small client-side or server-side building block. It detects 11 brands, removes spaces and hyphens, and applies a Luhn checksum. It has zero runtime dependencies and exposes CommonJS functions for validation and brand detection. This tutorial builds a minimal Node.js check, verifies the result with known test numbers, and explains what this kind of validation cannot tell you. TL;DR Install version 1.0.1 , call validateCreditCard when you need both a boolean result and a brand, and call detectBrand when you only need the network name. The package does not contact a payment processor, authorize a transaction, tokenize data, or prove that a card exists. Prerequisites You need: Node.js 12 or newer. The package declares >=12.0.0 in its metadata. npm. A terminal and a small JavaScript file. The package is released under the MIT license . The examples below target the published npm package version 1.0.1 , which is also the version I installed for this walkthrough. Install the package Create a directory for the example and install the pinned version: mkdir card-check-example cd card-check-example npm init -y npm install credit-card-brand-detector@1.0.1 Pinning the version makes the example reproducible. If you use a different version later, check its README and package metadata before copying the behavior into a production application. Build the smallest useful check Create check-card.js : const { validateCreditCard , detectBrand , getBrand , } = require ( ' credit-card-brand-detector ' ); const formattedVisa = ' 4532 0151-1283-0366 ' ; const mastercard = ' 5555555555554444 ' ; console . log ( validateCreditCard ( formattedVisa )); console . log ( detectBrand ( mastercard )); console . log

When adb devices does not show the result you expect, reinstalling random drivers is rarely the best first move. The output already tells you which layer is failing. This checklist separates the most common states: device unauthorized offline An empty device list ADB not recognized by the terminal The goal is to diagnose the connection in a logical order: tool, cable, USB mode, authorization, and finally drivers. Before troubleshooting Make sure the basic setup is correct: Install the latest Android SDK Platform-Tools from Google. Use a USB cable that supports data, not only charging. Unlock the Android phone. Enable Developer options and USB debugging. Connect directly to the computer when possible instead of using an unpowered hub. The location of Developer options differs between Samsung, Xiaomi, Pixel, Huawei, OnePlus, and other interfaces. If you need the device-specific menu paths, this guide to enabling USB debugging on Android phones covers the common manufacturers and the RSA authorization step. Start with one command Open Terminal, PowerShell, or Command Prompt inside the Platform-Tools folder and run: adb devices For extra information, use: adb devices -l A normal result looks similar to this: List of devices attached R58M123ABCD device product:example model:Example device:example The word after the serial number is the important part. What each ADB state means Result Meaning Where to look first device ADB can communicate with the phone The connection is ready unauthorized The phone has not authorized this computer Phone screen and RSA prompt offline ADB sees the device but cannot communicate reliably ADB server, cable, port, or device Empty list The computer is not exposing the phone to ADB Cable, USB mode, driver, or debugging setting adb not recognized The shell cannot find the ADB executable Platform-Tools folder or PATH Case 1: The result is device This is the success state. ADB can send commands to the phone. You can test the connection with a harml

Abstract When evaluating robot control policies, many practitioners draw direct conclusions from simple success‑rate percentages. For instance, given Policy A with 90 % success and Policy B with 92 % success, people frequently claim Policy B performs better. Nevertheless, purely comparing percentage figures without sample size, confidence intervals, paired experimental design and statistical power analysis often produces unreliable judgments. Drawing on Clopper‑Pearson exact confidence intervals, Wilson score intervals, McNemar’s paired testing and hierarchical episode‑within‑task structure, this article lays out a complete practical workflow for robot policy evaluation, covering pre‑experiment planning and post‑hoc result checking. For engineering teams running robot‑simulation benchmarks mixed with LLM‑based agent workloads, an API gateway such as 4sapi can help standardize telemetry collection and multi‑backend request orchestration. 1. The Pitfall: Percentages Without Sample Sizes Lack Evidentiary Weight Statements such as “Policy A achieves 90 % success; Policy B achieves 92 % success” are ubiquitous in robotics papers and technical reports. However, these two numbers alone cannot support the conclusion that Policy B is stronger. Valid interpretation must account for roll‑out count, task composition, random seeds, paired‑group configuration and statistical power. The RoboLab v4 benchmark illustrates this concrete risk. Each policy runs only 10 episodes per task. Under this setup, when a policy reaches a 90 % success rate, its 95 % confidence interval spans approximately 19 percentage points . Even expanding to 100 roll‑outs, the interval width still sits near six percentage points. Authors explicitly classify 10‑episode runs as coarse‑grained indicators and warn that fine‑grained policy comparison remains untrustworthy. This warning generalizes across most high‑cost robot benchmarks: reported numbers may print with high numerical precision, yet real statistical

Ever since I got involved with local LLMs I wanted to share the magic with my friends. The process before involved either Ollama or llama.cpp, which are great, but the setup was difficult and a barrier to entry for most people. WHAT ARE THE BENEFITS OF LOCAL AI? Local AI isn't as powerful as cloud-based solutions, but the gap is narrowing. With local AI there are no subscription costs, token limits, or outages, since it all runs on your own hardware. It doesn't require an internet connection, so it can be used fully offline. For businesses that are worried about leaking IP or sensitive data it's especially attractive. It stays on your machine and your data doesn't get captured by some company that may or may not use it to train their next model. WHAT YOU NEED FIRST Before we get started you need to understand what your hardware is capable of. For this to work well I suggest an Apple Silicon Mac with at least 24 GB of unified memory, or a gaming desktop with at least 16 GB of VRAM. The more VRAM you have, the more capable models you will be able to run. For reference, I run it on three machines: a MacBook Pro with 96 GB of unified memory, a Mac Mini with 24 GB, and a gaming desktop with a Radeon 7900 XTX. ONE INSTALLER, NO SETUP Unsloth Desktop is what people have been waiting for. It's just been released as a beta. It's pretty much a single-click install. You download the installer and run it, and from there Unsloth Desktop handles everything else for you. Behind the scenes it scans your machine and determines what needs to be installed. It puts a wrapper around llama.cpp and MLX, which gives you all the power of the top open source models without having to manage the underlying tools. Unsloth Desktop will automatically detect if any of the tools have gotten any updates and will prompt you to install the updates. MODELS COME STRAIGHT FROM HUGGING FACE Not only does Unsloth Desktop make the initial install easy, it integrates directly with Hugging Face. For those who

An eight-frame animation does not have a fixed duration. At 8 fps it lasts one second; at 12 fps it lasts two-thirds of a second; at 16 fps it lasts half a second. Before drawing or generating more frames, check whether the problem is missing poses or the time each pose stays on screen. We maintain FrameSprite, a browser workspace for game assets. This is a timing and export note, not a claim that a particular frame count makes AI animation reliable. The equations work with hand-drawn sprites too. Three numbers that are easy to mix up Source FPS describes how a recording was sampled. Frame count is the number of entries you put in an animation. Playback FPS controls how fast those entries advance in the game. A 24 fps source video can provide eight selected poses that you play at 12 fps. You do not need to preserve every source frame. For equal holds, forward playback and a speed multiplier of 1: duration_seconds = frame_count / playback_fps frame_hold_ms = 1000 / playback_fps fps_for_target = frame_count * 1000 / target_duration_ms Same eight frames Hold per frame Full loop 8 fps 125 ms 1.000 s 12 fps 83.333… ms 0.667 s 16 fps 62.5 ms 0.500 s You changed the cadence without changing one pixel of the sprite sheet. A test you can reproduce Use the public eight-frame sample . Keep the same frames, order, canvas and pivot for all three trials. Change only playback FPS between 8, 12 and 16. Check the animation alone at its intended game size. Run it beside actual movement or attack timing. If cadence improves but a foot or weapon still jumps, inspect the missing phase instead of raising FPS again. If every frame jumps by a small amount, inspect canvas and pivot alignment. If the pause happens only at the seam, look for an accidental duplicate endpoint. The sample makes the arithmetic test repeatable. It is not evidence that eight frames is the right budget for every character or action. Do not accumulate rounded timestamps At 24 fps, one hold is 41.666… milliseconds. St

How we built a reliable pipeline to split long texts for LLM translation without losing context or breaking the bank At LectuLibre, we translate entire books using Claude. The challenge: a 300-page book is roughly 90,000–120,000 words, which translates to 120,000–160,000 tokens. While Claude 3 models have a 200k context window, sending an entire book in one API call is impractical. It's slow, expensive, and often degrades translation quality due to attention dilution. We needed a robust chunking strategy that preserved context and stayed within token limits. The Problem: One Book, Too Many Tokens When we first started building LectuLibre, we naively assumed we could just pass the whole book to Claude and get a translation back. We quickly hit three walls: Rate limits : A single request with 150k tokens triggered API timeouts and 429 errors. Cost : Even if it worked, processing 150k tokens per request with Opus would cost over $13 per book, and most of the input would be wasted on repeated context. Quality : Long contexts tend to make the model "forget" early chapters, leading to inconsistent character names and terminology. Clearly, chunking was necessary. But how do you split a book without losing narrative flow? First Attempt: Naive Splitting by Paragraphs Our initial approach was simple: split the text into chunks of roughly 10,000 tokens by paragraphs. We used a regex to split on double newlines and then concatenated paragraphs until we hit the token limit. import re def split_into_paragraphs ( text : str ) -> list [ str ]: return re . split ( r ' \n\s*\n ' , text ) def chunk_by_paragraphs ( paragraphs : list [ str ], max_tokens : int = 10000 ) -> list [ str ]: chunks = [] current_chunk = [] current_tokens = 0 for para in paragraphs : # Estimate tokens using character count / 4 (quick and dirty) para_tokens = len ( para ) // 4 if current_tokens + para_tokens > max_tokens and current_chunk : chunks . append ( ' \n\n ' . join ( current_chunk )) current_chunk = []

If you're using Claude to build websites or applications, one of the biggest improvements you can make is to stop treating Claude like a chatbot where you simply copy and paste code. Instead, you can set up a development workflow where Claude works on the project, GitHub stores the code, and Vercel handles deployment. The basic workflow looks like this: You → Claude → Code → GitHub → Vercel → Live Website Claude works on the project, GitHub keeps the source code and its history, and Vercel can automatically deploy new code pushed to the connected repository. Here's how I approach the setup. Start by discussing the project with Claude Don't immediately tell Claude: "Build me a website." First explain what you're actually trying to build. Tell Claude: What the product is Who the target users are What problem you're solving The main features How the business will operate What you already know What you don't know You can also give Claude examples of existing websites or products that are similar to what you're trying to build. The purpose of this stage isn't to generate code yet. It's to make sure Claude understands the project before development begins. Plan the technical side Once Claude understands the idea, decide how you're going to build it. This is where you determine things such as: Programming language Framework Database Authentication APIs Hosting Folder structure Major features Development priorities For example, you might choose JavaScript/TypeScript with Next.js, PHP with Laravel, or another stack depending on your project. The important thing is to make these decisions deliberately instead of letting the AI randomly choose technologies as the project develops. So my basic AI development process is: Discuss → Plan → Build → Test → Deploy → Improve Create a GitHub repository Next, create a repository for your project on GitHub. Think of GitHub as the central home for your project's source code and its change history. Once the repository exists, your developm

Four algorithms. Same grid. Very different dungeons. I implemented BSP trees, cellular automata, random walk, and room placement, ran each one 20 times on an 80x40 grid, and measured everything: connectivity, open space, path length, speed. The Results Algorithm Open Space Connected Rooms Path Length Speed BSP Tree 42.1% 100% 1.0 105 steps 0.88 ms Cellular Automata 55.8% 0% 15.2 78 steps 52.8 ms Random Walk 35.0% 100% 1.0 73 steps 274.7 ms Room Placement 18.9% 100% 1.0 81 steps 0.29 ms The big surprise: cellular automata never produces a connected map. Zero percent connectivity across 20 runs. Every single cave system has unreachable areas. The Maps BSP Tree (structured rooms, always connected) ################################################################################ ################################################################################ #####.........#####.............###################################....#......## #####.........#####.............##..........##############........#....#......## #####...........................##..........##############....................## #####.........#####.............##..........##############.............#......## #####.........#####.............##..........##############........#....#......## ##########.#######################..........##############........#....#......## ##########.#######################..........################..################## ######..........##################..........################..################## ######..........##################..........################..######..........## ######..........##################..........################..######..........## ######..........##################..........################..######..........## ######.............###############..........################..######..........## ######..........##.###############..........################..######..........## ######..........##.###############..........################..######..........##

1. Introduction In the previous article, we began studying a level 6 CrackMe and quickly reached the Serial verification routine based on the Name. Here is this routine below: 0x401510: pusha ; Save all general-purpose registers ; ------------------------------------------------------------------------- ; PHASE 1: BASE64 DECODING AND SIZE CHECK ; ------------------------------------------------------------------------- 0x401511: mov ebx,DWORD PTR [esp+0x2c]; ebx = Pointer to Serial (passed as parameter) 0x401515: mov esi,0x404200 ; esi = Destination buffer for decoded Serial 0x40151a: push ebx ; Argument 2: Serial string 0x40151b: push esi ; Argument 1: Output buffer 0x40151c: call 0x401633 ; CALL: Custom Base64 decoder 0x401521: cmp eax,0x10 ; Is the decoded buffer exactly 16 bytes (128 bits)? 0x401524: jne 0x40162f ; No -> Direct failure (Jump to failure) ; ------------------------------------------------------------------------- ; PHASE 2: CHECK AND PREPARATION OF 64-BIT INTEGERS (S1 AND S2) ; ------------------------------------------------------------------------- 0x40152a: lea edi,[esi+0x10] ; edi = Pointer to second memory block (0x404210) ; Verification of the First 64-bit Number: S1 = [esi] (0x404200) 0x40152d: mov eax,DWORD PTR [esi] ; eax = Low 32 bits of S1 0x40152f: mov edx,DWORD PTR [esi+0x4]; edx = High 32 bits of S1 0x401532: test edx,edx ; Is S1 zero? 0x401534: jne 0x40153e 0x401536: test eax,eax 0x401538: je 0x40162f ; If S1 == 0 -> Failure ; Comparison of S1 with Modulus M (stored at 0x40403c) 0x40153e: sub eax,DWORD PTR ds:0x40403c ; S1 - Modulus (low part) 0x401544: sbb edx,DWORD PTR ds:0x404040 ; S1 - Modulus (high part with borrow) 0x40154a: jae 0x40162f ; If S1 >= Modulus -> Failure (S1 must be < M) ; Copy and Verification of the Second 64-bit Number: S2 = [esi+0x8] (0x404208) 0x401550: mov eax,DWORD PTR [esi+0x8]; eax = Low 32 bits of S2 0x401553: mov edx,DWORD PTR [esi+0xc]; edx = High 32 bits of S2 0x401556: mov DWORD PTR [edi],eax ; Copy

By Michael Nocito , data analyst · Published August 9, 2026 By the end of this page you can turn a chart that says E, W, N and S into one that says East, West, North and South, in about thirty seconds, without editing the data or writing a calculation. You'll also know exactly why the Aliases option is missing on some fields, which is the part that sends people looking for a workaround they don't need. It's about ten minutes. Here's the move. Right-click a dimension in the Data pane, choose Aliases, and type the name you want beside each value. The chart updates, the stored data doesn't change, and every view built on that field picks up the new labels. The short version: an alias renames the members of a discrete dimension. Only discrete dimensions have members, which is why measures, dates and continuous dimensions can't have one. An alias sits in a specific place, between what's stored and what's shown, and that placement explains everything else here. So it gets the picture. The original carries a diagram here. In words: Three stacked panels connected left to right. The left panel is labeled stored and holds four small cells reading E, W, N and S. The middle panel is a narrow vertical band labeled alias, holding four arrows. The right panel is labeled shown and holds four cells reading East, West, North and South. A solid arrow runs from the stored panel through the alias band to the shown panel, indicating the direction labels travel. A second arrow attempting to run backwards from the shown panel to the stored panel is crossed through with a heavy X, showing that renaming the label never changes the stored value. The stored cells still read E, W, N and S after the change. This is on the certification. Aliases sit in Section 2, Exploring and Analyzing Data, which is 37% of the Tableau Desktop Foundations exam and the largest section on it. The questions people get wrong are almost always about which field types accept an alias, which is section 2 below. 1. What

THE BRICK AND THE POST-IT My chemical plant's first vulnerability wasn't a bug, a piece of malware, or a port left open to the internet. It was a brick. In the computer room — the one with a door held open by a brick — I found a sticky note with credentials on it. They weren't even the right credentials for the system I wanted to break into. But they made me think the way whoever wrote them thinks, so I tried the most obvious pair in the world: admin / admin . And I was in. A brick propping open a door that should be locked. A sticky note guarding a password. A factory-default admin/admin. Three layers of security, three layers defeated — not by a genius hacker, but by a student on day one, carrying no tools at all. If that happens in the IT office, it's a problem. When it happens on a factory floor, where that same computer commands real pumps and valves, it's a different planet. The problem: learning OT without a factory I study computer security. Lately I've been drawn to OT — operational technology, the security of factories, power plants and industrial systems. The problem is simple: you can't learn to defend a factory from a book, and nobody will lend you theirs. Then I realized the answer was already inside the question: if you don't have one, you build one. The build: three commands and a lot of patience The lab is called GRFICSv3: an open source project that simulates an entire chemical plant — the PLC, the operator interface, the network, even the server rooms — inside Docker, on a home computer. Three commands and done: curl -O https://raw.githubusercontent.com/Fortiphyd/GRFICSv3/main/docker-compose.yml docker compose pull docker compose up -d "Three commands and done" is the story version. The real version includes my first error, arriving right on schedule at command number two: permission denied while trying to connect to the docker API at unix:///var/run/docker.sock If you hit this — and you will — here's the diagnosis: the Docker daemon is running fi