For security reasons, we consider "Target app", as the target we practiced on, and the real name won't be disclosed in this post. The target app, was a niche music streaming platform, available in web and mobile PWA, meaning the structure is same but access is easier for cross platform. The app worked in this way : You register using an account, 3rd party like google or via email After that you can use the app for free with a 3 day window (3 day trial) After the 3 day you gotta buy subscription to continue listening The flaw, existed in the first step, when you register using an email, no verification happens! You could enter any type of string@something.com , a random password and start your free trial. So what happens is that first I use string1@something.com , for 3 days. When the time runs out, I use string2@something.com for another 3 days. And since the app's trial and actual subscription don't have any difference, and the 3 day time window is the only limitation, the user with such knowledge from the app doesn't need to buy any subscriptions while such flaw exists! Mitigation : Apply email verification step after user input, so they have to use the received link to verify their address Blacklist "temporary email" service's address or IPs, so users won't generate any email to register after their trial has expired. This way, the registration process isn't too complex while keeps app from attackers avoiding a "For ever free" usage on the app.

The short answer is: sometimes, but it's complicated.

Stop Fighting Scikit-Learn Pipelines: How Metadata Routing Fixes Sample Weights & Groups A couple of months ago, I stumbled upon this video by Vincent D. Warmerdam about metadata routing in scikit-learn. I'll be honest, I had no idea what "metadata routing" even meant, but Vincent's explanation completely changed how I think about building ML pipelines. The video showed me that one of the most frustrating problems in scikit-learn; passing sample weights and groups through complex pipelines finally had an elegant solution. It piqued my curiosity enough that I dove deep into the feature, tested it extensively, and honestly, I was surprised by how little coverage this gets in technical blogs and articles. So I figured, why not write about it myself and share what I learned? If you've ever struggled with imbalanced datasets, grouped cross-validation, or just wanted to pass custom information through your pipelines, this article is for you. Let's start from the very beginning. What is "Metadata" in Machine Learning? Let's start with a concrete example. You're building a credit card fraud detection model with this data: # Your training data X = transaction_features # Amount, merchant, time, location, etc. y = is_fraud # 0 = legitimate, 1 = fraud # But you also have additional information: sample_weights = [ 1.0 , 1.0 , 10.0 , 1.0 , ...] # Fraud transactions weighted 10x customer_ids = [ 101 , 102 , 101 , 103 , ...] # Which customer made each transaction Metadata is the "extra information" beyond your features (X) and labels (y): sample_weight : How important is each transaction? (Fraud = 10x more important) groups : Which customer does each transaction belong to? (For proper cross-validation) Custom metadata : Transaction timestamps, confidence scores, data quality flags, etc. Why Metadata Matters: The Credit Card Fraud Problem Imagine you're building a fraud detection system for a financial company. You have: Imbalanced data : 99% legitimate transactions, 1% fraudulent T

Imagine a user trying to upload a 100MB video or a high-resolution photo to your app. If you use the standard Rails file upload, that file travels from the user's browser to your Rails server, and then your server sends it to S3 or Google Cloud. This is a terrible way to do it. While that 100MB file is transferring, your Rails worker (Puma) is frozen. It can't handle other users. If three people upload large files at once, your whole app will stop responding. In 2026, the professional way to handle this is Direct Uploads . With Direct Uploads, the file goes directly from the user's browser to your cloud storage (S3, R2, etc.). Your Rails server only handles a tiny bit of metadata. It is faster for the user and much safer for your server. Here is how to set it up in Rails 8. STEP 1: Configure Your Storage First, make sure you aren't using the local disk for production. You need a cloud provider like AWS S3 or Cloudflare R2. In your config/storage.yml : amazon : service : S3 access_key_id : <%= ENV['AWS_ACCESS_KEY_ID'] %> secret_access_key : <%= ENV['AWS_SECRET_ACCESS_KEY'] %> region : us-east-1 bucket : my-app-uploads # Crucial for Direct Uploads! public : true Note: You must configure CORS in your S3/R2 dashboard to allow requests from your domain. If you don't do this, the browser will block the upload. STEP 2: The Rails Form Rails makes the backend part incredibly easy. You just add one attribute to your file field: direct_upload: true . <!-- app/views/users/_form.html.erb --> <%= form_with ( model: user ) do | f | %> <div class= "field" > <%= f . label :avatar %> <%= f . file_field :avatar , direct_upload: true %> </div> <%= f . submit "Save Profile" %> <% end %> When you add direct_upload: true , Rails automatically includes a JavaScript library that handles the "handshake" with S3. STEP 3: Adding a Progress Bar (The UX Win) Direct uploads can take a few seconds. If nothing happens on the screen, the user will think your app is broken. We can use the built-in Ac

Whether you are building SaaS, running an agency, some shop, and struggling with your hard work - you have my highest respect. The ups and downs of working on your own is a killer man, it feels great on some days and just crazy on others. It's not for every one - if someone told me about this side of building startups 12 years ago (when I started my agency), I would have given it a bit more thought tbh. Keep building and shipping, and hopefully all your work will be rewarded in a way that feels rewarding to you.

We constantly hear that Ansible and Python are apparently the only ways to automate networks, today I even listen in a conversation "Python is the industry standard" probably I missed the RFC document or probably the guy was referring to a sales standard, but back to us what happens when the framework, the platform or the software we are using becomes heavier than the problem to solve? There is a moment where automation becomes necessary, not because we want to look modern, not because every task deserves a framework and not simply because adding automation automatically means we are doing things better. It becomes necessary because repeating the same command collection manually across many devices is slow, risky, boring and almost impossible to diff and validate properly especially under pressure. For this reason I built the Cisco Go Collector during a real migration activity with a very practical goal: collect configuration and command outputs from Cisco devices in an easily repeatable way, without forcing every colleague involved in the process to become developers or to install an automation stack just to run a super simple flow. The idea was simple: define the devices in a CSV which is the comfort zone for everyone define the commands in the same CSV file, super simple and organized to manage one row per device run a portable Go binary against that CSV file collect the outputs in organized text files archive the result as operational evidence that can be easily diff That is it! super lightweight to run no Python virtual environment no Ansible playbook structure no inventory hierarchy no framework onboarding no additional runtime or software on corporate managed workstations just a CSV file and a compiled binary The automation and AI trap when the solution is heavier than the problem to solve I love automation and I fully support AI if used the proper way, but we have to find a balance and recognize when to choose one tool over the other and specially one progra

Order DoorDash from Claude Discussion | Link

https://cowboystatedaily.com/2026/06/18/giant-banana-pulled-...

submitted by /u/iximiuz [link] [留言]

submitted by /u/West-Chard-1474 [link] [留言]

submitted by /u/Old-Illustrator-8692 [link] [留言]

Smart lighting company Philips Hue has launched its first wired wall modules. Installed behind existing wall switches, the new devices bring non-smart lights into the Hue ecosystem for the first time. Hue also announced new Play table and floor lamps that are more affordable versions of its Signe series, along with upgrades to its E14 […]