Hi, I have a web app that serves cached JSON files via Cloudflare CDN. The data is generated by a proprietary algorithm and has significant competitive value. The JSON structure is simple to discover: /cache/_index.json → lists manifest URLs /cache/manifest_xxx.json → lists data file URLs /cache/data_xxx.json → actual proprietary data Anyone can write a 20-line script to crawl the full dataset in minutes. Rate limiting (Nginx, 60 req/min) slows it down but doesn't stop a patient scraper. The obvious solution would be JWT token authentication on the JSON endpoints, but Cloudflare CDN caches by URL — adding auth headers breaks caching entirely, defeating the purpose of having a CDN. Constraints: Must keep Cloudflare CDN caching working (performance critical) No user login/registration exists — it's a fully public site Data must remain accessible to legitimate browser users Cannot move away from Cloudflare Is there any real, production-proven solution to this problem? Or is "public CDN-cached data" fundamentally incompatible with "access control"? What would you do? submitted by /u/JosetxoXbox [link] [留言]

Microsoft just kicked off Build 2026 with a keynote from CEO Satya Nadella and other company leaders. As expected, it was filled with announcements, ranging from new Surface hardware to an always-on personal assistant and updates across Microsoft's in-house AI models. If you didn't watch the event live, you can catch up on all the […]

Peek inside any folder without opening it Discussion | Link

A federal IT staffer filed a complaint about DOGE, then went public. Shortly after Elon Musk boosted a post calling his claims false, his brake lines were cut. Now he’s suing for defamation.

Uber's cutback has occurred after the company had reportedly encouraged staff to use AI as much as possible.

The National Center for Atmospheric Research won't be losing its supercomputer.

Microsoft on Tuesday took the wraps off Adaptive Spec-driven Scoring for Evaluation and Regression Testing, an open source framework for spinning up AI evaluations.

Last week I had a single tool: a JSON-to-TypeScript converter. Today I have 10. I spent a day building a full suite of developer tools - all free, all client-side (nothing leaves your browser), and all open source on GitHub. The Suite DevForge is a collection of tools I built because I kept opening 15 different tabs every day: 1. JSON ? TypeScript Paste JSON, get TypeScript interfaces or types. Supports nested objects, arrays, custom root names. 2. CSV ? JSON Bidirectional conversion with header detection and delimiter support (comma, semicolon, tab). 3. Regex Tester Live regex testing with flags (g, i, m, s, u, y), match highlighting, and replace functionality. 4. Base64 Encoder/Decoder Encode text to Base64 and decode Base64 back to text. Unicode-safe. 5. JWT Decoder Decode JWT tokens into header, payload, and signature components. Read-only - no verification, no security risk. 6. SQL Formatter Uppercase keywords, indentation control. Handles SELECT, JOIN, INSERT, CREATE - the common stuff. 7. Diff Checker Side-by-side text comparison with LCS-based diff algorithm. Color-coded additions and removals. 8. UUID Generator Generate UUID v4 (or v1) in bulk. Copy individual or all at once. 9. Timestamp Converter Convert Unix timestamps to readable dates and back. Shows seconds, milliseconds, ISO 8601, UTC, and relative time. 10. Color Converter Convert between HEX, RGB, HSL, and CMYK. Color picker, presets, named color support. The Tech Stack Zero frameworks. Zero dependencies. Zero backend. Every tool is a single HTML file with embedded CSS and JavaScript. They all run entirely in the browser - no data is sent to any server. Hosted on GitHub Pages. Free forever. Why I Built This I'm a solo developer based in Nepal. Building things that help other developers is how I learn, grow, and (hopefully) earn. The suite is free, but there's a Pro tier ( one-time) that unlocks: File exports Batch operations Custom naming conventions Priority support I also do freelance development

The AI agent security community has been converging on a problem. A researcher recently ran an experiment — feeding a memory-retrieval framework 10 scenarios involving certificate operations: signing, issuing, revoking, delegating. The system retrieved the right memory 8 out of 10 times. It matched the external authorization gate 7 out of 10. The conclusion: metadata per item isn't enough. You need a separate authorization gate over the proposed operation. That conclusion is correct. But I want to show what that gate actually looks like when you build it — because the primitive already exists, and it's older than LLMs. The problem is authorization, not retrieval Most agent frameworks today invest in memory and observability. The agent can recall what it did before. You can see what tools it called. Logs, traces, dashboards. What they don't have is a cryptographically enforced answer to the question: was this agent authorized to do this, before it did it? Those are different problems. Retrieval tells you what the agent remembers about its permissions. Authorization tells you what it was actually granted — signed, tamper-proof, at dispatch time. An agent that retrieves "I have revocation permissions" from memory and then revokes a certificate it shouldn't touch is not an authorization failure at the retrieval layer. It's an authorization failure at the gate layer — because there was no gate. Certificates are that gate A certificate is a signed declaration of what an entity is authorized to do. Issued once, verifiable offline in ~1ms, revocable instantly. We've used them for TLS, for IoT devices, for code signing. The same primitive works for agents. The model is simple: Orchestrator issues a certificate at dispatch time The certificate carries the agent's identity and its exact scope in meta Every tool call goes through a gate that verifies the certificate offline On completion — or abort, or timeout — the orchestrator revokes it // Orchestrator — dispatch const { cer

Google launched Universal Cart at I/O 2026 last week. An intelligent cart that follows users across Search, Gemini, YouTube, and Gmail. ALM Corp published the list of named early checkout merchants on May 20: Nike, Sephora, Target, Ulta Beauty, Walmart, Wayfair, and Shopify brands. I read that list twice looking for a Magento store. None. That's the article. Below: the five-protocol stack you'd otherwise have to read five different specs to understand, the one decision your existing payment processor has already made for you, and a thirty-day Magento-specific playbook to ship before agent-routed traffic starts flowing past your store. If your store runs on Magento or Adobe Commerce, agent-routed traffic is going to flow past you - first in the US, then Canada and Australia "in the coming months," then the UK. The agent layer isn't going to wait for Adobe Commerce to ship native UCP support. The merchants in the first cohort had thirty days of head-start. Most of that window is already gone. Here's what to ship before the rest of it closes. The five-protocol stack, compressed Four protocols define how an AI agent buys something on behalf of a user. A fifth ties payments together. UCP - the discovery layer. Your store publishes a manifest at /.well-known/ucp declaring its capabilities, transports, and payment handlers. MCP - the transport layer. Agents dispatch your commerce tool calls over MCP messages. ACP - OpenAI and Stripe's checkout protocol. Stripe-led coalition. AP2 - Google's payment-authorization protocol. Sixty-plus partners signed at launch: Adyen, American Express, Mastercard, PayPal, Coinbase, Revolut, Worldpay, and more. MPP - Stripe's machine-payments protocol. Same family as ACP. Benji Fisher's synthesis post on dev.to is the sharpest framing I've read: UCP discovers, MCP transports, ACP and AP2 authorize. Read it if you haven't. The UCP spec itself is densifying fast. A loyalty extension landed on May 19 ( #340 ). A schema-validated documentation har

What is Wrisha? Wrisha is a desktop emotional AI companion — an animated character who can see you, hear you, talk back, and react. The pipeline is genuinely multimodal: Vision — webcam + facial-emotion detection (OpenCV / FER) Hearing — speech-to-text so you can just talk to her Brain — an LLM generates her replies, in-character Voice — text-to-speech with mood-modulated tone Avatar — an animated face (pygame) that emotes and lip-syncs I built the bones of it a while back, got busy, and walked away. The Finish-Up-A-Thon was the push I needed to come back to it. The "before": it didn't just need polish — it was dead When I reopened the repo, the harsh truth was that the app couldn't even start. Two things had rotted: The environment was a fossil. The project was so old it wouldn't install on a modern machine. Wrong numpy, stale dependency pins, and a Python version mismatch that sent pip trying to compile packages from source and failing. Just getting it to attempt to run took a full environment rebuild on Python 3.12. The code was half-migrated and crashed on launch. I'd previously upgraded the internal modules — memory, a mood engine, a smarter brain — to a "v3" design, but I never finished wiring them into main.py. So the moment it tried to start, it died: TypeError: init () missing 2 required positional arguments: 'memory' and 'mood_engine' The "before" in one screenshot: a project that built its best features and then never connected them. I'd built the hard parts — persistent memory, a smooth mood state machine, proactive behavior — and left them sitting in files that main.py never even imported. Classic abandoned-side-project energy. The "after": three things I finished I set out to do three things, and I'm counting all three as the win. It runs again The core fix was finishing the migration: rewiring main.py to actually construct the Memory and MoodEngine, inject them into the Brain, and reference mood from the engine instead of the dead attribute it used to

Migrar 100 usuários manualmente no console da AWS é lento, suscetível a erros e impossível de auditar com precisão. Neste artigo você vai ver como automatizar esse processo usando AWS CLI e Shell Script direto no AWS CloudShell — sem instalar nada localmente. O resultado final: usuários criados, alocados nos grupos corretos e com MFA obrigatório, tudo em minutos. O que é o IAM? O AWS Identity and Access Management (IAM) é o serviço que controla quem pode acessar os recursos da sua conta AWS e o que cada pessoa ou serviço pode fazer. Com o IAM você gerencia: Conceito Descrição Usuário Identidade individual com credenciais próprias Grupo Conjunto de usuários que compartilham as mesmas permissões Política Documento JSON que define o que é permitido ou negado Role Identidade temporária assumida por serviços ou usuários A boa prática é nunca conceder permissões diretamente a um usuário — sempre use grupos. Visão geral da solução O fluxo é simples: Criar os grupos IAM no console Montar um arquivo CSV com os dados dos usuários Rodar um shell script no CloudShell que lê o CSV e cria tudo automaticamente Aplicar a política de MFA obrigatório nos grupos Passo 1 — Criar os Grupos IAM Antes de importar os usuários, os grupos precisam existir. No AWS Console , acesse IAM → User groups → Create group e crie um grupo para cada perfil do seu ambiente. Neste exemplo usaremos: RedesAdmin — administradores de rede LinuxAdmin — administradores de servidores Linux DBA — administradores de banco de dados Estagiarios — acesso limitado para estagiários Nomes de grupos suportam até 128 caracteres (letras, números e + = , . @ _ - ), são únicos por conta e não diferenciam maiúsculas de minúsculas. Passo 2 — Montar o arquivo CSV Crie uma planilha com os dados dos usuários e salve como CSV separado por vírgula (UTF-8) . O arquivo deve ter exatamente três colunas: Username , Group e Password . Username , Group , Password joao . silva , LinuxAdmin , Senha @2024 ! maria . souza , DBA , Senha @2024

Hi HN, we’re Rishi and Sahil. We’ve developed Rudus ( https://www.rudus.ai/ ), an AI-powered takeoff and estimation platform built for concrete subcontractors. Takeoff is the process of measuring and quantifying materials from concrete plan sheets. Rudus identifies every concrete structure (footings, walls, columns, slabs), pulls in related details, and eliminates hours of manual quantity calculation. Here’s a demo: https://www.youtube.com/watch?v=PAMNDRWEdlI . The problem: Concrete subcontracto

My father worked in IT for over thirty years, and growing up around that shaped how I thought about computers. The earliest memory I have is sitting in my father's lap as he does something on his computer. One of the oldest photos I have is of me sitting on a chair in front of a computer. I grew up idolizing him. I switched to Linux when I was 12, by myself. I taught myself scripting, picked up programming basics, and spent more time in a terminal than most adults I knew. I have memories of sitting on the roof at 13 with my laptop, trying to crack my neighbor's WiFi with aircrack-ng (they were aware of my endeavors). However, growing up in a politically volatile neighborhood (Lyari) also made me politically aware and literate from a young age. With that, I developed an interest in political science and philosophy. I sat my A levels in economics and sociology, and I did not look back. For the next few years, the technical side of my life became just a habit rather than a professional direction. Then I realized I do not have to choose one or the other. I can carry on doing both. Today, I am an academic and technical editor. The social sciences gave me the writing skills: reading long blocks of dense theory, explaining abstract concepts in plain language, writing long analytical essays. And I understand technical concepts well enough to work with them seriously. I thought of synthesizing both. When I started building a technical writing portfolio, cybersecurity documentation felt like a natural place to go. Not because I had operational experience, but because I had grown up adjacent to that world. I understood the culture, the tooling, and the mindset, even if I had never worked a SOC shift. I knew I wanted to cover security documentation. Security teams produce some of the most consequential written work in any organization, and most of it is poorly structured, inconsistently formatted, or written for the person who already knows the answer rather than the person who

What is Wrisha? Wrisha is a desktop emotional AI companion — an animated character who can see you, hear you, talk back, and react. The pipeline is genuinely multimodal: Vision — webcam + facial-emotion detection (OpenCV / FER) Hearing — speech-to-text so you can just talk to her Brain — an LLM generates her replies, in-character Voice — text-to-speech with mood-modulated tone Avatar — an animated face (pygame) that emotes and lip-syncs I built the bones of it a while back, got busy, and walked away. The Finish-Up-A-Thon was the push I needed to come back to it. The "before": it didn't just need polish — it was dead When I reopened the repo, the harsh truth was that the app couldn't even start. Two things had rotted: The environment was a fossil. The project was so old it wouldn't install on a modern machine. Wrong numpy, stale dependency pins, and a Python version mismatch that sent pip trying to compile packages from source and failing. Just getting it to attempt to run took a full environment rebuild on Python 3.12. The code was half-migrated and crashed on launch. I'd previously upgraded the internal modules — memory, a mood engine, a smarter brain — to a "v3" design, but I never finished wiring them into main.py. So the moment it tried to start, it died: TypeError: init () missing 2 required positional arguments: 'memory' and 'mood_engine' The "before" in one screenshot: a project that built its best features and then never connected them. I'd built the hard parts — persistent memory, a smooth mood state machine, proactive behavior — and left them sitting in files that main.py never even imported. Classic abandoned-side-project energy. The "after": three things I finished I set out to do three things, and I'm counting all three as the win. It runs again The core fix was finishing the migration: rewiring main.py to actually construct the Memory and MoodEngine, inject them into the Brain, and reference mood from the engine instead of the dead attribute it used to