A malicious npm package name js-logger-pack , went through 29 versions on the registry which was looking innocuous logger and ending as a binary dropper. The payload it dropped was 81 MB of binary called MicrosoftSystem64 which is a full cross-platform RAT packaged as a Node.js Single Executable Application, so it shows up as a native binary to endpoint tools rather than a node process. And the clever bit was instead of sending the stolen data directly to a C2 server, it uploads everything to private HuggingFace datasets using an embedded API token. So all exfiltration traffic appears as normal HTTPS requests to a legitimate ML platform. If you have any of those in your install history then rotate everything like credentials, SSH keys, API tokens, crypto seed phrases. All packages list and full technical breakdown is in blog. submitted by /u/BattleRemote3157 [link] [留言]

TL;DR -DevRelCon NYC returns to Industry City in Brooklyn on July 22–23, 2026. It's the flagship...

We built a monokernel that runs the full decode sequence as one GPU-resident program on AMD MI300X, with some neat optimizations. The die topology is central to the result, we map memory access patterns to the physical layout, compute units group by their associated IOD, and the hardware runs at its full design performance. Up to 3,300 output tokens/s per request, batch size 1, no speculative decoding, no quantization, on 8x MI300X. This preview runs a small 2B coding model, and we plan to support large frontier MoE in the future. Technical deep dive: https://blog.kog.ai/building-a-single-kernel-latency-optimized-llm-inference-engine-on-amd-mi300x-gpus Try it: https://playground.kog.ai submitted by /u/averne_ [link] [留言]

GitHub reports cutting token costs in agentic CI workflows by up to 62% by pruning unused MCP tools, swapping some MCP calls for gh CLI, and running daily “auditor” and “optimizer” agents. A token-usage.jsonl artefact and an Effective Tokens metric help track spend across models and spot regressions. By Mark Silvester

While Blue Origin investigates the root cause behind last night's spectacular explosion of its New Glenn rocket, it's already clear that this will be a major setback for NASA's Moon base plans and Amazon's fledgling Leo space internet constellation. The incident occurred at about 9pm at Blue Origin's Florida launch site during a hot-fire test, […]

California AG Rob Bonta has sued 23andMe over the 2023 data breach that led to the sale of 7 million users' data on the dark web.

FastAPI released an official VSCode extension, which includes features such as route exploration, endpoint search, and CodeLens-style navigation. This tool aims to enhance the development experience for FastAPI users. submitted by /u/Top-Rush83 [link] [留言]

For a while, my starter kits didn't include any Docker configuration. The foundation was solid with auth, roles, MFA, Horizon, Logs Viewer, but the deployment side was left to whoever cloned the project. That was a deliberate choice at first. Docker setups vary a lot depending on the infrastructure: some people use a reverse proxy, others have Cloudflare in front, some run on bare metal, others on managed platforms. I didn't want to ship something that would need to be ripped out immediately. But over time I changed my mind. Here's why and what the process taught me. The problem with "just configure it yourself" Leaving deployment out of a starter kit sounds reasonable. In practice, it means every project starts with the same 4-6 hours of Docker work that never really changes. Multi-stage Dockerfile. PHP-FPM config. Nginx with HTTPS. PostgreSQL and Redis wired up. Horizon and the scheduler running as proper services. Healthchecks everywhere so Docker knows when things are actually ready. None of it is so complicated. But it's time-consuming, easy to get subtly wrong, and almost identical from one project to the next. Once I admitted that, the question wasn't whether to include Docker, it was how to do it in a way that's actually useful without being too opinionated about production infrastructure. What I ended up building The setup I settled on covers the full local development stack: A multi-stage Dockerfile : separate stages for Composer dependencies, Node assets, and the final PHP-FPM image. Keeps the production image lean. Nginx with HTTP-to-HTTPS redirect and a self-signed certificate for local dev, already included, no setup needed. PostgreSQL and Redis as services with proper healthchecks. Horizon and the scheduler as dedicated services, not crammed into the main app container. A bootstrap service that runs php artisan migrate --force before the app starts. The Dockerfile uses three stages to keep the final image as lean as possible: FROM php:8.4-fpm-alpine A

Here are two scenes. They look unrelated. They're not. Scene 1 Two people at a café, talking about a restaurant they want to try. A stranger walking past stops: "That place closed six months ago. The one on the corner is better." A brief nod, and they walk on. The two people exchange a glance, taken aback. Why did that person stop? What did they want? A few steps away, the stranger is also confused. They had useful information. They shared it. Why did these people react so strangely? Scene 2 A colleague is visibly stressed, describing a difficult situation at work. One friend pulls their chair closer, puts a hand on their arm: "That sounds really hard." Another opens their laptop: "I found something that might help — HR has a process for exactly this, I'll send you the link." The colleague leans into the first. Glances uncertainly at the second. The second person doesn't understand why sitting close and saying "that sounds hard" counts as helping. You haven't solved anything. The first doesn't understand why anyone would respond to distress with links. Both scenes end the same way: people on both sides convinced they did the right thing, confused by the other's reaction. The mismatch is mutual and invisible from the inside. Two survival instincts, two empathy systems For many autistic people, information is a survival mechanism. Uncertainty is threat, missing information is a vulnerability, and the drive to correct and share runs below conscious awareness. Empathy, expressed through that system , looks like giving someone what keeps you safe: accurate information, solutions, resources. The social preamble before sharing — announcing yourself, softening the approach — doesn't arise as a concept. Why would useful information require an introduction? For many neurotypical people, social safety is a survival mechanism. Group cohesion and reading others accurately are what keep people safe. Empathy, expressed through that system , looks like presence: mirroring distress,

ORA-00031: Session Marked for Kill — What It Means and How to Fix It ORA-00031 occurs when a DBA issues ALTER SYSTEM KILL SESSION but Oracle cannot terminate the target session immediately. Instead, Oracle marks the session as "KILLED" and waits for it to reach a safe termination point — typically after completing a rollback or releasing OS-level resources. This is less of a hard error and more of a transitional state that every Oracle DBA will eventually encounter. Top 3 Causes 1. Large Transaction Rollback in Progress When you kill a session mid-transaction, Oracle must roll back all uncommitted changes to preserve data integrity. The larger the transaction, the longer the session stays in KILLED status. -- Check rollback progress for KILLED sessions SELECT s . sid , s . serial # , s . username , t . used_ublk AS undo_blocks , t . used_urec AS undo_records FROM v $ session s JOIN v $ transaction t ON s . taddr = t . addr WHERE s . status = 'KILLED' ; 2. Unresponsive or Disconnected Client If the client network connection is broken or the client process has hung, Oracle cannot deliver the kill signal. The session lingers in KILLED state until the OS-level connection finally times out. -- Find the OS process ID (SPID) for stuck KILLED sessions SELECT s . sid , s . serial # , s . username , s . status , p . spid AS os_pid , s . machine , s . program FROM v $ session s JOIN v $ process p ON s . paddr = p . addr WHERE s . status = 'KILLED' ; 3. OS-Level I/O or Resource Wait Sessions blocked at the OS level (disk I/O stall, memory pressure, storage issues) cannot respond to Oracle's internal kill signal. In these cases, only an OS-level process termination will resolve the problem. -- Identify what the session was waiting on before being killed SELECT sid , serial # , status , event , wait_class , seconds_in_wait FROM v $ session WHERE status = 'KILLED' ; Quick Fix Solutions Option 1 — Use the IMMEDIATE keyword (recommended first step) -- Standard kill (asynchronous) AL

Every line of your smart contract costs something. Some lines cost more than others. In this part of our gas saving series, we’ll explore how to write smarter Solidity code that keeps your contract lean and efficient. Here are six simple and practical ways to reduce gas costs while writing Solidity smart contracts. 1. Use payable Only When Needed, But Know It Saves Gas In Solidity, a function marked payable can actually use slightly less gas than a non-payable one. Even if you're not sending ETH, the EVM skips some internal checks when the function is marked payable. See this example: function hello() external payable {} // 21,137 gas function hello2() external {} // 21,161 gas That tiny difference may not seem like much, but across thousands of calls, it adds up. Only use payable when your function is actually meant to accept ETH 2. Use unchecked for Safe Arithmetic When You’re Sure Since Solidity 0.8.0, all arithmetic operations automatically check for overflows and underflows. While this makes contracts safer, it also uses extra gas. When you're certain that overflow won't occur, you can use the unchecked keyword to skip these safety checks. uint256 public myNumber = 0; function increment() external { unchecked { myNumber++; } } Gas used: 24,347 (much cheaper than using safe math) Warning: Use unchecked carefully. Only when you're confident there's no risk of overflow. 3. Turn On the Solidity Optimizer The Solidity Optimizer is like a smart helper that cleans up and tightens your compiled bytecode. It does not change how your contract works, but it removes waste and makes it cheaper to run. If you’re using tools like Hardhat or Remix, always enable the Optimizer before deploying to mainnet. 4. Use uint256 Instead of Smaller Integers (Most of the Time) Smaller types like uint8 or uint16 might look more efficient, but they can cost more gas during execution. That’s because the EVM automatically converts them to uint256 behind the scenes. So, if you're not tightly p

If you've ever built or set up a subscription experience on Shopify for a coffee brand, you've probably run into the same problem most merchants face: The signup flow works great. The first order goes out. And then subscribers start quietly disappearing before the third delivery. This isn't a coffee problem. It's a subscription infrastructure problem — and it's almost always caused by the same handful of missing pieces in the system underneath the storefront. In this guide I'll walk through the practical setup decisions that actually move the needle on retention for coffee subscription businesses on Shopify — from choosing the right model and pricing structure to the fulfillment calendar, dunning logic, and cancellation flow that most setups skip entirely. Why Coffee Works So Well as a Subscription Product Before getting into setup, it's worth understanding why coffee is genuinely one of the better products to build a subscription around — when the infrastructure supports it. Predictable consumption cycle. A 12-oz bag of whole beans lasts roughly two to three weeks for a single drinker. That natural rhythm makes it easy to design a billing and delivery schedule that matches actual usage patterns. Daily habit. Roughly two-thirds of American adults drink coffee every day. A subscription removes the friction of reordering, and that convenience compounds into real retention over time. Freshness as a retention argument. Coffee quality degrades noticeably after roasting. Subscribers who care about quality genuinely prefer a recurring shipment over buying retail — which means freshness becomes a built-in reason to stay subscribed that most product categories simply don't have. The global coffee subscription market reached $808.8 million in 2024 and is projected to surpass $2.2 billion by 2033. The infrastructure opportunity for developers and merchants building on Shopify is real and still early. Step 1 — Choose the Right Subscription Model Before You Build The model choic

Agentic AI coding tools are transforming how we build software. But they share a fundamental constraint: context windows are finite, and as chat sessions grow, AI performance degrades, a phenomenon Anthropic calls context rot . The model loses its grip on early instructions, leading to a frustrating "fix-it loop" where the agent fixes one thing but breaks another. Most of us prompt an agent, let it write code, review it, and repeat. This works beautifully for prototypes. But when you need to build a stable, full-featured product with hundreds of mission-critical acceptance criteria (AC), "vibe-coding" breaks down. The reality is that you get better behavior from agents the same way you get it from humans, by explicitly capturing what good and bad look like, and checking against it . Coming from a systems engineering background in regulated industries, I knew we needed to stop treating agents like conversational chat buddies and start treating them like engineering assets. That's why I built DevCortex : a purpose-built structured intelligence layer that brings systems engineering discipline to agentic workflows. What is DevCortex? DevCortex is an agentic development platform built on one core idea: AI agents work best when they have structured, queryable access to a database of requirements they can interrogate on demand, not a wall of text in a prompt. It sits between the human specification and AI execution using three components: 1. An Agentic-V Model Database: A structured hierarchy mapping your high-level vision (ConOps) to system specs (Specs), individual requirements (Reqs), linked defects (Issues), and an auto-generated Traceability Matrix. 2. An MCP Server: Delivers just-in-time, high-signal context to tools like Claude Code or Open Code. Instead of dumping requirements upfront, the agent queries exactly what it needs, when it needs it. 3. Human Control Planes (Web UI & CLI): A multi-user Web UI with real-time WebSocket feeds to watch your agent work, plus a

Overview This is my first real-world cybersecurity VAPT experience inside an enterprise insurance company environment. I worked across network infrastructure, web applications, internal devices, and physical security — and learned how professional security assessments are actually performed beyond labs and CTFs. Introduction I am a cybersecurity enthusiast focused on SOC operations, web application penetration testing, and vulnerability assessment. In this engagement, I worked on assessing the security posture of an insurance company across its network infrastructure, devices, web applications, and physical security controls. This was my first real-world experience working in an enterprise environment, and initially I was not fully confident about the workflow. However, with the guidance and support of my senior, I was able to understand the process step by step and actively contribute to the assessment. Objective Identify security vulnerabilities across network, web, and internal systems Assess exposure of critical assets Analyze potential attack paths in the environment Evaluate basic physical security controls Scope of Work Network infrastructure assessment Web application security testing Device-level security review Basic physical security evaluation Tools Used Nessus (vulnerability scanning) Burp Suite (web application testing & request interception) Nmap (network discovery & port scanning) GVM / OpenVAS (vulnerability assessment) OWASP ZAP (automated web scanning) Wireshark (packet analysis & traffic inspection) Approach / Methodology Performed network discovery using Nmap to identify active hosts and open ports Conducted vulnerability scanning using Nessus and GVM to detect known security issues Analyzed web application behavior using Burp Suite and OWASP ZAP Intercepted and inspected HTTP/HTTPS traffic to understand request/response flow Used Wireshark to analyze packet-level communication and detect anomalies Evaluated system exposure across internal devic

This is a submission for the GitHub Finish-Up-A-Thon Challenge What I Built I built and revived Mandi Central , a complete business operations and billing system for mandi-style trading businesses. Live Project: https://mandicentral.in Mandi Central helps manage daily mandi operations like purchases, farmer purchase entries, sales entries, payments, bank and cash ledgers, accounting heads, reports, invoices, outstanding balances, and financial statements from one structured platform. This project was not started as a simple demo. It was a real business-focused software project, but it had many unfinished parts, broken flows, missing reports, pending PDF generation, incomplete mobile API planning, and several UI and accounting issues. For the GitHub Finish-Up-A-Thon Challenge, I brought it back, fixed the pending issues, completed the core business flow, and made the project live on mandicentral.in . Demo Live Website: https://mandicentral.in GitHub Repository: https://github.com/hiijoshi/bill Screenshots and demo cover the completed modules: Business Operations Hub Sales List Bank reconciliation Cash ledger Bank ledger Sales entry Purchase entry Farmer purchase entry Bulk PDF download Accounting reports Party ledger redirection Outstanding reports Mobile API-ready backend The Comeback Story Mandi Central started with a strong idea: create one platform where mandi businesses can manage their complete daily workflow. But before this challenge, the project was stuck with many incomplete and pending items. There were more than 40 pending issues across PDF generation, sales invoices, bank ledger, cash ledger, accounting reports, outstanding reports, purchase calculations, sales calculations, mobile APIs, AWS deployment, domain setup, and UI fixes. Some of the major problems before completion were: PDF generation was not working properly. Bulk sales bill download was missing. Mobile application APIs were pending. Farmer Purchase Entry API was pending. Purchase Entry API w