Prompt injection and token savings - #1 in benchmarks Discussion | Link

submitted by /u/DanielRosenwasser [link] [留言]

Go from an empty repository to a live custom domain with HTTPS in about 14 minutes, without manually editing a single DNS record. The post How GitHub Copilot enables zero DNS configuration for GitHub Pages appeared first on The GitHub Blog .

Most Dockerfiles work. That's the problem — "it builds and runs" hides a lot of quiet costs in security, speed, and size that don't announce themselves until an audit, an incident, or a cloud bill does it for them. Here are seven mistakes I see constantly, and what to do instead. 1. Running as root By default, the process in your container runs as root — and if someone breaks out, they're root on a surface they shouldn't be. Add a non-root user and switch to it: RUN useradd --system --uid 10001 appuser USER appuser Cheap, and it closes off a whole category of "well, at least it wasn't root" incidents. 2. FROM some-image:latest latest is not a version — it's "whatever was newest when this happened to build." Two builds a week apart can produce different images with no diff to explain it, and a surprise base upgrade is a fun way to spend a Friday. Pin a specific tag, ideally by digest: FROM node:20.11.1-slim 3. Baking secrets into layers COPY .env . or ARG API_KEY followed by using it — and now the secret lives in an image layer forever , recoverable by anyone who pulls the image, even if a later layer deletes the file. Layers are immutable and additive; you can't delete your way out of a leak. Use build secrets ( --mount=type=secret ) or inject at runtime, never at build. 4. No .dockerignore Without one, COPY . . sweeps your .git directory, local env files, node_modules , and test data into the build context — bloating the image and, worse, potentially baking credentials and history into a layer. A five-line .dockerignore is one of the highest-leverage files in the repo. 5. Layer order that destroys your cache COPY . . RUN npm ci # ← reinstalls on EVERY code change Docker invalidates every layer after the first change. Copy the lockfile and install dependencies before copying the rest of your source, so a one-line code change doesn't trigger a full reinstall. This is a build-speed bug hiding as a style choice. 6. Leaving package manager cruft in the image RUN apt-get

This post was originally published on MatrixTrak.com — the production reliability toolkit for trading bot operators and .NET engineers. When requests hang forever and recycling releases stuck work: why missing timeouts create backlog, how to add budgets safely, and the rollout plan that prevents new incidents.. Most production incidents do not start as "down." They start as waiting. At 09:12 a dependency slows down. Your ASP.NET instances look healthy. CPU is fine. Memory is fine. But requests stop finishing. In-flight count climbs. Connection pools stop turning over. You scale out and it does not help because the new instances just join the waiting. The cost is not subtle. Backlog grows, SLAs fail, and on-call starts recycling processes because it is the only thing that releases the stuck work. Then the incident repeats next week because nothing changed about the waiting. This post gives you a production playbook for .NET: how to set time budgets, wire cancellation, and roll it out without triggering a new outage. Rescuing an ASP.NET service in production? Start at the .NET Production Rescue hub . If you only do three things Write down a total budget per request/job (then enforce it). Set per-attempt timeouts for each dependency and log elapsedMs , timeoutMs , and the decision (retry/stop/fallback). Propagate cancellation end-to-end so work stops (no zombie work after timeouts). Why requests hang forever: infinite waits capture capacity Missing timeouts are not a performance problem. They are a capacity problem. When a call can wait forever, it will eventually wait longer than your system can afford. While it waits, it holds something your service needs to operate: a worker slot, a thread, a connection, a lock, or a request budget. Once enough requests or jobs are holding those resources, the system stops behaving like a service and starts behaving like a queue you did not design. From the outside it looks like "everything is slow." Underneath, you are accumulating

I wanted to understand how malloc actually works under the hood. Most explanations I found online described what an allocator does, but completely skipped over the "why" behind its design decisions. Rather than stopping at theory, I decided to build a cross-platform allocator in C that implements malloc , calloc , realloc , and free from scratch. This article documents the design of that allocator, the architectural tradeoffs I faced, and the core concepts I had to learn along the way. Table Of Contents Design Decisions Architecture Modern Allocator Strategies Core Concepts What's Next Project Overview A custom memory allocator does not create physical memory. Instead, it requests pages of raw virtual memory from the operating system and manages how that memory is partitioned, reused, resized, and released by the application. The goal of this educational project is to implement C's core memory management API using a modular, cross-platform architecture inspired by design principles found in modern allocators, rather than relying on legacy, single-platform tricks. Design Decisions #1: Why I am Skipping sbrk While many classic tutorials use sbrk for educational implementations, I deliberately chose a 100% mmap -based approach for two major reasons: sbrk is a fragile global bottleneck. It works by moving a single pointer (the program break) up and down. This means the allocator assumes it owns a contiguous line of memory. If a third-party library or another thread in the program secretly calls sbrk behind the scenes, the allocator's memory layout can break instantly. mmap , by contrast, provides isolated, independent chunks of memory. Cross-Platform Symmetry. Windows has absolutely no equivalent to sbrk , but it has a direct equivalent to mmap : VirtualAlloc . If we used sbrk , our architectural abstraction ( os_alloc ) would become awkward because Linux would deal with a moving pointer while Windows dealt with independent pages. Using mmap keeps the abstraction perfec

I tried to build an arbitrage bot between Kalshi and Polymarket. Sports seemed to be the easiest because the matcher is relatively easy compared to the other markets (economy, bitcoin, weather, etc.) The matcher worked, we got about ~98% of the sports and e-sports market. But there's barely any sizable arbitrage between Kalshi and Polymarket, and what shows up closes in under 10 seconds. For the Argentina vs Egypt, the match with the disputed VAR call and Argentina's stoppage-time comeback from two goals down. Every price swing on that match, including the two around the VAR call, closed inside about 45 seconds. Total arbitrage opportunity net of fees across the whole match: $439, against $20.8 million moving through Polymarket's market alone and $13.8 million in Kalshi open interest. ( https://dino.markets/blog/argentina-egypt-var-price-gap ) That's not an arbitrage opportunity. That's what an efficient pair of order books looks like once you finally have the tooling to watch them at the same time. I logged this properly over a full day too: 870 cross-venue price gaps in one 24-hour window, median time open about 9 seconds, 96 percent closed inside 30. ( https://dino.markets/blog/how-long-a-mispricing-lasts ). So I shipped the Polymarket-Kalshi sports market matcher as an API instead of an arbitrage trading bot. It turned out the matcher itself was the useful part. Free REST access to the matched feed and the confirmed-arb view, 60 requests a minute, MCP server included so an agent can read it without you writing a client. Planning to open source the matching engine itself at some point. After that, either extend it to other market pairs between Kalshi and Polymarket, or look at arbitrage against traditional sportsbooks. Nothing locked in yet. Feel free to use it and tell me what you think about it. Thanks!

I Built a Platform Where builders Can Document Their Products Before They Even Launch One thing I've learned after building side projects is that writing code isn't the hardest part. Getting people to notice what you've built is. Every time I finished a project, I'd launch it on a few platforms, share it on X, and hope someone would find it. Sometimes I'd get a few users, but after a day or two, the momentum was gone. It made me realize something. Most platforms are designed for the launch, not the journey. But as developers, the journey is where the interesting stuff happens. You fix bugs, redesign the UI three times, celebrate your first user, rewrite your backend, and slowly turn an idea into a real product. Those moments are worth sharing too. So I started building LaunchDock.space . The idea is simple. Instead of only launching finished products, developers can also create a page for projects that are still in development and post daily progress updates. Think of it as a place to build in public, document your progress, and grow an audience before your product is even ready. Along with development logs, LaunchDock lets makers: Launch finished products. Discover tools built by other builders. Follow the progress of other makers. Connect with a community that enjoys discovering new projects. I'm building LaunchDock with React, TypeScript, Node.js, Express, MongoDB, and Cloudflare R2, keeping the stack simple and focused on performance. The project is still evolving, and I'm shipping new features regularly. Building it has taught me a lot about product design, user feedback, and the importance of consistent shipping. I'd love to hear your thoughts. If you were using a platform like this, what feature would make you come back every day?

There are a lot of fast-growing AI startups, but some are growing even faster, they say.

The robotaxi stopped, called 911, and waited for the San Mateo Police to show up.

What if the AI you chat with every day is quietly running something that looks a lot like a train of thought, and we just never had the right tool to see it? On 7th July, 2026, Anthropic published a research paper that honestly feels a little spooky. The team behind the Transformer Circuits Thread released a long, detailed study called Verbalizable Representations Form a Global Workspace in Language Models . The title is dense, but the idea inside is wild. They found a small, privileged region inside Claude and similar models. A region that behaves a lot like what cognitive scientists call the global workspace , the part of the brain associated with conscious access. The part that lets you say, I am thinking about a banana right now . In this post, I want to walk you through what they found, in plain English, with no math fear and no jargon walls. We will cover what the workspace is, how they found it, what they can do with it, and why it matters for anyone building or using AI. Grab a coffee. This one is worth your time. First, a Quick Brain Detour Before we get to the model, we need a tiny bit of background from neuroscience. For decades, scientists have noticed that the brain seems to operate on two tracks. Most of what your brain does, like parsing the sounds coming into your ears or keeping you balanced, happens automatically and quietly. You cannot really talk about it . It just runs in the background. But a smaller slice of brain activity is different. It is reportable . You can put it into words. You can hold a concept in mind, dismiss it, chain it to another concept, and use it for reasoning. Cognitive scientists call this access consciousness . One popular theory, called the Global Workspace Theory , says this happens because the brain has a shared hub. Specialized processors do their own thing in parallel. But every now and then, a representation gets posted to this central workspace, and once it is there, lots of other brain systems can read it, reason w

This post is about Hyperbole's HyWiki package for knowledge management. I've been doing a deep dive into knowledge management and PKMSs, and in my research I've found that HyWiki offers the best of all worlds. It has a truly unique behavior compared to other PKMSs that allows it to obviate the bookkeeping involved with linking your notes together, and allows your curated knowledge to propagate into the rest of your Emacs, not just your siloed notes vault. submitted by /u/misterchiply [link] [留言]

Hello fellow React developers! In this article we will be breaking down what React component instance is and scenarios where React component instance is at play. What is a React Component ? Before we can understand and really appreciate what a React component instance is, we first need to understand what a component itself is. Basically, components are the fundamental building blocks of any React application. They are independent, reusable pieces of code that allow you to split your application into distinct, manageable bits of logic and UI. From our knowledge of JavaScript, you can think of components in a way as what a function is. Just as we create and use functions to avoid repeating code and separate logic, components are used to divide our application into reusable visual chunks. However, they work in isolation and return HTML (via JSX) to describe what appears on the UI. Let take a look at a simple Greetings component used in a demo; Instead of writing the HTML layout for a greeting over and over again, we define it once as a component and reuse it multiple times in our application by passing different props (arguments). React Component Instances: What are they ? Now that we understand what a React component is, let's move on to React component instances. In programming, an instance is a concrete object created from a specific template (such as a JavaScript class or a Constructor function). In React, a component instance is the actual implementation of a component in a React application. It is a long-lived object that holds contextual information about a particular component. Every time a component is rendered in our application, React creates a new instance of that component. To help you visualize this, let’s take a look at a simple Counter component; // A Counter Component import React , { useState } from ' react ' ; export default function Counter () { const [ count , setCount ] = useState ( 0 ); return < button onClick = {() => setCount ( count + 1 )} > C

Most agent demos are one-shot loops. You open a terminal, give the model a task, watch it call tools, and then the process dies. That is fine for coding sessions. It is a weak shape for an assistant that is meant to live in your actual workflow. Talon is built around the other shape: a persistent agent process with frontends, memory, tools, background jobs, and swappable model backends. What it runs on Talon can expose the same agent core through: Telegram Discord Microsoft Teams terminal chat a desktop/mobile companion bridge That means the agent is not tied to one UI. The chat app is just a mouth. The core state, tools, memory, goals, and model backend live behind it. Backends are swappable The same harness can run through: Claude Agent SDK OpenAI Agents Codex Kilo OpenCode Each backend implements the same capability interface, so the rest of the system does not need to care which model runtime is active. It has real operating machinery The important parts are not flashy. They are the things that let an agent keep working after the first message: MCP plugins for tools cron jobs for scheduled actions triggers for condition-based wakeups persistent goals for multi-session work long-term memory heartbeat mode for background progress dream mode for consolidation per-chat model and effort settings This is the difference between "chat with a model" and "run an assistant". Install npm install -g talon-agent talon setup talon start Repo: https://github.com/dylanneve1/talon If this is the kind of agent infrastructure you want more of, a GitHub star helps the project get found.

We've all seen password strength meters on sign-up forms. Most of them rely on simplistic, static rules: "Must contain at least 8 characters, one number, and one special character." But from a mathematical standpoint, these rules are a poor proxy for actual password security. A password like Tr0ub4dor&3 conforms to these rules but is far easier to compromise than a randomly generated four-word passphrase like correct-horse-battery-staple . To truly measure password security, we have to look at information theory and compute its Shannon Entropy . Here is how password entropy works, the math behind it, and how you can calculate it directly in the browser with 100% client-side privacy. What is Password Entropy? In cryptography, entropy is a measure of the unpredictability or randomness of a password. It is expressed in bits . An entropy of $N$ bits means there are $2^N$ possible combinations that an attacker would have to guess in a worst-case brute-force search. < 28 bits: Very weak (easily guessed in milliseconds). 28 to 35 bits: Weak (cracked in minutes or hours). 36 to 59 bits: Reasonable protection (days to months). 60 to 127 bits: Very strong (takes years to decades to crack). 128+ bits: Extremely secure (mathematically unfeasible to crack). The Mathematical Formula To calculate the entropy ($E$) of a password, we use the following equation: $$E = L \times \log_2(R)$$ Where: $L$ is the length of the password (number of characters). $R$ is the size of the pool of unique characters from which the password is drawn. $\log_2(R)$ is the binary logarithm of the pool size, representing the amount of information carried by each character. Determining Pool Size ($R$) To find $R$, we analyze which character sets are present in the password string: Lowercase letters ( a-z ): 26 characters Uppercase letters ( A-Z ): 26 characters Numbers ( 0-9 ): 10 characters Common special characters/punctuation: 33 characters (e.g., !@#$%^&*()-_=+[]{}|;:',.<>/? etc.) If a password uses ch

MarkDown - что это? [[Markdown]] — это язык разметки, с упрощенным до человекочитаемости синтаксисом. Markdown — создан Джоном Грубером ( John Gruber ) в 2004 году. Markdown — это фактически "микро" язык для трансляции "текста markdown"в подмножество языка XHTML. Markdown - итоговая презентация текста всегда документ HTML , и только потом если нужно следующим шагом PDF, др. стандарты документации. Markdown принципиально не может задействовать весь потенциал XHTML, результатом его работы всегда является ограниченный набор элементов. Markdown — это транслятор который при анализе интегрированного в "текст" markdown HTML/XHTML кода обязан по стандарту просто его транслировать в итоговый образ документа. Markdown — это, если цитировать автора > «Markdown — это инструмент преобразования текста в HTML для веб-писателей. Markdown позволяет писать в легко читаемом и удобном для написания текстовом формате, а затем преобразовывать его в структурно корректный HTML. ║ John Gruber » Примечание Термин транслятор , не обходимо понимать как сущность алгоритм Я не нашел программу реализующая концепт MarkDown по принципам John Gruber. Ни одна программа не умеет делать из Markdown валидный по John Gruber HTML. Все проверенные мною программы Obsidian, MarkText, Typora, на выходе из 10 строк генерируют портянку HTML в несколько тысяч строк!!! Причина Obsidian, Typora и MarkText используют Markdown не для веб-писателей и блогеров, а как формат хранения баз знаний (Knowledge Management)**. John Gruber - Wikipedia

Every junior developer or solo software engineer falls into the exact same engineering trap: They conflate writing code with building a business. They spend their initial excitement phase setting up intricate user database authentication schemas, writing custom cron jobs for automated subscription reminders, or building heavy background pipelines just to resize a user’s uploaded logo image. By the time their local environment is "infrastructure perfect," weeks have passed. The momentum is gone, burnout sets in, and the repository is abandoned before ever tasting real production traffic. In 2026, computing power has completely shifted to specialized edge layers. Infrastructure has become commoditized. If you are wasting creative bandwidth trying to compete on backend pipelines instead of focusing entirely on your unique value proposition, you are systematically killing your startup. Here is the architectural matrix to decouple your operational infrastructure and shift to a lean, hyper-scalable API-first codebase. Part 1: The Production Infrastructure Decoupling Layer The golden rule of modern systems design is clear: Your application should only maintain two core pillars internally—your proprietary business logic and your core user state database. Everything else—from security to user tracking—is a solved problem that should be offloaded to third-party micro-services. Let’s look at the financial and time trade-offs of building versus outsourcing across critical technical vectors: Microservice Vector The Native Way (High Friction) The 2026 API Standard Launch Velocity Impact Merchant of Record Raw Stripe API + Custom Tax Calculators Lemon Squeezy / Paddle Saves 5 days of legal & accounting setup Feature Rollouts Custom Postgres feature-flag logic loops GrowthBook / LaunchDarkly Zero deployment overhead for major pivots Customer Feedback Manual tables + Admin CRUD boards Featurebase API Instant roadmaps directly inside frontend Media Compression AWS S3 triggers + Edge

Here's why your Prompt is WRONG 😑 Pravesh Sudha Pravesh Sudha Pravesh Sudha Follow for AWS Community Builders May 29 Here's why your Prompt is WRONG 😑 # ai # promptengineering # programming # beginners 9 reactions Add Comment 3 min read