Every blog post needs an OG image. Without one, your links look blank on Twitter, LinkedIn, and Slack — just a plain URL that nobody clicks. Most developers solve this by spinning up a headless browser, loading an HTML template, taking a screenshot, and uploading it somewhere. It works, but now you're maintaining a Puppeteer instance, dealing with font rendering quirks, and burning server resources on something that should be simple. There's a faster approach: design your OG images as HTML templates and let a screenshot API handle the rendering. The Idea: HTML Templates as OG Images Think of your OG image as a tiny webpage. You already know HTML and CSS. Build a 1200×630 template with your blog title, author name, maybe a gradient background — whatever fits your brand. Host it or pass it as raw HTML. Then call an API to screenshot it. Done. A basic template might look like this: <div style= "width:1200px;height:630px;display:flex;align-items:center; justify-content:center;background:linear-gradient(135deg,#1a1a2e,#16213e); font-family:Inter,sans-serif;padding:60px" > <div style= "color:#fff;text-align:center" > <h1 style= "font-size:48px;margin:0" > {{title}} </h1> <p style= "font-size:24px;color:#8892b0;margin-top:20px" > {{author}} · {{date}} </p> </div> </div> Replace the placeholders on your server, then send the resulting HTML (or a URL pointing to it) to the API. Calling the API With ScreenshotRun , a single curl request captures the rendered template as a PNG: curl -X POST "https://api.screenshotrun.com/v1/screenshot" \ -H "Authorization: Bearer YOUR_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "url": "https://yourblog.com/og-template?title=My+Post+Title", "viewport_width": 1200, "viewport_height": 630, "format": "png" }' The response gives you the image file. Save it to your CDN, set the og:image meta tag, and you're done. No browser to manage, no Chrome binary eating RAM on your CI server. Wiring It Into Your Build If you publish with a static sit

Most AI agents fail because they are developed in a vacuum without access to the scale and complexity of production data. This context gap leads to agents that hallucinate your infrastructure and suggestions that break the moment they hit a live environment. Most agentic failures are context failures rather than intelligence failures. Traditional development workflows create fragmentation and failure points for AI. You can bridge this gap by using byte-level clones to provide agents with a machine-readable map of your world. Upsun allows every Git branch to trigger a byte-level clone of your production environment in under a minute. Copy-on-Write technology ensures you only pay for data changes and not for duplicating massive datasets. Logical isolation means your agents can run heavy queries without consuming cycles from your production cluster. Stop paying the devops tax and give your agents the deterministic sandbox they need to succeed. Solve the data context gap for AI agents | Upsun Stop AI failures caused by fragmented stacks. Use byte-level clones to bridge the repro gap and develop agents against production-grade data. upsun.com

A pre-install supply-chain gate returns ALLOW or DENY for each package your AI agent proposes, before npm install runs, keyed on provenance: is the name in a vouched snapshot or a popular baseline, and is the .npmrc registry trusted. An SBOM taken after resolve cannot answer that question. In this post's attack manifest, supply_chain_gate.py returns 2 DENY and exits 1. AI disclosure: I wrote supply_chain_gate.py with an AI assistant and ran it myself, offline, before publishing. Every number in the output blocks below is pasted from a real local run on Python 3.13.5, standard library only, no network. I checked the exit codes (0 / 1 / 2), hashed the STDOUT twice to confirm it is byte-for-byte deterministic, and edited every line. The external figures I cite (the USENIX 2025 package-hallucination study) are the researchers' numbers, not mine, and I link the source and say how they measured. I keep their numbers and my run's numbers in separate paragraphs on purpose. In short: An SBOM and a CVE scan run after npm install . They record what resolved and whether it has a known CVE. Neither can say whether your agent should have proposed that name in the first place. A coding agent recommends a dependency with the same flat confidence whether the name is real, hallucinated, or one letter off a real one. That confidence is exactly what a post-resolve scan cannot see through: a name registered yesterday has no CVE yet, so a known-CVE scan lists it as clean. supply_chain_gate.py reads a manifest (the packages the agent proposed, your vouched snapshot, and your .npmrc ) and returns ALLOW or DENY per package against a bundled popular baseline, before install. The result that carries the argument: the same 277-name baseline that ALLOWs express (exact match) DENYs expresss in a sibling manifest. One letter flips the verdict. What flips it is default-deny against a vouched baseline, not a static blocklist of known-bad names; the edit-distance check only labels the DENY ( TYPOSQU

Hello, I'm Maneshwar. I'm building git-lrc, a Micro AI code reviewer that runs on every commit. It is...

Welcome to our weekly digest, where we unpack the latest in account and chain abstraction and the broader infrastructure shaping Ethereum. This week: Ethlabs launches as an independent EF-origin R&D lab backed by Bitmine, Sharplink, and Joe Lubin; the Ethereum Foundation reorganizes into five focused clusters and parts ways with a fifth of its staff; Starknet brings confidential USDC payments to DeFi through its STRK20 framework; and a new industry report charts how crypto-native neobanks went mainstream and why account abstraction matters more because of it. Ethlabs Launches as an Independent R&D Lab The Ethereum Foundation Restructures Into Five Clusters Starknet Brings Private USDC to DeFi Crypto Neobanks Cross From Experiment to Infrastructure Please fasten your belts! Ethlabs Launches as an Independent R&D Lab A coordinated group of Ethereum contributors has launched Ethlabs , an independent nonprofit research and development lab built to ready the network for its next wave of institutional and agentic adoption. The funding effort is led by Bitmine, Sharplink, and Ethereum co-founder Joe Lubin, with support from Anchorage, Octant, and SNZ. Ethlabs is cofounded by five former senior Ethereum Foundation researchers — Ansgar Dietrichs, Barnabé Monnot, Caspar Schwarz-Schilling, Josh Rudolf, and Julian Ma — who between them shaped finality, scaling, data availability, and protocol economics over the past decade. Dietrichs serves as Executive Director. The lab’s early work centers on what institutions need to move onchain at scale: faster settlement, native issuance, cross-chain movement, and more mainnet capacity, alongside research into ETH’s monetary properties. The team frames the moment as Ethereum’s shift from infrastructure buildout to an age of adoption, where the architecture that settles global activity is being decided now rather than in ten years. To preserve neutrality, funding flows through an independent grants administrator that handles screening and

submitted by /u/m-chav [link] [留言]

Auditing My Indie SaaS Subscriptions: 5 Alternatives That Cut $800/Year TL;DR Fixed costs for indie dev projects balloon through "subscriptions you signed up for and forgot." I switched 5 services to free tiers or self-hosted alternatives, cutting ¥10,000/month — ¥120,000/year (roughly $800). The short version: Before Monthly After Monthly Annual Savings Heroku Hobby (2 dynos + DB) ¥2,800 Fly.io / Railway free tier ¥0 ¥33,600 Vercel Pro ¥3,000 Cloudflare Pages ¥0 ¥36,000 Datadog (1 host) ¥2,300 Grafana Cloud Free ¥0 ¥27,600 Mailgun Foundation ¥1,400 Resend free tier ¥0 ¥16,800 Algolia Build overage ¥500 Meilisearch (self-host) ¥0 ¥6,000 At indie-project traffic levels, you're probably using less than 10% of what paid plans offer. The first step is auditing your usage and checking whether your actual numbers fit inside a free tier. The Approach: Measure First, Decide Second Cut decisions should be based on real data, not gut feeling. Start with a billing audit. # Export each service's plan and recent usage to a spreadsheet # Example: check request count for the last 30 days from nginx access log awk '{print $4}' access.log | grep -c " $( date +%d/%b/%Y ) " # → A few thousand requests/day fits comfortably inside almost every SaaS free tier The key is looking at actual traffic , not peak spikes. Most indie projects fit well within Vercel/Cloudflare free tiers (100k requests/month to unlimited bandwidth). Step-by-Step Migration 1. Hosting: Heroku → Fly.io # Deploy to fly.io — existing Dockerfile or buildpacks work as-is curl -L https://fly.io/install.sh | sh fly launch # interactively generates fly.toml fly deploy fly scale count 1 # 1 instance is enough for indie projects fly postgres create # small instance, effectively free The key to cost control: lock to fly scale count 1 and the minimum VM ( shared-cpu-1x ). 2. Frontend: Vercel Pro → Cloudflare Pages Unlimited bandwidth, generous build limits, and free equivalents of Pro features (Analytics, etc.) that most indie

Build software that heals itself in the agentic era Bucabay Bucabay Bucabay Follow Jul 1 Build software that heals itself in the agentic era # ai # agents # architecture # security 13 reactions 3 comments 10 min read

The $765K NFT exploit nobody using block.timestamp thinks about In May 2021, an attacker exploited the Meebits NFT mint, one of Larva Labs' projects, by taking advantage of its predictable randomness mechanism. Meebits used on-chain inputs including block timestamp, nonce, and difficulty to generate the token ID for each newly minted NFT. Different token IDs had different rarities, and rarer IDs were worth significantly more on the secondary market. The attacker figured out the generation formula, simulated the outcome before committing, and repeatedly rerolled mints within the same transaction until hitting a rare NFT. They walked away with a Meebit later sold for roughly 200 ETH, worth approximately $765K at the time. The contract did exactly what it was programmed to do. The problem was the inputs it trusted as "random" were never actually random at all. This is day 7 of the 28-day Chainlink architecture series. Today covers Chainlink VRF: why on-chain randomness is a fundamentally hard problem, how VRF solves it cryptographically, and a detail most explainers skip entirely: why even a fully compromised node operator can't bias a VRF output. Why blockchains can't generate real randomness natively Smart contracts are deterministic. Every node in the network runs the same code on the same inputs and must arrive at the same result, every single time, or consensus breaks. That determinism is what makes blockchains trustworthy. It also makes native randomness structurally impossible. Any value a smart contract can read mid-execution: block.timestamp , blockhash , block.difficulty , block.prevrandao is visible to validators and miners before the block is finalized. That visibility creates a manipulation window block.timestamp : validators can manipulate this within roughly a 15-second window on Ethereum. Small enough that nobody notices, large enough to flip a coin-flip lottery in your favor repeatedly. blockhash : if a validator is about to mine a block where the hash

683 Test Files Later: How We Validate AI Agent Wallet Infrastructure Your AI agent can browse the web, write code, and manage files — but can it actually touch money? That's the gap WAIaaS was built to close: a self-hosted, open-source Wallet-as-a-Service that gives your AI agent a real blockchain wallet, a policy engine, and a transaction pipeline it can use autonomously. And before any of that ships to production, it has to pass more than 683 test files. Why Test Coverage Matters for Wallet Infrastructure When your agent sends an email, a bug means a bad email. When your agent sends 0.1 ETH to the wrong address, a bug means lost funds. The stakes are categorically different. This isn't about chasing a coverage number. It's about the fact that wallet infrastructure for AI agents sits at the intersection of two unforgiving domains: financial transactions (irreversible, high-stakes) and autonomous software (runs without human review). If you're building an agent on top of a wallet layer, you need to know that layer has been beaten up extensively before you trust it with real assets. Here's a practical look at what WAIaaS actually tests, and more importantly, what that means for you as a developer building on top of it. The Architecture Under Test WAIaaS is a 15-package monorepo. Each package has its own test suite, and together they cover every layer of the system an AI agent will touch. actions, adapters, admin, cli, core, daemon, desktop-spike, e2e-tests, mcp, openclaw-plugin, push-relay, sdk, shared, skills, wallet-sdk That's 683+ test files spread across packages that include: The transaction pipeline — a 7-stage pipeline covering validate, auth, policy, wait, execute, and confirm The policy engine — 21 policy types and 4 security tiers 45 MCP tools — every tool your Claude or LangChain agent will call 15 DeFi protocol integrations — including Jupiter, Aave v3, Hyperliquid, and more 39 REST API route modules — every endpoint the SDK talks to When you call client.

⚠️ This article contains affiliate advertising (promotions). A portion of revenue generated through linked sites is paid to the author, but this does not affect the purchase price for readers in any way. Hey — I'm a working engineer running a side hustle in tech writing and e-commerce. Here's the bottom line upfront: by the time you finish this article, you'll have a Python script that extracts "side-hustle promo noise" from your X (Twitter) timeline and auto-adds it to a mute list , plus a Claude Haiku classifier that labels each tweet as signal or noise for roughly ¥0.02 per tweet — copy-paste ready, just swap in your API keys. My own information-gathering time dropped from 90 minutes to 12 minutes a day (7-day average; details below). Why Manual Muting Breaks Down on X: The 30-Item Wall Muting on X via the GUI is one entry at a time. In my case, roughly 70% of the 480 accounts I follow are genuinely useful — but 30% are promotional, making them "almost good" accounts. Muting at the account level kills the useful tweets too. So I turned to keyword muting, which becomes unmanageable past 30–40 keywords manually. Add "free," "limited time," "LINE sign-up," and "#RT please" to the list and you start catching legitimate tech tweets as collateral damage. One failure story: early on I added "side hustle" as a mute keyword, missed an entire high-quality thread squarely in my interest zone, missed the viral wave, and conservatively lost about ¥3,000 in affiliate opportunity. Word filters don't have the precision. That's the starting point for this article. Extracting "Promo Templates" Mechanically with Tweepy and Filter Rules First, using the X API v2 (read access is available even on the free tier) and Tweepy, I pull tweets equivalent to my home timeline and numerically score structural features common in promotional content. The trick is to score on three axes — emoji density, URL count, and call-to-action verbs — rather than keyword matching. import re import tweepy cl

We did what most engineering teams do. Bought an OpenAI API key. Shared it on Slack. Told everyone to start using AI in their workflow. It felt like the right move. Productivity went up. Developers were happy. Managers were impressed. Then the invoice arrived. Nobody could explain it. We could not tell which team spent what, which model was being used, or whether anyone had accidentally sent customer data to an external provider. We had full AI adoption and zero visibility. That is when we realized we had confused access with governance. The problem is not the AI. It is the missing layer between your team and the API. Most teams operate with raw provider keys floating around in .env files, Slack messages, and IDE configs. When someone leaves, you hope they did not take the key with them. When a pipeline misbehaves overnight, you find out from the billing alert, not from your own monitoring. We started asking ourselves some uncomfortable questions: Who on the team is using GPT-4o versus a cheaper model? Is anyone sending PII to an external provider without knowing it? What happens if our OpenAI key gets exposed in a public repo? Can we switch to Anthropic without rewriting half our tooling? None of these are exotic concerns. They are the natural consequences of scaling AI access without an infrastructure layer to govern it. What actually helped We needed something that sat between our developers and every AI provider, handling authentication, enforcing limits, logging every request, and letting us swap providers without touching application code. Think of it the way an API gateway manages microservices. Same idea, but for LLM traffic. Developers point their tools like Cursor, Continue.dev,...at a single endpoint. Two environment variables. Nothing else changes. Behind the scenes, every request is logged, every token counted, every provider key protected. Governance without friction. That is the only kind developers will actually tolerate. If your team is using AI wit

You bought the hardware. Now you’ll need to subscribe for “expanded access” to the most advanced features.

According to the Financial Times, Sam Altman is floating the idea of having leading AI companies give US sovereign funds a five percent equity.

The speakers discuss Netflix’s architecture for surviving extreme traffic spikes. They explain the mechanics of prioritized load shedding embedded in their Envoy sidecar proxy, allowing user-initiated requests to steal capacity from non-critical traffic. They share automated platform strategies for continuous chaos load testing, config generation, and retry storm mitigation. By Anirudh Mendiratta, Benjamin Fedorka

Europe's highest court of appeal has upheld a record-setting $4.7 billion fine imposed on Google back in 2018.

Amazon says it now has enough satellites operating in low-Earth orbit to light up its Starlink internet competitor. With last night's launch, Amazon Leo has 396 satellites deployed, which is "enough to support continuous service across initial latitudes," according to Chris Weber, VP heading up business and product for Amazon Leo. That puts the company […]

Something stinks in California’s climate policies. Years ago, the state set up a system that pays cattle farmers across the country to turn the methane emitted from cattle manure into natural gas, encouraging the dairy sector to produce a gas we burn instead of one that just pollutes the air. It’s become wildly popular because…

Long hours outdoors, day drinking, and World Cup matches are among the factors raising the risks of heat-related illness, as hot weather spreads across the eastern US.