submitted by /u/DataBaeBee [link] [留言]

Over the past few months I've been heavily involved in the decompilation community. I've been hands-on decompiling a beloved game from my childhood (Star Fox Adventures). I started this journey with zero prior decomp experience—and to make things worse I had never really touched C nor assembly either. Learning how to decompile was challenging. It's difficult to find any good learning resources for it and any open-source projects for this are inactive and/or contain little actual learning materia

Original post: tachiosports.com What we're building By the end of this guide, you'll have a Discord bot that posts live CS2 match scores to a channel, updates every 60 seconds, and shows team names, current map, and odds. No database required — everything comes straight from the API. Prerequisites You'll need Node.js installed (v18 or newer), a Discord bot token from the Discord Developer Portal, and a free Tachio Sports API key. Sign up on the homepage with GitHub to get yours. Step 1 — Create the Discord bot Go to discord.com/developers/applications and create a new application. Under the Bot tab, click Add Bot and copy the token. Invite the bot to your server with the 'bot' and 'Send Messages' permissions. Keep your token secret — it's like a password for your bot. Step 2 — Set up the project mkdir cs2-discord-bot cd cs2-discord-bot npm init -y npm install discord.js Step 3 — The complete bot code const { Client , GatewayIntentBits , EmbedBuilder } = require ( " discord.js " ); const DISCORD_TOKEN = process . env . DISCORD_TOKEN ; const API_KEY = process . env . TACHIO_API_KEY ; const CHANNEL_ID = process . env . CHANNEL_ID ; const client = new Client ({ intents : [ GatewayIntentBits . Guilds , GatewayIntentBits . GuildMessages , ], }); async function fetchLiveMatches () { const res = await fetch ( " https://api.tachiosports.com/esports/live/cs2 " , { headers : { " x-api-key " : API_KEY } }, ); if ( ! res . ok ) return []; const data = await res . json (); return data . matches ?? []; } function buildEmbed ( match ) { const home = match . teams . home . name ?? " TBD " ; const away = match . teams . away . name ?? " TBD " ; const score = match . score ?. display ?? " vs " ; const map = match . current_map ?? "" ; const format = match . match_format ?? "" ; const league = match . league . name ?? "" ; const oddsHome = match . odds . match_winner . home ?? " – " ; const oddsAway = match . odds . match_winner . away ?? " – " ; return new EmbedBuilder () . setColor (

What We Know: The Basics of the Breach Polymarket, one of the largest prediction market platforms in the crypto space, confirmed on X that hackers stole funds from users after attackers compromised a third-party vendor. The breach allowed the attackers to inject malicious code directly into Polymarket's website, though the company specified the code ran "for some users" — a detail that raises immediate questions about whether the attack was deliberately targeted or only partially executed before detection. Polymarket spokesperson Connor Brandi confirmed to TechCrunch that the vendor compromise resulted in direct theft of user funds. Beyond that confirmation, the company declined to answer specific questions about the incident, leaving the scale of the financial damage, the identity of the compromised vendor, and the exact mechanism of the malicious code injection all officially unaddressed. The platform says it has contained the breach and is reaching out directly to affected users, committing to full refunds. No figure for total stolen funds has been disclosed. Blockchain monitoring firm PeckShield flagged suspicious activity around the same time Polymarket made its public announcement, adding an independent layer of confirmation that something significant moved on-chain during the incident window. What stands out immediately in the crypto security community is where the failure originated. The Polymarket platform itself was not the direct point of entry — a third-party vendor was. That distinction matters enormously. Users who trusted Polymarket's smart contract security and on-chain transparency had no visibility into the web infrastructure dependencies sitting between them and the prediction market interface. The malicious code injection attack, a technique that exploits trusted website supply chains, bypassed the decentralized architecture that crypto platforms often promote as a security feature. The incident joins a growing list of Web3 platform breaches wher

In the "Libre Barcode Project" discussion yesterday, 1bpp asked: "Is anyone willing to sacrifice their sanity for the sake of implementing a QR renderer as TTF hinting code?" Yes. I had some tokens to burn and was curious... turns out, it's possible. This was put together by a mix of Gemini, GPT, and Claude (depending on which usage limits kept running out).

Ship Faster with TanStack, Cost Less with Cloudflare Discussion | Link

Early in April I needed to print some tax forms at the library, first time in forever, and I began to wonder: what's the easiest way to get a file onto a public computer? There are many ways, but most of them involve creating an account somewhere or plugging in a thumb-drive. I use a password manager, so my passwords are long and complicated, not easily typed. I don't want to plug anything into a public computer, nor do I fancy uploading my taxes to some random website. I thought about what a he

Most multi-tenant email-agent setups give every customer the same caps. Your free-tier user who signed up an hour ago and your enterprise account doing thousands of sends a day hit the exact same daily send limit, the exact same storage ceiling, the exact same retention window. That's fine right up until a free trial account starts hammering your infrastructure, or an enterprise customer files a ticket because their agent stopped sending at noon UTC and nobody can explain why. Free-tier and enterprise tenants shouldn't share the same caps. They have different risk profiles, different contractual obligations, and different billing. The trick is to make the quota a property of the tier, not a property of each individual account — so when you provision a new tenant you don't compute limits, you just drop them into the right bucket and the limits come along for free. With Nylas Agent Accounts that bucket is a workspace , and the caps live on a policy you attach to it. Set up one policy per tier, attach each to its tier's workspace, and every Agent Account in that workspace inherits the policy's send, storage, and retention limits automatically. No per-account configuration, no drift. I work on the Nylas CLI, so the terminal commands below are the exact ones I reach for when I'm wiring this up. As always, I'll show both the raw HTTP call and the CLI equivalent for every step, because half of you live in scripts and the other half live in your app code. What you actually get An Agent Account is just a Nylas grant with a grant_id — a managed mailbox that can send and receive on a domain you've registered. Everything grant-scoped works against it: Messages, Drafts, Threads, Folders, the lot. There's nothing new to learn on the data plane. A policy is a reusable bundle of limits and spam settings. One policy can govern many accounts. The limits we care about for tiering are: limit_count_daily_email_sent — how many messages an account can send per day. limit_storage_total — t

Unit converters are everywhere online, but they all seem to either require an account, run ads that cover half the screen, or send your input to a server for no reason. I built one that runs entirely in your browser, with no dependencies, no tracking, and no round-trips. 👉 https://unit-converter-dev.pages.dev What It Does Seven conversion categories, 70+ units, real-time bidirectional conversion: Category Example units Length mm, cm, m, km, in, ft, yd, mi, nmi, light-year Weight mg, g, kg, t, oz, lb, st, short ton Temperature °C, °F, K, °R Volume ml, l, m³, fl oz, cup, pint, quart, gallon, tbsp, tsp Area mm², cm², m², km², ha, acre, ft², in², mi², yd² Speed m/s, km/h, mph, ft/s, knot, Mach Data bit, byte, KB/KiB, MB/MiB, GB/GiB, TB — both SI and binary Features: Bidirectional — type in either field, the other updates instantly Swap button — flip from/to with one click All-units panel — see your input converted to every unit in the category simultaneously Formula display — shows the conversion factor (e.g. "1 Mile = 1.609344 Kilometer") Zero dependencies — single HTML file, no build step, no npm Implementation Notes Linear vs. non-linear conversions Most unit conversions are linear: multiply by a factor to get to the base unit, divide by another factor to get to the target. The approach: function convert ( catKey , fromUnit , toUnit , value ) { const base = toBase ( catKey , fromUnit , value ); // → base unit return fromBase ( catKey , toUnit , base ); // base unit → target } function toBase ( catKey , unit , value ) { const u = CATEGORIES [ catKey ]. units [ unit ]; if ( u . toBase ) return u . toBase ( value ); // non-linear (temperature) return value * u . factor ; } Temperature is the classic non-linear case. You can't just multiply to convert between Celsius, Fahrenheit, and Kelvin — you need offset arithmetic: temperature : { units : { C : { toBase : v => v + 273.15 , // °C → K fromBase : v => v - 273.15 , // K → °C }, F : { toBase : v => ( v - 32 ) * 5 / 9 + 2

Middleware in PAGI A port of the sample app from What Is Middleware? — which builds the same three-layer stack in Plack/PSGI (Perl) and Starlette/ASGI (Python) — to PAGI , an async, ASGI-style application interface for Perl. The app is deliberately tiny but exercises the three things middleware exists to do: Logger — wrap the request, time it, log method/path in and status/duration out. Authenticator — inspect a header, inject context for downstream layers on success, or short-circuit with a 401 on failure. ProfileRouter — answer one specific route from inside the stack, reading the context the Authenticator injected. All code below was run under perl-5.40.0 with PAGI::Test::Client ; the log lines and responses shown in Running it are the actual captured output, not hand-written. The PAGI middleware contract A PAGI application is, in the spec's words, "a single coderef returning a Future": an async sub over the ($scope, $receive, $send) triple — the same shape as ASGI. $scope is the per-connection metadata hash ( type , method , path , headers , …), $receive pulls inbound events, $send pushes outbound ones ( http.response.start , then http.response.body ), and the Future it returns resolving is what tells the server the response is complete. Middleware is just as plain: a subroutine that takes an application and returns a new application, wrapping the inner one. That is the whole spec-level contract — app in, app out: sub middleware { my ( $app ) = @_ ; return async sub ($scope, $receive, $send) { # ... before ... await $app -> ( $scope , $receive , $send ); # call the inner app # ... after ... }; } A middleware propagates the inner app's Future — its completion and any exception flow straight through — and never reads its return value, which the spec defines as inert; to observe or rewrite the response it wraps $send instead, and to add per-request context it clones $scope (top-level edits stay visible downward only). PAGI::Middleware , from PAGI-Tools rather than

Figma shipped native Motion. A real animation timeline, right inside the file. When that landed, a lot of people emailed me some version of the same question: "is MotionKit dead now?" Fair question. My honest first reaction was a quiet "...maybe." But the more I used native Motion, the clearer it got — it's genuinely good, and it's not trying to be everything. No physics. No frame-by-frame. No Lottie export. No morphing. So the move was never to compete with it. The move was to bridge to it — let the two tools hand work back and forth, and let MotionKit be the power layer that does the stuff native Motion can't. So that's what this update is. A two-way bridge between MotionKit and Figma's native Motion. Here's everything it does, and exactly how to use it. The short version Four moves, one little control in the header: Import native Motion into MotionKit as real, editable keyframes Live sync (read-only by default) so changes in Figma Motion flow into MotionKit as you work Link for export so your native Motion renders inside a Lottie without duplicating anything Push MotionKit keyframes back into native Motion — including motion you baked from the physics engine And the headline trick: bake a real physics drop in MotionKit, then push it into Figma Motion as native keyframes. Native Motion has no physics engine. Now it kind of does. First, find the bridge Look at the top-right of the toolbar, next to the Pro star. There's a small badge: the MotionKit diamond, an arrow, and the Figma logo . That little arrow is the status. You don't have to open anything to read it: faint dotted line → not connected arrow pointing into MotionKit → reading from Figma, live, read-only arrows on both ends → two-way, MotionKit also writes back If there's native Motion sitting on the current frame but you haven't connected, you'll see a small purple dot on the Figma side — that's "hey, there's something here to import." Click the badge to open the bridge. That's the whole mental model. Dire

Introduction Speculative decoding is one of those techniques that has been "almost ready for production" for the better part of three years. A small draft model proposes tokens; a larger target model verifies them in a single forward pass. In theory, you get 2–4× throughput. In practice, the draft model has to be cheap, fast, and good enough at mimicking the target's distribution, which is a much harder combination than it sounds. Yesterday, a new paper from DeepSeek quietly climbed to the top of Hacker News (714+ points, 290+ comments at the time of writing). It's called DSpark , and it reframes speculative decoding in a way that looks like it could finally make the technique drop-in rather than bolt-on. The paper is here: github.com/deepseek-ai/DeepSpec/blob/main/DSpark_paper.pdf The Core Idea Instead of training a separate, smaller draft model from scratch (the classic approach), DSpark grafts the speculative head directly onto the target model. The intuition is simple: if the target model already knows which tokens are likely to follow, why not reuse its own intermediate representations rather than maintaining a parallel network? From the discussion on HN, this approach has a concrete architectural benefit — it reduces layer duplication that you'd otherwise have to maintain with a standalone draft model. In the DeepSeek experiments, the technique was applied on top of Step and Qwen 3.6 , which are themselves MTP-capable. How It Fits With MTP One of the more interesting practical points raised by HN commenters: DSpark is complementary to Multi-Token Prediction (MTP) , not a replacement for it. MTP — where the model predicts several future tokens at every step using auxiliary heads — has already been shown to give 50–100% speedups on hardware like the NVIDIA DGX Spark. DSpark adds another layer on top: even with MTP, the validation step is still a single forward pass through the main model, and the speculative tokens that get accepted come "for free." A useful men

Most job search tools focus on submitting more applications. I wanted to solve a different problem: reaching the people actually making hiring decisions. So I built PitchHired , an AI-powered platform that helps job seekers find hiring managers, generate personalized outreach emails, review them with AI, and send them from their own Gmail account on a business-hours schedule. The goal isn't to replace the job search, it's to remove repetitive work while keeping the candidate in control. I also chose a one-time credit model instead of monthly subscriptions because job seekers shouldn't have to keep paying while they're between opportunities. PitchHired is still evolving, and I'd genuinely appreciate feedback from fellow developers. What features would you want in a tool like this, and what would make you trust (or not trust) AI-assisted job search?

I started a gaming guide blog six weeks ago. Twenty-one articles later, it's getting traffic from Google, I have four affiliate programs set up, and I have never written a single line of code. This is not a "how to make money blogging" post. This is a practical breakdown of the tools, the workflow, and the mistakes I made so you can skip them. The blog is yxgonglue.com. It covers PC and console game guides — GTA VI pre-order comparisons, VPN setups for gaming, cloud gaming platform rankings, extraction shooter loot guides. Niche stuff. The kind of content people search for when they have a specific problem. Here is the stack that runs it. THE STACK WordPress + Kadence Theme Hosted on a standard shared hosting plan. Kadence is a free WordPress theme that loads fast and does not fight you. No page builder. No Elementor. Just the block editor and Kadence blocks for tables and formatting. The biggest lesson here: your theme does not matter as much as your content structure. Pick something lightweight. Stop theme-shopping. Start writing. Yoast SEO The free version. It gives you a red/yellow/green score for each post based on keyphrase density, subheading distribution, link count, and meta length. Is it perfect? No. Is it a useful checklist for someone who does not do SEO for a living? Absolutely. One thing Yoast taught me the hard way: Custom HTML blocks are invisible to the plugin. If you paste your article into a Custom HTML block, Yoast reads zero words, zero links, zero headings. Everything turns red. Use the regular editor. If you need a table, use a table block. Keep it simple. Google Search Console This is where you see what people actually searched before they clicked your article. The gap between what you think people search for and what they actually search for is enormous. Search Console closes that gap. Submit every new post URL manually. It takes ten seconds. Do not wait for Google to discover your site on its own. THE CONTENT WORKFLOW One Article Per Day Tw