A smart contract does not need an overflow, reentrancy bug, or broken access-control check to lose money. Sometimes, the exploit is hidden inside an ordinary division: uint256 result = amount * rate / SCALE; The expression looks harmless. It may even produce the expected answer in every unit test. But financial smart contracts operate with integer arithmetic. Fractions are discarded, rounding direction changes who receives value, and an error of one unit can be repeated across thousands of transactions. In a financial protocol, rounding is not merely a mathematical implementation detail. Rounding is a value-transfer policy. Every division should therefore answer three questions: Which direction does the calculation round? Which party benefits from that direction? Can the rounding advantage be repeated or amplified? This article examines the most dangerous precision problems in Solidity and the engineering patterns used to prevent them. Solidity Does Not Have Native Fixed-Point Arithmetic Most financial formulas use fractions: interest = principal × rate × time fee = amount × fee percentage shares = assets × total shares ÷ total assets collateral value = token amount × oracle price Solidity primarily performs these calculations with integers. For unsigned integers: uint256 result = 5 / 2; The result is: 2 The fractional component is discarded. For positive values, this behaves like rounding down: 2.5 → 2 This appears insignificant until the result represents: vault shares; debt; collateral; protocol fees; interest; rewards; liquidation bonuses; exchange rates; token prices. The lost fraction does not disappear economically. One party receives less value, while another party retains the remainder. Precision Loss Is Not Always Small Consider a protocol calculating a percentage: function calculateFee( uint256 amount, uint256 feeBps ) public pure returns (uint256) { return amount * feeBps / 10_000; } For a 0.3% fee: amount = 100 feeBps = 30 fee = 100 × 30 ÷ 10,000 fee =

In this article, we will explore how to implement an LSTM using PyTorch and Lightning . For more details about LSTMs, there is a separate series of articles available here . Imports To begin, we first import the required modules. import torch import torch.nn as nn import torch.nn.functional as F Introducing a New Optimizer We also introduce a new optimizer: from torch.optim import Adam Adam is used to fit the neural network to the data. It works similarly to SGD, but in practice, Adam often converges faster and adapts the learning rate more effectively. Lightning and Data Utilities Next, we continue with the remaining imports: import lightning as L from torch.utils.data import TensorDataset , DataLoader Defining the LSTM Model We define the neural network by creating a Lightning module. class LSTMByHand ( L . LightningModule ): def __init__ ( self ): # Create and initialize weight and bias tensors def lstm_unit ( self , input_value , long_memory , short_memory ): # LSTM computations def forward ( self , input ): # Forward pass through the unrolled LSTM def configure_optimizers ( self ): # Configure Adam optimizer def training_step ( self , batch , batch_idx ): # Compute loss and log training progress Initializing the Model Now let’s implement the __init__ method. This is where we initialize all weights and biases. class LSTMByHand ( L . LightningModule ): def __init__ ( self ): super (). __init__ () mean = torch . tensor ( 0.0 ) # Mean of the normal distribution std = torch . tensor ( 1.0 ) # Standard deviation # ------------------------- # Forget Gate (l = "lr") # ------------------------- self . wlr1 = nn . Parameter ( torch . normal ( mean = mean , std = std ), requires_grad = True ) self . wlr2 = nn . Parameter ( torch . normal ( mean = mean , std = std ), requires_grad = True ) self . blr1 = nn . Parameter ( torch . tensor ( 0.0 ), requires_grad = True ) # ------------------------- # Input Gate (p = "pr") # ------------------------- self . wpr1 = nn . Parameter

This is a submission for the June Solstice Game Jam What I Built The Imitation Game The Imitation Game is a real-time multiplayer social deduction game inspired by Alan Turing's famous Imitation Game the thought experiment that eventually became known as the Turing Test. Most people believe they can easily tell the difference between an AI and a human. They assume AI is too perfect, too logical, too fast, or too obvious. The Imitation Game challenges that assumption. Players enter a live chat room convinced they'll spot the machine within minutes. Then conversations begin, suspicions form, accusations fly, and certainty starts to disappear. Was that awkward response written by a human, or an AI trying to sound human? Was that emotional story genuine, or generated? Was the player who stayed silent suspicious, or simply distracted? By the end of a match, players often discover that identifying an AI is far harder than they expected. The real question isn't whether the machine can fool people. It's whether people are as good at detecting machines as they think they are. Instead of a single human interrogating a machine, players are placed into a live chat room with other participants and asked a simple question: Can you identify which player is actually an AI? Hidden among the players is a Quanbit , a rogue artificial intelligence from the year 3026 . Its mission is simple: blend in, appear human, avoid suspicion, and survive. The challenge for human players is equally simple, but far more difficult in practice. They must carefully analyze conversations, voting patterns, response timing, and social behavior to determine who among them is secretly the machine. The game currently features two distinct modes, each designed around a different style of deception. Eyefold Eyefold is the purest form of the game's Turing Test experience. Players enter a room where one participant is secretly a Quanbit. Conversations unfold naturally, and everyone is free to discuss any topic.

nvidia-peermem "Invalid argument" on Ubuntu — Fix GPUDirect RDMA with DMA-BUF TL;DR: If modprobe nvidia-peermem fails with Invalid argument ( -EINVAL ) on a system using the inbox Ubuntu InfiniBand stack ( rdma-core ), the module is not broken and you do not need it. nvidia-peermem requires an API that only exists in MLNX_OFED. On Hopper/Blackwell GPUs with the NVIDIA open driver, use DMA-BUF instead — it does GPUDirect RDMA natively. The one gotcha: you must enable nvidia-drm modeset=1 . Applies to: Ubuntu 22.04 / 24.04, inbox rdma-core stack, NVIDIA open kernel driver, H100 / H200 / B200, ConnectX-6/7 (or any HCA with ODP support). The symptom $ sudo modprobe nvidia-peermem modprobe: ERROR: could not insert 'nvidia_peermem' : Invalid argument dmesg shows nvidia-peermem loaded but registered nothing, or the load returns -EINVAL . GPUDirect RDMA appears to be unavailable. Why this happens (and why it is not a bug) nvidia-peermem is the legacy path for GPUDirect RDMA. It registers GPU memory with the InfiniBand subsystem through a Mellanox-proprietary kernel API: ib_register_peer_memory_client () That symbol only exists in MLNX_OFED's build of ib_core . It is not in the mainline kernel, and it is not in rdma-core , which is the inbox InfiniBand stack on Ubuntu. If you are on the inbox stack, nvidia-peermem was compiled without that API present, so it can never bind and always returns Invalid argument . No module parameter or config change will fix it, because the thing it needs was never there. Do not install MLNX_OFED just to make nvidia-peermem load. That works, but it is the wrong fix — you would be adding a heavy proprietary stack to revive an obsolete module. There is a native path already in your kernel. The fix: use DMA-BUF On Hopper and newer with the open driver, GPUDirect RDMA works through DMA-BUF , a mainline Linux framework. No external module, no MLNX_OFED. Requirements (check these first) NVIDIA open kernel driver (not the proprietary build) nvidia-drm

We’ve all been there: running a dependency audit, seeing a tool report 100 "unused" files, and realizing with horror that half of those files are actually critical architectural hubs. Static analysis tools in the JavaScript ecosystem are historically built to be "safe"—they flag anything they cannot explicitly trace. But in a complex monorepo with circular dependencies, alias-heavy build tools like Vite, and custom workspace configurations, these tools often collapse. They stop auditing and start "pruning"—treating your architecture as a pile of junk to be deleted. Most tools rely on simple pattern matching or basic Abstract Syntax Tree (AST) walks. They struggle to build a true Control Flow Graph (CFG) or identify Strongly Connected Components (SCCs). When an engine encounters a cycle in a monorepo, it doesn't see a complex architectural component; it sees a disconnected node, labels it "orphaned," and suggests a deletion plan that would effectively brick your build. To audit an architecture correctly, you need to move beyond simple string resolution. You need deep AST and CFG parsing, utilizing high-performance parsers (like OXC) to map actual execution paths. You also need SCC analysis to detect circular dependency chains across package boundaries, coupled with worker-pool parallelization, because auditing 10,000 files in a monorepo shouldn't block the main process. By leveraging these core concepts, I developed entkapp to validate the structural integrity of a workspace. Consider this audit log from an intentionally broken repository: [Linker-DEBUG] Attempting to resolve package-a ... Resolved to: C:/.../package-a/index.js 🔄 Detecting circular dependencies... ⚠️ Detected 1 circular dependencies: Cycle #1: packages/package-a/index.js -> packages/package-a/index.js Here, the engine is forced to acknowledge the structural reality, not just the file list. It validates the boundary, identifies the cycle, and reports the smell without blindly nuking the project. The g

This article covers what I learned or maybe didn't really learn. The Problem With Traditional HTTP Most web applications use HTTP. The flow looks like this: Client → Request → Server Client ← Response ← Server Once the server sends the response, the connection is closed. This works perfectly for: Authentication CRUD operations Fetching data Form submissions But what happens when the server needs to send information without being asked? For example: A new task is assigned Someone comments on a task A project status changes A teammate updates a board With traditional HTTP, the browser would need to keep asking: "Anything new?" "Anything new?" "Anything new?" This technique is called polling, and it's inefficient. That's where Socket.io comes in. What Socket.io Actually Does Socket.io creates a persistent connection between the client and server. Instead of repeatedly opening and closing connections, the connection stays alive. Now communication becomes two-way: Client ↔ Server The client can send data whenever it wants. The server can also send data whenever it wants. This is what makes real-time applications possible. Why Express Alone Isn't Enough One thing that confused me initially was why Socket.io couldn't simply be attached directly to my Express app. The answer lies in how Express works. When you write: app . listen ( 5000 ); Express creates the HTTP server internally. You don't have direct access to it. Socket.io, however, needs access to the raw HTTP server. So instead of: app . listen ( PORT ); The flow becomes: const httpServer = createServer ( app ); Then Socket.io attaches to that server: const io = new Server ( httpServer ); Finally: httpServer . listen ( PORT ); This architecture allows Socket.io and Express to share the same server. Understanding Events Socket.io is event-driven. Everything revolves around two methods: socket . emit () and socket . on () Think of them as: emit = send on = listen For example: Client: socket . emit ( " join-project " ,

I've been growing my open source portfolio one contribution at a time, and this week I landed on something genuinely interesting in livekit/agents (11k+ stars, the framework behind a ton of real-time voice AI agents). The bug If you're building a voice agent on a realtime model (OpenAI Realtime, xAI, Gemini Live), the model streams your transcription back in chunks. A single utterance can fire many user_input_transcribed events before it's final — token by token for OpenAI/xAI, or as one big interim blob for Gemini. If you want to react exactly once per utterance (say, show a "user is typing" indicator on your frontend via RPC), you need a stable key to correlate all those interim events together. That key already existed internally — InputTranscriptionCompleted carries an item_id . But when the framework re-emitted it upward as the public UserInputTranscribedEvent , the item_id was silently dropped — leaving consumers with no reliable way to dedupe across providers. The fix Small once you see it: add the field, forward it. class UserInputTranscribedEvent ( BaseModel ): transcript : str is_final : bool item_id : str | None = None # new ... def _on_input_audio_transcription_completed ( self , ev : llm . InputTranscriptionCompleted ) -> None : self . _session . _user_input_transcribed ( UserInputTranscribedEvent ( transcript = ev . transcript , is_final = ev . is_final , item_id = ev . item_id ) ) Two files, about 10 lines of real change. The actual work was tracing the event from the realtime model layer, through AgentActivity , up to AgentSession , to find exactly where the field got swallowed. The takeaway I didn't need to understand all of livekit-agents to land this — just one event's lifecycle, end to end. Small, well-scoped issues are the most achievable way into a big codebase, especially when someone's already mapped the territory in the issue itself. PR is up, CI green, waiting on review: github.com/livekit/agents/pull/6172

I expected bcrypt to silently drop characters past 72. I did not expect it to bake in half an emoji. That's what happens with a specific password combination I tested. The original password still works. But strip the emoji (a password manager, a different keyboard, a Unicode normalizer) and you're locked out. Your Laravel validator passed it as valid the whole time. The 72-Byte Rule bcrypt has a hard input limit of 72 bytes. Not characters - bytes. When you call password_hash($password, PASSWORD_BCRYPT) , PHP silently truncates anything past byte 72. Most developers know this in theory. But for ASCII-only apps, it never bites. 72 ASCII characters is already a very long password, and the silent clip is harmless in practice. The trouble starts with multi-byte scripts. How Many Characters Fit? Character set Bytes per char Effective bcrypt limit ASCII 1 72 chars Cyrillic 2 36 chars CJK (Chinese, Japanese, Korean, common block) 3 24 chars Emoji 4 18 chars Past the byte limit, a longer password adds no security at all. A 200-character Cyrillic password hashes identically to its own first 36 characters. Byte 73 and beyond simply do not exist from bcrypt's point of view. So "longer always produces a stronger bcrypt hash" is not true. A Cyrillic user with a 37-character password gets silently truncated at char 36. The hash is still consistent. The user logs in fine, but any variation past character 36 doesn't matter to bcrypt. Annoying from a security standpoint, but it does not break login. The Split-Byte Trap The 72-byte limit cuts at a byte boundary, not a character boundary. If a multi-byte character falls on that cut, bcrypt bakes in an incomplete UTF-8 sequence. // 35 Cyrillic chars = 70 bytes, emoji = 4 bytes, total = 74 bytes $password = str_repeat ( 'А' , 35 ) . '🔑' ; $hash = password_hash ( $password , PASSWORD_BCRYPT ); password_verify ( $password , $hash ); // ? password_verify ( str_repeat ( 'А' , 35 ), $hash ); // ? password_verify ( str_repeat ( 'А' , 36 ), $h

Hope it helps anyone documenting or reviewing API specs. submitted by /u/AntonOkolelov [link] [留言]

At least three coal plants have been repeatedly cited for violating environmental regulations.

Hi HN, I think it's safe to say that the majority of developers don't give a second thought to writing code with I/O tangled in business logic. It's all too common to see code like: const user = findUser(email); if (!user) await saveUser(user); Now, you may ask: what's the big deal? When we write code like this, two things happen: 1. It gets harder to debug production bugs. Unless you have the exact same database and remote API services to connect to, you may fail to reproduce the bug. 2. You ha

Cold Court is a brother-sister duo from Philly that seems to love nothing more than shoving all of their influences together in a messy soup that at least superficially resembles the hyperpop you've come to expect from acts like 100 Gecs. But, where songs like "Dumbest Girl Alive" goofily wink at pop punk and emo, […]

Article URL: https://www.ycombinator.com/companies/wildcard/jobs/SEmo4di-founding-applied-ml-engineer Comments URL: https://news.ycombinator.com/item?id=48620504 Points: 0 # Comments: 0

My shortened story: due to factors in Soviet controlled Poland, my uncle played my dad role. He took me to a quarry to fire Estes-style rocket cars, and all that.. he also managed to steal a Milicja (military police) siren from work, and put it on the back of my banana style bike. As an EE, he made it actually function. Thanks to all the hackers who made us who we are.

Anthropic recently reported that Claude now handles around 95% of its internal analytics requests, letting employees query business data independently instead of relying on data teams. The company attributes this result less to advances in models and more to data governance, semantic definitions, and operational discipline. By Renato Losio