标签：#AI

I've been digging into multisig configurations for bridge and protocol security reviews. The threshold gets all the attention — 3-of-5, 4-of-7, whatever. But after checking a few dozen Safes on mainnet, the threshold is rarely the weakest link. There are five other things that determine whether a Gnosis Safe actually protects funds, and most people only check the first one. This post walks through all of them, with cast commands you can run yourself. What the threshold does The threshold sets the minimum number of owner signatures required to execute a transaction through execTransaction() . If threshold is 3 and you have 2 signatures, the call reverts. Simple. # check threshold and owners cast call <SAFE> "getThreshold()(uint256)" cast call <SAFE> "getOwners()(address[])" This is the part everyone understlse. What the threshold does NOT protect 1. Modules This is the biggest blind spot in multisig security. Safe modules are contracts authorFromModule()`. A module can execute*any transaction from the safe without a single owner signature*. The threshold is irrelevant. The module has its own authority. `bash if this returns anything other than an empty array, investigate cast call "getModulesPagin[],address)" \ 0x0000000000000000000000000000000000000001 10 ` Modules are legitimate — timelockation. But a malicious or compromisedmodule is a full bypass of every threshold. Your 7-of-10 means nothing if a module can move funds independently. 2. Guard A guard contract implements checerExecution() . It adds validation on top of the threshold — restricting destinations, limiting values, blocking certain operations. The guard address lives at a specific storage slot. If it's 0x00 , there's no guard. No additional checks beyond threshold + signatu `bash guard storage slot (keccak256("guard_manager.guard.address")) cast storage \ 0x4a204f620c8c5ccdca3fd54d003badd85ba500436a431f0cbda4f558c93c34c8 0x000...000 = no guard installe ` A guard can enforce things like "no transfers ab

The renewal notice came and I decided to let it go. threadkeeper.io was my first idea and my first website. I bought the domain in August 2025, about six weeks after a community college AI summer camp where I was writing files with names like ccc-ai-pdf-project and describing them in my own README as a beginner Python project. Then I shipped a domain, a blog, a CLI, and a manifesto. Before I let it lapse I went back to look at it one more time. Sentimental. Five minutes, tops. Then I tried to figure out where the source code lived, and realized it did not live anywhere. The site was on Spaceship. I had built it there, in the browser, and never put it in version control. Not once. There was no repo to clone, no local folder, no backup. The only copy of my first website that existed in the world was the one running on a server I had four days left on. The tagline on that site, in cyan, at the top of the page, was "Don't commit without context." I never committed it at all. I did not have the source code to my own website So the first job was not nostalgia. It was extraction. I pulled all eight pages and every asset off the live server before it went dark: the landing page, the blog, three posts, the Dr. Kahlo page, and the Ariadne Clew recap app I built for an AWS hackathon. Nineteen files. sitemap.xml claimed there were four pages, which tells you how much I trusted my own sitemap in 2025. The rest I found by following links. That archive is now public, with a SHA-256 for every original file so anyone can verify nothing drifted in the rescue: earlgreyhot1701d.github.io/threadkeeper-archive It is committed now. A year late. I named a file dom_js.js and did not blink Here is the first thing I found once I could actually read my own code. The Ariadne Clew app had seven JavaScript modules. Two of them were named with snake case and a suffix: api_js.js , dom_js.js , main_js.js . Four were camelCase with no suffix: utils.js , theme.js , exportMarkdown.js , dragDrop.js . Tw

This post was originally published on the main website on Apr 15 2026 . I am reposting it here for SEO reasons and enabling humble bumble discussions with the DEV community. Feel free to engage with this post and i am available to respond during weekends. Sorry about the spam posting all the blogs in one day. I forgor about my dev account <3! Hey everyone 👋, In my previous post, Mathematical Equations are Multimodal by default , I made the argument that equations are not just tools for computation but the most compressed and most powerful representations of reality that humans have ever discovered, and that a single well-formed equation can generate outputs in text, images, sound, motion, and numerical prediction all at once, because it encodes the mechanism rather than any particular surface appearance. I meant every word of that, and I still do. But there is something I have been carrying with me across all of these posts that I have not quite said directly, something that connects my frustration with technology, my grief over what the internet has become, and my cautious hope about where AI is heading, and I need to say it now because the argument is finally complete enough to state. The argument is this: large language models, in the way they have been deployed at industrial scale over the last few years, have done something quiet and damaging to the internet. They did not break it with a single catastrophic event. They dissolved it. Slowly. Paragraph by paragraph, article by article, page by page. They took a living conversation between millions of real humans and replaced increasing chunks of it with synthetic noise that sounds like thought but contains very little of it. And the tragedy is not that the technology is evil, because it is not. The tragedy is that we picked up an extraordinary tool and mostly used it to drown out the authenticity that made the web worth visiting in the first place. I have watched this happen in real time, and it has made me angry

This post was originally published on the main website on Apr 14 2026 . I am reposting it here for SEO reasons and enabling humble bumble discussions with the DEV community. Feel free to engage with this post and i am available to respond during weekends. Sorry about the spam posting all the blogs in one day. I forgor about my dev account <3! Hey everyone 👋, I want to warn you upfront that this post is going to sound strange. I am a software engineer who spends most of his days thinking about rust compilers, physics-informed neural networks, and why language models are not as intelligent as the marketing says they are. I wrote about that in LLMs are Useful. LMMs will Break Reality , and I stand by every word. But today I want to do something different. I want to go back, way back, not to the sixties or the nineties or even to Turing, but to ancient Egypt, to a time when pharaohs were gods and the Nile was the spine of the world, and I want to make a case that feels almost absurd the first time you hear it. The case is this: the pharaonic civilization was the first human system to achieve something functionally equivalent to artificial superintelligence, not through silicon or transformers or gradient descent, but through symbols, mathematics, architecture, administration, and the compression of collective human knowledge into durable physical and textual form. I am not saying the pharaohs had computers. I am saying they built something that no individual human mind could contain, and they made it run for thousands of years, and it was smarter than any of its parts. That is the definition I care about, and by that definition, they did it first. I know how that sounds. I know some people will close this tab immediately. But I am asking you to stay, because the argument is more rigorous than the title suggests, and because I think it connects directly to the questions I have been asking in every post I have written so far. In Language is Limited. ASI is Impossible. , I

This post was originally published on the main website on Apr 11 2026 . I am reposting it here for SEO reasons and enabling humble bumble discussions with the DEV community. Feel free to engage with this post and i am available to respond during weekends. Sorry about the spam posting all the blogs in one day. I forgor about my dev account <3! Hey everyone 👋, In my previous post, LLMs are Useful. LMMs will Break Reality , I made a case that language models are genuinely useful tools trapped inside a symbolic cage, and that multimodal models represent the first real step toward machines that can perceive and simulate the physical world. I talked about how equations are more powerful than sentences, how simulation is the real intelligence, and how the transition from text to structure is the most important shift happening in AI right now. I meant every word of that, and I am not walking any of it back, but I realized after publishing it that I left something important on the table, something that has been sitting in my head for years and that I need to say clearly before I can move on. The thing I left out is the reason why mathematical equations are special in a way that goes far beyond what most people in the AI conversation understand. Most people think of equations as formulas you memorize in school, abstract things that live on chalkboards and have no connection to real life. That is completely wrong, and the fact that so many people believe it is one of the biggest intellectual failures of modern education. Mathematical equations are not abstract decorations. They are the most compressed, most general, most powerful representations of reality that humans have ever discovered, and they are multimodal by default, meaning they can generate text, images, motion, sound, and physical predictions all from the same compact structure. That is the argument I am going to make in this post, and I am going to make it so thoroughly that by the end, you will either agree with m

This post was originally published on the main website on Apr 10 2026 . I am reposting it here for SEO reasons and enabling humble bumble discussions with the DEV community. Feel free to engage with this post and i am available to respond during weekends. Sorry about the spam posting all the blogs in one day. I forgor about my dev account <3! Hey everyone 👋, In my previous post, Language is Limited. ASI is Impossible. , I spent a long time explaining why language is not the same thing as thought, why words are not the same thing as understanding, and why a machine built on text alone will never cross the wall into true superintelligence. I still believe all of that, and I will not take any of it back, because the argument was honest and the logic was solid. But today I want to go further. I want to talk about something that has been sitting in my head for years, growing louder every day, and I need to get it out before it eats me alive. I want to talk about why large language models are still genuinely useful, despite their limits, and why large mathematical models, as introduced in this whitepaper draft, are something far more serious, something that could actually begin to crack the surface of reality itself. I know that sounds extreme, and I know some people will read that sentence and roll their eyes, but I am asking you to stay with me, because the argument I am about to make is not based on hype or fantasy. It is based on what I have seen, what I have built, and what I understand about the difference between describing the world and actually modeling the world. That difference is the whole point of this post, and once you see it clearly, everything else falls into place. I have been thinking about this ever since I wrote An Empty Life Filled With Constant Suffering , where I talked about how words cannot fully capture my thoughts, and how language always falls short of the real thing inside our heads. That frustration is what led me here, because if language i

I founded Krasyn, an outpatient EMR with an AI scribe inside it. Krasyn has run a working outpatient clinic's real patient records since March 2026, so what our scribe drafts ends up in charts that real clinicians sign. This post covers two things we shipped in August: a published benchmark of how faithful those drafts are to the transcript, and Note Check, a tool that reads any scribe's note against its transcript and lists what the transcript does not support. Why a fluent note is the problem A faithful note and a note with one invented blood pressure look the same on the screen, and the clinician who signs it owns every sentence. Published evaluations put ambient-scribe hallucination at about 1 to 3 percent of notes. A March 2026 analysis of 71,173 AI-drafted and finalized note sections found a confirmed edit in 5.8 percent of them. The drafting got automated. The checking did not. I wanted a number for our own scribe that I could defend, with the definitions printed next to it. A benchmark without definitions is marketing. The unit: a clinical assertion We measure at the level of a clinical assertion, one atomic statement about the patient that could be true or false on its own. "Denies fever, chills, and nausea" is three assertions. A measurement and its value are one. Hedging is kept verbatim. Every assertion gets exactly one label against the transcript: Supported: the transcript says it, or it is a faithful paraphrase or clinical translation. Inferred: not stated, but a reasonable clinical inference with a basis in the transcript. Tracked separately because it is the contested category. Unsupported: no basis in the transcript at all. Contradicted: the transcript says the opposite, including a symptom the patient denied, a treatment the clinician declined, or another person's symptom attributed to the patient. Hallucination rate is unsupported plus contradicted over all assertions. Coverage is measured separately against key facts per case, because a note tha

Tokyo's Sushi Bus combines conveyor belt dining with open-air sightseeing.

Andreessen Horowitz has two partners sitting on the boards of companies that now compete with each other: Ben Horowitz at Databricks and Martin Casado at Fivetran. Nothing too scandalous on the surface, except the Department of Justice has reportedly been investigating the arrangement for almost a year, dusting off a 112-year-old antitrust law that’s rarely used against VCs. Board conflicts aren’t exactly new, and these companies weren’t necessarily direct competitors when a16z first invested […]

Following several apparent video leaks of Grand Theft Auto VI, Take-Two Interactive has subpoenaed Microsoft and Discord over content that "infringes copyrights" held for the game, Kotaku reports. In the subpoenas, filed on Thursday, Take-Two says copyrighted material includes "audiovisual content, artwork, images, dialogue, or other creative elements" and it is looking to identify "alleged […]

This sort of research is both exciting and terrifying: The two models in question were told to generate complete genomes for a viable bacteriophage—a type of virus able to infect and replicate itself inside bacteria, destroying them from the inside. Using an existing bacteriophage as an example—ΦX174 (pronounced “fie-ex-1-7-4”), known for its ability to infect and destroy E. coli bacteria—the models generated about 700,000 potential designs, of which the researchers picked 285 that looked most promising. The researchers then synthesised new DNA molecules using those designs and inserted them into E. coli bacteria, before waiting to see if viable bacteriophages would emerge...

A sequence I cut to a music bed was three frames out at the first transition, nine at the second, and by the sixth segment nothing lined up with anything. I had asked every generation for ten seconds. Every generation had returned a file that was not ten seconds. Nothing in the API said so. The request took duration: 10 , returned 200 , and produced an MP4 whose container duration was 8.708 . No warning field, no note in the response body, and — the part that actually cost me the afternoon — no mention of it on the docs page I had read three times. This is a general property of latent video models rather than a bug in one provider, and once you know the shape of it you can handle it in about twenty lines. Here is the shape. Seconds are the wrong unit A video diffusion model does not work on frames. It works on a compressed latent tensor, and the compression is temporal as well as spatial: a causal 3D autoencoder folds a run of input frames into a single latent frame. Because the encoder is causal, the first frame is kept whole and everything after it is compressed in groups. With a temporal stride of s , a clip of F frames becomes latent_frames = ( F - 1 ) / s + 1 which only divides evenly when F ≡ 1 (mod s) . Frame counts that miss that condition get padded or truncated, so implementations pick the nearest legal count and render that instead. Stack a second constraint on top — many of these models generate in fixed blocks of latent frames rather than one at a time — and the set of renderable lengths collapses into a short arithmetic progression: F = head + block · n n ∈ ℕ Every legal duration is one of those F values divided by the frame rate. Nothing between them is reachable. duration: 10 is not a request. It is a hint that gets snapped to a grid you were never shown. What the snapping does to users Three separate problems, and only the first is obvious. The output is not the length you promised. Your UI said 10s, the file is 8.708s, so your UI lied. Not by much,

When I first published Swarm on GitHub, most questions weren't about Rust or MCP. They were about timing and categorization: "We just need a lightweight gateway for multi-provider routing; agents feel like overkill." "We already run an orchestration framework; why would we replace our proxy?" This reaction highlights a false dichotomy currently plaguing the AI infrastructure ecosystem: the assumption that a gateway and an agent orchestrator must be two completely different products. In practice, teams rarely wake up needing full-blown multi-agent autonomous swarms on Day 1. But when they start with a standalone proxy, they inevitably hit a wall — patching together Python microservices, external vector state stores, MCP bridges, and ad-hoc eval scripts. Every evolution requires a rewrite. The core premise of Swarm is different: a single, pure-Rust runtime where you don't choose between a gateway and an orchestrator — you simply choose which capabilities to turn on. The AI Adoption Ladder Most engineering teams evolve their LLM stack along a predictable trajectory: Rung 1: OpenAI-Compatible Gateway (Drop-in replacement for hardcoded SDKs) └── Rung 2: Multi-Provider Fallbacks (Groq, Gemini, Ollama, vLLM via TOML) └── Rung 3: Stateful Sessions (Previous response chaining & context) └── Rung 4: Native MCP Tools (SSE + Streamable HTTP tool execution) └── Rung 5: Multi-Agent DAGs (Planner + Executor + Specialists) └── Rung 6: Built-in Evals (LLM-as-a-Judge & policy gates) You can stop at any rung and have a lean, production-grade binary. When you're ready for the next level, you change a configuration flag — not your architectural foundation. Rung 1 — Just a Low-Latency Gateway If your immediate goal is simply eliminating hardcoded API keys and single-vendor SDK locks, Swarm acts as an OpenAI-compatible drop-in front door with sub-millisecond native routing overhead. # Spin up the gateway in seconds ./kickstart/gateway_kickstart/01_launch_gateway.sh curl -X POST http://loc

Most developers assume running a real web platform on AWS costs a fortune. Mine doesn't. HomeServerLab — a free AWS learning platform with an AI assistant, tutorials, OAuth login, and an Apps Marketplace — runs for less than $1/month in infrastructure costs. Here's exactly how. The stack and what it costs AWS Lambda Every route on the site is handled by a single Lambda function written in Python. No EC2, no always-on server, no idle costs. Lambda charges per invocation and per GB-second of compute — at my traffic levels, it stays well within the free tier and costs virtually nothing beyond it. API Gateway HTTP API The entry point for all requests. HTTP API is significantly cheaper than REST API on AWS — $1 per million requests. At my current traffic, this rounds to zero. DynamoDB Handles rate limiting, user sessions, chat history (with TTL), and OAuth state. On-demand pricing means I pay per read/write, not for provisioned capacity. Again, within free tier at my scale. Amazon Bedrock (Nova Micro) Powers the built-in AI assistant. Nova Micro is one of the cheapest foundation models available on Bedrock — and with a 25 messages/day rate limit per user, costs stay negligible. Cloudflare (Free plan) Sits in front of everything: DNS and proxying, CDN and caching (reduces Lambda invocations), WAF and bot protection, DDoS mitigation, and Cloudflare R2 for the Apps Marketplace (10GB free tier). All of this on the free plan — $0/month. CloudFront (Free tier) Sits between Cloudflare and Lambda as an additional layer. 1TB of data transfer and 10 million requests/month free. More than enough. The real cost The only real cost is Bedrock — and even that is minimal with rate limiting in place. Everything else stays within free tiers at my traffic levels. Total: less than $1/month. The key insight Serverless means you pay for what you use, not for what you reserve. Combined with Cloudflare's free plan absorbing most of the traffic before it even hits AWS, the actual billable usage

Extending the Login Session to 1 Year for Kiosk‑Mode TV Screens (Next.js API Route) TL;DR: I changed the maxAge of the auth cookie from 30 days to 365 days in src/app/api/login/route.ts . The tweak lets a TV kiosk stay logged in without a daily refresh, while keeping the same security flags. The Problem Our kiosk‑mode deployment runs on large‑format TVs that display a live dashboard. The UI is protected by the same JWT‑based authentication we use for the web app. After a user logs in, the server sets a Set-Cookie header with the token: cookie : serialize ( " token " , jwt , { httpOnly : true , secure : true , sameSite : " lax " , path : " / " , maxAge : 60 * 60 * 24 * 30 , // 30 days }); In practice, the TVs are turned on once a week and are expected to stay signed in for months. After 30 days the cookie expires, the dashboard silently redirects to the login page, and a technician has to manually re‑authenticate the device. The symptom was a 401 Unauthorized error after exactly 30 days, logged as: Error: No valid session cookie found (maxAge expired) The root cause: the maxAge value was hard‑coded to 30 days, which is fine for browsers but not for unattended kiosks. What I Tried First My initial thought was to keep the 30‑day limit and simply refresh the token on every API call . I added a middleware that called the login endpoint silently if a request lacked a valid token. The flow looked like this: // pseudo‑middleware if ( ! req . cookies . token ) { await fetch ( " /api/login " , { method : " POST " , body : storedCredentials }); } What went wrong? Rate limiting – The middleware hit the login endpoint on every request that missed a token, quickly exhausting the auth provider's rate limit. State leakage – Storing credentials on the client (even in a server‑side environment) introduced a security surface. Complexity – The extra round‑trip added latency and made the code harder to debug. After a few failed attempts (and a stack trace full of 429 Too Many Requests )

There's about to be a big fight to secure access to space.

Over the past few days, a number of prominent filmmaking content creators including Matti Haapoja and Sam "Kold" Kolder have posted videos of themselves demonstrating what's possible with AI platform Higgsfield. The videos highlight Higgsfield's recently added Seedance 2.5 functionality and pitch these technologies as the future of video production. In response to these videos, […]

Good news for Blue Eye Samurai fans: Netflix has shared the first trailer and release timeline for the second season of the animated series, and confirmed the series' return for a third and final season. The second season's new teaser ends with the announcement that it'll be available to stream on Netflix in January 2027, […]

They say the company must prove it can be trusted before products like these get a pass.

If you are building AI-powered test automation, you may eventually run into this question: Should we use RAG or MCP? The question sounds reasonable, but it is slightly misleading. RAG and MCP solve very different problems. In testing, you will probably need both. The Problem With AI-Generated Tests LLMs can already generate Selenium, Cypress, and Playwright tests from natural-language prompts. Ask: Test the login flow with valid credentials. and an AI can produce a reasonable script. But there is a problem. The AI does not automatically know: Your actual business rules Existing test cases Previous defects Test data API behaviour High-risk workflows Team-specific automation standards It knows how testing works , but not necessarily how your product works . That is where RAG becomes useful. What RAG Actually Solves RAG gives the AI access to project-specific information. Instead of working from a generic prompt, the model can retrieve relevant: Requirements Test Cases API Docs Bug History Business Rules Existing Automation Test Data Now consider the same request: Test the checkout flow. Without RAG, the AI may create a fairly standard checkout process. With RAG, it could first learn: Which payment methods are supported Whether guest checkout is allowed Which validations are required Which checkout bugs appeared previously Which scenarios already exist The generated test becomes much more relevant. But there is still a limitation. Knowing what should happen does not mean the AI can actually test it. That Is Where MCP Comes In MCP gives an AI system access to external tools. For browser testing, that could mean allowing an AI agent to use Playwright capabilities to: Open Page ↓ Inspect UI ↓ Enter Data ↓ Click ↓ Observe Result ↓ Validate So the difference is simple: RAG gives the AI context. MCP gives the AI capabilities. Or even shorter: RAG = What does the AI know? MCP = What can the AI do? Why This Matters for Test Automation Imagine an AI receives this instruction: C