标签：#AR

Real integration notes for wiring NIFTY ML models to live broker data via Dhan. Research/ paper-trading context — not a live-trading recommendation. Why Dhan Dhan's API exposes direct option-chain access — exactly what an options-ML system needs: POST /optionchain — full chain for an underlying POST /optionchain/expirylist — available expiries Fields: security_id , last_price , volume , oi , previous_oi , implied_volatility , top_bid_price , top_ask_price , and greeks (delta/theta/gamma/vega) Security IDs are stable: NIFTY = 13 (IDX_I) , BANKNIFTY = 10001 (IDX_I) . The Pipeline Shape A research dashboard pulls live chain + underlying, runs the trained XGBoost model on each new 15-minute bar, and displays: side score (CE/PE alignment) gate state (entry ready / blocked) contract quality scores a doctrine/backtest report Keep the inference path separate from the execution path . The dashboard shows; a permissioned, human-approved module places orders. Paper Trade First The DhanLiveTrader pattern: load the model, predict on each new bar, place long orders with configurable SL/TP (default 1.0 ATR SL, 2.0 ATR TP), and run in paper mode first . Only after stable out-of-sample + paper evidence should any execution module even be considered. { "client_id" : "YOUR_DHAN_CLIENT_ID" , "access_token" : "YOUR_DHAN_ACCESS_TOKEN" , "is_paper_trade" : true , "nifty_symbol" : "NIFTY" , "quantity" : 50 , "max_trades_per_day" : 3 , "sl_atr_mult" : 1.0 , "tp_atr_mult" : 2.0 } The Hard Part: Stops A known footgun: using a Stop-Loss Limit (SL-L) order with price = sl − 0.05 means it won't fill if price crashes through the stop. Prefer SL-Market for the protective stop. Execution quality is its own research topic — don't bolt it on at the end. Honest Status The ML side of this stack showed real directional skill (60.5% top-decile accuracy) but the fixed-SL backtest was still unprofitable (PF 0.53). A dashboard that displays an honest "RESEARCH / PAPER" status is worth more than one that hid

Lessons from a real rebuild of an options-buyer prediction system. No profit claims — just the architecture that fixes the chronic bugs of V1. The Core Mistake in V1 V1 asked one XGBoost model one big fuzzy question: "CE ya PE?" — directly from raw CE/PE premium data. Premium is a transformed signal (underlying move × delta × gamma × IV × theta × spread × strike distance × liquidity). The model learned noise as much as signal. Concrete evidence from the research logs: Balanced accuracy stuck at 51–61% for months — hyperparameters were never tuned ( lr=0.02, depth=3 defaults used throughout; Optuna existed but was never run). A partition bug ( iv_change_1d shift inside single-row groups) silently zeroed a whole feature for the entire history. A rollup config flag compressed 15-minute bars into 1 row/day, destroying 760× of training volume (387 sequences instead of 295K+). Live paper trading: 31.6% win rate, −₹90.3k PnL , entry confidences only 55–64%. V2 Principle: Split the Question underlying mechanics --> side, range, ETA, invalidation option chain scanner --> is the buyer contract worth paying for? XGBoost (many heads) --> thin calibrated learner on clean mechanics Rule: underlying decides side; option contract decides execution eligibility. CE/PE premium is validated against, never learned as, direction. Many Shallow Heads, Not One Deep Model Instead of one CE/PE answer, V2 trains separate narrow heads: underlying_up/down_touch_{15,30,60}m ce_1p3x / ce_1p5x / ce_2p0x and pe_1p3x / pe_1p5x / pe_2p0x (SEPARATE CE and PE) no_trade_quality This single change removes most of the CE/PE confusion V1 fought for months. The Shallow Regularized Grid (the actual fix for overfit) learning_rate = 0.015 – 0.035 n_estimators = 800 – 2000 ( early stop ) max_depth = 2 – 3 min_child_weight = 12 – 40 gamma = 0.1 – 2.0 subsample = 0.65 – 0.90 colsample_bytree = 0.55 – 0.85 reg_alpha = 0.5 – 3.0 reg_lambda = 6.0 – 20.0 scale_pos_weight = min ( neg / pos , 8.0 ) V1's intraday head ha

Preparing for a Python developer interview often starts with coding problems. You practice arrays, strings, dictionaries, functions, and algorithms. Then you solve a few more problems and feel like you're ready. But an actual Python developer interview can test much more than whether you can write working code. You may need to explain your decisions, debug an unfamiliar piece of code, discuss Python concepts, or describe how you would approach a real development problem. Here are the areas I'd focus on before an interview. 1.Don't Just Solve Python Problems—Explain Them It's possible to solve a coding problem correctly and still struggle in an interview. Interviewers often want to know: Why did you choose this approach? What is the time complexity? What happens with edge cases? Is there another way to solve it ? How would you improve the solution? Try explaining your solution aloud after solving it. If you can't explain why your code works, you probably don't understand the solution as well as you think. 2. Know Python Beyond the Basics Don't stop at syntax. Review concepts such as: Lists, tuples, sets, and dictionaries Mutable vs immutable objects *args and **kwargs Exception handling Iterators and generators Decorators List comprehensions Context managers Object-oriented programming Memory management You don't need to memorize every Python feature. Focus on understanding concepts well enough to explain when and why you'd use them. 3. Practice Debugging Real developers don't spend all day writing code from scratch. A large part of the job involves understanding existing code and fixing problems. Take a small Python program with a bug and practice: Reproducing the problem. Reading the error carefully. Finding the likely cause. Testing your assumption. Fixing the issue. Explaining why it happened. This is also useful interview practice because debugging reveals how you think when the answer isn't immediately obvious. 4.Be Ready for Real-World Questions Depending on t

Hoi hoi! I’m @nyaomaru, a frontend engineer who dislikes crowded places, so I'm planning to take a...

You budgeted six months. It took fourteen. You wanted one thing; you got three things that almost do it. And somewhere between the first sprint and the final invoice, you stopped understanding what you were even paying for. If that sounds familiar, this is the breakdown no one gave you before you started. What custom software development actually means Custom software development is building software from the ground up for your specific business, not configuring Salesforce, not installing a plugin. You're solving a problem your operations have, the way your operations actually work. What trips people up: "custom" doesn't mean "built entirely from scratch." Good dev teams use frameworks, libraries, and third-party services. What's custom is the logic of how your data flows, how business rules are enforced, how users interact. Scope range is huge: Custom dev covers everything from a lightweight internal dashboard to a full-scale multi-tenant SaaS platform. This is why cost estimates vary so wildly. 3 things nobody tells you before you sign 1. Scope creep is almost always the client's fault "Users should be able to manage their accounts" sounds simple. It actually contains dozens of decisions: can they change their email? What verification is required? Can they delete their account? Each one is a feature. Each feature has a cost. The fix: Run a discovery phase (2–4 weeks) before writing a single line of production code. It costs money upfront. It saves far more mid-project. 2. The cheapest bid rarely wins long-term A $40k quote and a $180k quote for the same project both happen. The $40k team isn't lying; they're optimistic, underbidding to win work, or scoping something different. What actually happens: you hit $40k, and you're 40% done. Higher bids from experienced teams often include architecture planning, documentation, testing infrastructure, and post-launch support things the cheap bid omitted. These aren't extras. They're what make the software maintainable in t

Can't believe I spent 2 weeks writing this. Last week, I gave a talk at a Cursor community event...

A scheduler can be perfectly healthy and still run the wrong job at the wrong time. The failure is usually not the cron expression. It is the boundary between wall-clock time, monotonic elapsed time, leases, retries, and a process that may pause or restart. A reliable agent scheduler needs an explicit clock contract. Without one, a clock correction can make a job run twice, never run, or run after its authorization window has expired. The three clocks an agent should not conflate Use wall-clock time for human meaning and durable records: scheduled_at: when the user asked for the run not_before: the earliest acceptable dispatch time expires_at: the latest acceptable dispatch time Use a monotonic clock for elapsed-time decisions inside one process: lease renewal deadlines backoff timers watchdog intervals drain deadlines Use a database or provider sequence for ordering across processes: scheduler ownership fencing tokens attempt numbers reconciliation order A monotonic timestamp cannot be compared across hosts, and a wall-clock timestamp cannot safely measure a five-minute lease if NTP steps the clock backward. Store both kinds of evidence instead of pretending one timestamp answers every question. A small scheduling contract Here is a deliberately boring record shape: action: send_digest run_id: 01J... scheduled_at: 2026-08-19T08:00:00Z not_before: 2026-08-19T08:00:00Z expires_at: 2026-08-19T08:05:00Z lease_owner: worker-7 lease_token: 1842 attempt: 1 state: READY The important part is not the field names. It is the decision rule: The scheduler claims the run with a durable lease and fencing token. It checks wall-clock eligibility against not_before and expires_at. The worker checks that its lease token is still current before starting. The effect layer checks the token again before a side effect. If the outcome is ambiguous, record UNKNOWN and reconcile by the provider's idempotency key instead of blindly retrying. That last step matters after restarts. A clean rest

Most write-ups on this subject are about technique. This one is about the three decisions you should make before you write any code, because in my experience every project that went badly went badly for a reason that was decided on day one and not noticed until much later. I have built this kind of collection twice, for competitive analysis and for a partner-vetting workflow. Neither of them needed to touch anything behind a login, and I want to explain why that turned out to be the useful constraint rather than the limiting one. Line one: the login wall is a boundary A login wall is a statement about who the content is for. Treating it as an engineering obstacle to be routed around is the decision that puts a project on the wrong side of everything: terms of service, the platform's own detection, and in several jurisdictions the law. So the first line is simply: if it requires an account to see, it is out of scope. Not "hard," not "for later." Out of scope. I am not going to discuss techniques for getting past one, and I would be sceptical of any article that does. The interesting engineering question here is not how to see more. It is how much you can actually do with what is openly published, and the honest answer is: considerably more than people assume before they check. This constraint also has a practical benefit that is easy to miss. A pipeline built only on openly available data does not break when authentication changes, does not require credential management, and does not put an account at risk. Mine has survived two platform changes that took down colleagues' authenticated collectors. Line two: public does not mean unrestricted The second line is the one developers get wrong most often, and it has nothing to do with access. Data being publicly visible says nothing about whether you may store it, for how long, or what you may do with it. In the EU and UK, information about an identifiable person is personal data whether or not they published it themselves

🛡️ Arquitectura de Defensa para Agentes de IA: Cómo asegurar tus LLMs contra Prompt Injection, Tool-Poisoning y Fugitividad. El ecosistema actual de agentes autónomos y servidores MCP (Model Context Protocol) es brillante, pero operativamente es una pesadilla de seguridad. Estamos construyendo sistemas que ejecutan código, acceden a bases de datos y toman decisiones críticas basándose en salidas de texto que son intrínsecamente manipulables. Si estás desplegando agentes en producción confiando únicamente en que el modelo "se portará bien" gracias a su System Prompt, estás completamente desprotegido. Para solucionar esto, he desarrollado un framework de defensa en profundidad distribuido en 4 capas críticas. No se trata de teoría académica; son sensores deterministas y dinámicos listos para producción. 🏗️ Las 4 Capas del Ecosistema de Seguridad. Capa 1: Sanitización de Entrada y Control de Estímulos (Ingress). El ataque empieza antes de que el modelo procese el token. Necesitamos interceptar vectores maliciosos tanto en texto como en medios visuales. hermes-shield: Un sanitizador de entrada anti prompt-injection que opera en 5 capas secuenciales para neutralizar instrucciones hostiles ocultas. vision-injection-guard: Un sensor determinista diseñado para procesadores VLM. Detecta texto malicioso inyectado visualmente en imágenes antes de que el modelo de lenguaje lo interprete. corpus-scrub: Herramienta de prevención de fuga de datos. Detecta y redacta de forma automática PII (información personal identificable) y secretos en tus corpus de datos antes de entrenar o ajustar un LLM. Capa 2: Pasarela de Control y Validación Física (Gateway & Sandbox). Una vez que el agente está activo, no puede comunicarse directamente con el exterior sin un proxy que valide sus intenciones. ai-guard-gateway: Una pasarela de seguridad profesional para endpoints expuestos. Implementa Rate Limiting, redacción de PII en tiempo real, detección de inyecciones y políticas OPA (Open Policy Agen

The tunnel comes up. wg show prints a recent handshake. The client has its address inside the tunnel. And not a single byte reaches the internet. Almost every guide answers this with "open UDP 51820 in the firewall". You already did that — it is why the handshake works at all. The problem is somewhere else, and UFW makes the distinction easy to miss: Entering a machine and traversing it are two different permissions. ufw allow 51820/udp lets packets arrive at the server. Your clients' traffic does not stop there — it goes through the box and out the public interface. That path lives in the FORWARD chain, which UFW denies by default and which no allow rule touches. The four things to check, in order 1. IP forwarding — and the file that overwrites the other file This is the one that costs hours, because the setting looks done. UFW loads its own sysctl file at startup, and it takes precedence over the system one. A value you carefully set in /etc/sysctl.conf can be silently overwritten on the next ufw enable . The right place is /etc/ufw/sysctl.conf : net / ipv4 / ip_forward = 1 net / ipv6 / conf / default / forwarding = 1 net / ipv6 / conf / all / forwarding = 1 Then check the effective value, not the file you just edited: sysctl net.ipv4.ip_forward 2. Forwarding, which is not the same as ingress Targeted, and the one to prefer: sudo ufw route allow in on wg0 out on eth0 Or globally, in /etc/default/ufw : DEFAULT_FORWARD_POLICY = "ACCEPT" The second opens forwarding for every interface. It is a good ten-second diagnostic and a poor permanent configuration. 3. NAT, which UFW never adds on its own Without it, packets leave carrying their tunnel address, which nothing on the internet knows how to answer. In /etc/ufw/before.rules , at the very top , before the *filter line: *nat :POSTROUTING ACCEPT [0:0] -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE COMMIT Two classic mistakes here: putting this block after *filter (it is then ignored), and copying eth0 without chec

If you have ever copy-pasted a table out of a PDF, you already know what happens. Rows collapse into one long line of text. Columns interleave. Numbers land in the wrong cell, or no cell at all. The table on the page looks perfectly structured, but a PDF has no real concept of "table." It only knows where individual characters sit on a page. Every extraction tool, ours included, has to reconstruct the table from scratch, using nothing but the position of each word. That gap between "looks like a table" and "is structured data" is where almost every free PDF tool falls apart. Here is how we handle it, what actually works, and where it still doesn't. Two different jobs, two different tools PDFHaul splits this into two separate tools because they solve different problems. PDF to Excel rebuilds the whole document as a single spreadsheet, in the order it appears on the page: form labels, key-value pairs, section titles, and tables all together. It is for documents where you want the full content, not just the numbers, things like invoices, time sheets, and reports. Extract Tables does the opposite. It ignores everything that isn't a table and hands back one clean sheet per table, nothing else. It is for people who want structured data out, ready to sum, sort, and filter, not a copy of the document. Both tools share the same underlying geometry engine. The difference is what each one keeps and what it throws away. How Extract Tables actually decides what's a table The core problem with table extraction is that "looks tabular" and "is tabular" are not the same thing. A vector chart's axis box, a form's outlined signature field, and a two-column list of allergen names all produce something that a naive extractor will happily read as a grid. None of them are tables. Our pipeline handles this in four phases, all before anything is written to a spreadsheet: Phase 1: classify the page. Every page is scored as bordered (has ruled lines or filled-rectangle grid lines), stream (no

Polars hits the sweet spot between Pandas’ ease and Spark’s scale. If you’ve ever waited on a groupby or cursed a memory error, this cheat sheet is for you. I’ve pulled the patterns that save time in real pipelines, not just toy examples. Bookmark this before your next ETL run. Setup and Basics First, get Polars and a dataset. The lazy API is the default now, so you’ll rarely need to call .lazy() explicitly. Start with a CSV or Parquet file, or create a DataFrame from scratch. pip install polars pyarrow import polars as pl df = pl.read_csv('data.csv') # or pl.read_parquet() df = pl.DataFrame({'a': [1, 2], 'b': ['x', 'y']}) Selecting and Filtering Polars uses expressions, not strings. This feels odd at first but pays off when you chain operations. The syntax is consistent: every column is an expression you can transform, filter, or aggregate. df.select(['a', 'b']) # columns by name df.select(pl.col('a').alias('renamed')) df.filter(pl.col('a') > 10) df.filter(pl.col('b').is_in(['x', 'z'])) df.filter(pl.col('a').is_null()) Transforming Data Polars expressions are composable. You can nest them, reuse them, and even store them in variables. This is where the library shines over Pandas. df.with_columns(pl.col('a').cast(pl.Float64)) df.with_columns(pl.col('a').fill_null(0)) df.with_columns((pl.col('a') * 2).alias('a_doubled')) df.with_columns(pl.col('b').str.to_uppercase()) df.with_columns(pl.col('a').is_between(10, 20)) Grouping and Aggregations Groupbys in Polars are lazy by default. This means you can stack multiple aggregations without materializing intermediate results. The syntax is clean, but watch out for the order of operations. df.group_by('b').agg(pl.col('a').sum()) df.group_by('b').agg([pl.col('a').mean(), pl.col('a').max()]) df.group_by('b').agg(pl.col('a').quantile(0.9)) df.group_by_dynamic('timestamp', every='1d').agg(pl.col('a').sum()) Joins and Concatenation Joins in Polars are explicit. You’ll specify the join type and the columns to join on. Concatenatio

US healthcare is broken. Under RFK Jr., the research agency working to fix it is, too.

Tanks with defensive tech for shooting down drones are still proving vulnerable.

If you build with Prisma, you already know Prisma Studio. Run one command and you get a clean, visual way to browse and edit rows in your database. It's genuinely useful, and I reach for it every day while developing. But somewhere between "I need to look at my data" and "I need to let a support agent safely edit a customer's record in production," Prisma Studio quietly stops being the right tool. It was never trying to be that tool. It's a database viewer. An admin panel is something else, and the gap between the two is exactly the part that matters once real people and real permissions are involved. I ended up building a small package to fill that gap for my own Express + Prisma apps. Writing it forced me to be precise about what an admin panel actually adds on top of a database browser. Here's the distinction as I now understand it. A database browser shows rows. An admin panel governs them. Prisma Studio connects to your database and shows you everything. That's the point of it, and it's also why you'd never hand it to a non-engineer or expose it in production. It has no concept of who is looking, what they're allowed to do, or which rows they're allowed to touch. An admin panel's whole job is those three questions. The package I built mounts a React UI at /admin and a guarded JSON API under /admin/api/* on your existing Express app. Every single request through that API runs the same pipeline, in the same order: authentication → permission check → tenant scope → validation → Prisma mutation/query → optional audit event That ordering is the entire difference. A database browser skips straight to the mutation. An admin panel refuses to run the mutation until it knows the request is authenticated, permitted, scoped to the right tenant, and valid. Permissions and scope are two different questions This was the design decision I care most about, because collapsing these two into one is how data leaks happen. Permissions decide which actions a role may take. Can an ed

"Nearby" sounds like a simple feature. Calculate the distance between the user and every location. Sort by distance. Done. In practice, that's not enough. A useful local discovery engine has to understand more than geography. That's one of the problems we're tackling with LeeX. The basic version A traditional nearby query might look like: User location ↓ Calculate distance ↓ Sort ascending ↓ Return results If Restaurant A is 500 meters away and Restaurant B is 2 kilometers away, Restaurant A wins. But what if Restaurant A is permanently closed? What if Restaurant B is much more relevant to the user's category? What if Restaurant B is currently featured? What if thousands of people have recently interacted with Restaurant B? Distance alone doesn't capture usefulness. Our discovery model We're thinking about discovery as a combination of signals: Discovery Score = Distance + Relevance + Activity + Popularity + Featured status + Availability + User context The exact weighting can evolve. The important part is that proximity is one signal, not the entire algorithm. Distance still matters We don't want to ignore geography. For local discovery, distance is extremely important. A user looking for a restaurant probably cares whether it is: 500 m 1 km 2 km 5 km 10 km That's why LeeX can expose radius-based discovery. But distance should normally be combined with other information. Category context Suppose someone opens LeeX and selects: Restaurants The discovery engine should not treat every listing equally. The system already knows the user's current intent. That gives us a stronger query: Nearby + Restaurant + Open + Relevant rather than: Nearby + Everything Featured listings LeeX also has a promotion layer. Featured listings can receive additional visibility across relevant discovery surfaces. But promotional ranking needs to be handled carefully. A featured listing shouldn't necessarily make every other result useless. Instead, we can think of featured placement as an ad

Within minutes of this post going live, this laptop goes back to the company. Work is handed over....

Microsoft did the hard work so you don't have to. The Microsoft.FeatureManagement library integrates directly with .NET's configuration and dependency injection systems, which means you can get feature flags working with minimal code and a solid foundation. For the full documentation, check out the Microsoft Feature Management documentation . Let's get this thing running. Installation Add the NuGet package to your project: dotnet add package Microsoft.FeatureManagement.AspNetCore That's it for dependencies. No magic rituals required. Configuration Register the feature management services in Program.cs : builder . Services . AddFeatureManagement (); By default, feature flags are read from the FeatureManagement section of your appsettings.json : { "FeatureManagement" : { "NewDashboard" : true , "ExperimentalSearch" : false } } Flag names are strings. Values are booleans. Simple. Checking a Flag in Code Inject IFeatureManager wherever you need to check a flag: public class DashboardController : Controller { private readonly IFeatureManager _featureManager ; public DashboardController ( IFeatureManager featureManager ) { _featureManager = featureManager ; } public async Task < IActionResult > Index () { if ( await _featureManager . IsEnabledAsync ( "NewDashboard" )) { return View ( "NewDashboard" ); } return View ( "OldDashboard" ); } } That's the whole pattern. Inject. Check. Branch. Repeat. Using Feature Filters Boolean flags are useful, but sometimes you need something a little more sophisticated. The library supports feature filters for things like: Percentage rollouts Time windows User targeting For example, you can enable a feature for a percentage of requests: { "FeatureManagement" : { "BetaFeature" : { "EnabledFor" : [ { "Name" : "Percentage" , "Parameters" : { "Value" : 20 } } ] } } } This enables BetaFeature for 20% of requests. The library handles the sampling. You handle the business logic. Everybody wins. Razor Tag Helpers Building a Razor-based UI? The lib

Save $250 off the Garmin Fenix 8, plus discounts on other popular fitness trackers from the brand.

The ChatGPT maker says its upcoming Astra model may have reached “critical” cyber capabilities, prompting it to halt a significant number of training runs while it tightens internal safeguards.