标签：#Go

Rate limiting is one of those features every production API eventually needs. Whether you're building a public REST API, a WebSocket service, or an authentication endpoint, you'll eventually face problems like: Credential stuffing Brute-force attacks API abuse Bots scraping your endpoints Unexpected traffic spikes Most applications solve this with a simple request counter. But after building several APIs with Django, FastAPI, and Flask, I realized that production traffic requires much more than "X requests per minute." That observation led me to build drogue , an open-source Python library for rate limiting and traffic protection. The Problem Traditional rate limiting is straightforward: Allow 100 requests per minute. This works well for many cases, but real-world applications quickly expose its limitations. For example: A distributed attack can remain below the per-IP limit. A bot can rotate through proxies. WebSocket connections often require different handling than HTTP requests. Different endpoints need different protection strategies. I wanted a system that could go beyond simple request counting. Design Goals From the beginning, I focused on a few principles. 1. Clean framework integration I didn't want endpoint functions filled with framework-specific plumbing. Instead, the library should feel like a natural extension of the framework. from fastapi import FastAPI from drogue.adapters.fastapi import DrogueLimiter app = FastAPI () limiter = DrogueLimiter ( app , default_limits = [ " 100/minute " ]) @app.get ( " /users " ) @limiter.limit ( " 10/minute " ) async def users (): return { " status " : " ok " } No additional request objects. No complicated middleware configuration. Minimal boilerplate. Multiple Rate Limiting Algorithms Different applications require different algorithms. Instead of supporting only one approach, drogue includes multiple options: Token Bucket Sliding Window Fixed Window Each has different trade-offs between accuracy, burst handling, and

There’s new benchmark measuring AI’s ability to perform mathematical cryptanalysis. Anthropic’s frontier model actually found new attacks. The benchmark: “ CryptanalysisBench: Can LLMs do Cryptanalysis? ” The idea is to benchmark the ability of LLMs to discover new mathematical cryptanalytic attacks against a series of historical algorithms. Abstract: Cryptanalysis—the task of finding attacks against cryptographic schemes—its at the intersection of mathematical reasoning and cybersecurity, two areas where LLMs have advanced fastest. Cryptanalysis represents both a clean testbed for frontier reasoning (as practical attacks can be automatically verified) and a domain with unusually high stakes, since the primitives under study underpin our digital security. In this paper we ask whether LLMs can do cryptanalysis, and find that the answer is increasingly yes. We introduce CryptanalysisBench, 191 tasks across six families of cryptographic primitives (block ciphers, hash functions, etc.) drawn primarily from four NIST standardization competitions. Our benchmark consists of three tiers: (i) primitives with known practical breaks; (ii) primitives with no known practical break, evaluated both at full strength and as scaled-down variants; and (iii) a challenge set of production primitives at the frontier of cryptanalysis. Five frontier models (Claude Opus 4.8, Sonnet 5, Mythos 5, GPT-5.5, and the open-weights GLM-5.2) break 65%­86% of Tier 1 schemes, 6­12 Tier-2 schemes at full strength, and 24­61 across all scaled-down variants. Beyond deriving known results, models produce novel cryptanalysis, such as a key-recovery attack that exploits a design flaw in the SpoC AEAD and an error in KINDI’s published CCA-security proof, both to the best of our knowledge not previously known...

A thousand workers from OpenAI, Anthropic, Google, Meta and more have signed the letter.

Analysis of 15 million real AI interactions finds most tasks at most jobs are unaffected.

Employees of OpenAI and Anthropic, as well as Google, Meta, Thinking Machines, Microsoft, Mistral, and other leading AI labs, have written a statement to the US government supporting a potential slowdown of sorts for frontier AI development - or at least a speed-up of global coordinated governance efforts. "Al could help create a dramatically better […]

It's earnings season, and investors got an unpleasant surprise from Google: an increase on its spending estimate, to as much as $205 billion - from the last quarter's projection of up to $190 billion. Even the lower end of Google's new projected range - $195 billion - is much more than the company had previously […]

This article provides a step-by-step guide to building and testing a cross-cloud currency agent. A coordinator built with Strands Agents and hosted on Amazon Bedrock AgentCore Runtime (in AWS us-east-1 ) discovers and delegates to a Google ADK agent (on GCP Cloud Run in us-central1 ) over A2A v1.0 , cross-checks results against an MCP exchange-rate tool , and measures what independent cross-cloud verification costs in latency, reliability, and overhead. What is This Project Trying to Do? Most Agent-to-Agent (A2A) protocol demos stop at "look, the HTTP 200 OK request succeeded." That is a smoke test, not an interoperability benchmark. This project goes further: an Amazon Bedrock AgentCore-hosted Strands Agents coordinator discovers and delegates to a Google ADK agent running on GCP Cloud Run, comparing the results against a local MCP stdio exchange-rate tool backed by live Frankfurter daily reference rates. We also compare the performance, developer experience, and wire compatibility directly against our previous benchmark run hosted on Microsoft Foundry in Azure ( gpt-5-mini ), giving us a true cross-cloud benchmark across AWS, Azure, and GCP. The questions we answer with hard empirical data rather than vibes: Can an AgentCore-hosted Strands agent discover and invoke a Google ADK agent through an A2A agent card with no framework-specific glue? What latency and token overhead does remote-agent verification add? Does independently verifying an MCP tool result over A2A improve correctness or failure recovery enough to justify that overhead? How does AWS Bedrock AgentCore Runtime compare like-for-like with Microsoft Foundry on Azure? Reduce, Re-Use, Re-Cycle! This builds directly on the currency agent from the previous articles in this series: Getting Started with MCP, ADK and A2A | Google Codelabs GitHub - jackwotherspoon/currency-agent That agent — built with Google ADK, Gemini 2.5 Flash, and a FastMCP exchange-rate server backed by the free Frankfurter API — serves a

Github URL: https://github.com/SID-Technologies/Pilum In December 2025, I open-sourced Pilum , a multi-cloud deployment CLI that deploys to Cloud Run, Lambda, Azure, Cloudflare Pages, npm, Homebrew, and Docker Hub from a single pilum.yaml . The announcement post covered the architecture: recipes, ingredients, handlers, wave-based execution. That was the "it compiles and the tests pass" version. Three months and 40+ pull requests later, Pilum deploys all of SID Technologies , platform-core, Torch, Statio, every website, every npm package, and itself. This post is about everything that broke between "it works" and "it ships production software." ( Update: * there's now a seven-months-in addendum at the bottom. It's mostly about what stopped breaking.)* The Timeline Dec 2, 2025 : First commit. Baseline CLI with recipe system. (#1) Dec 4 : Homebrew release workflow. Pilum dogfoods its own deployment. (#2-#4) Dec 31 : Service graph, --only-changed , file embedding support. The "I need this for real" features. (#22-#24) Jan 3-12 : Documentation and bug fixes. The quiet "oh, this doesn't actually work" phase. (#25-#29) Feb 6-7 : The big feature sprint — 8 features in 48 hours. Wave deployments, npm recipe, Cloudflare Pages, Azure Container Apps, Cloud Run Jobs, environment variables, JSON output, history command. (#30-#38) Feb 8-12 : The big fix sprint — YAML parsing, package manager issues, build failures, error swallowing, GCP secrets, Cloudflare execution. Everything from the feature sprint broke something. (#42-#49) Feb 24 : Security hardening and npm publishing fixes. (#51-#53) Mar-Apr : Memory-based worker allocation, wave ordering bug, orchestrator rewrite. The "I thought this was done" phase. (#58-#62) The pattern is clear: features ship fast, fixes ship faster, and the real bugs show up a month later. Wave-Based Deployments Were Broken Wave-based deployment was the headline feature in #31. Services declare dependencies, Pilum builds a dependency graph, topological

Keeping phones out of landfills and doing useful things is a good thing.

Governments are switching, but I’m not sure it makes a difference : …some municipalities, including Denver, Colorado, are ditching their Flock arrays. But keep in mind that if they’re only switching from Flock to another brand of license-plate readers, like Axon, it’s like a gambling addict trying to kick the habit by switching from FanDuel to DraftKings. […] Despite what you may read on the Flock website, Axon cameras are pretty effective when it comes to hoovering up personal details that can go far beyond your license plate numbers. That means a municipality that opts for Axon cameras instead of Flock units won’t necessarily reduce the amount privacy its citizens lose through their use...

The screwup shows how tricky it can be to stop web crawlers from making ostensibly private conversations with AI chatbots entirely too public.

This is a submission for DEV's Summer Bug Smash: Clear the Lineup powered by Sentry . Project Overview Staxa is a multi-tenant deployment platform I am building solo under Stackforge Labs. The backend is a single Go binary ( staxad ) using the chi router, with about 60 API endpoints, running on K3s on a Hetzner CAX21 ARM64 server that costs around $11/month. Each tenant gets an isolated Kubernetes namespace with their own app container, a PostgreSQL 16 or MySQL 8 database, a subdomain with automatic SSL, and resource quotas. Container builds run through Buildah, and the frontend is Next.js (App Router) with shadcn/ui and Clerk for auth. Bug Fix or Performance Improvement The symptom: POST /api/v1/tenants/{id}/deployments/{depId}/rollback accepted a deployment ID in the URL path and then completely ignored it. Whatever version you asked for, you got the most recent successful deployment instead. The route was wired up correctly in internal/api/router.go:149 : r . Post ( "/tenants/{id}/deployments/{depId}/rollback" , srv . handleRollbackDeployment ) But handleRollbackDeployment never called chi.URLParam(r, "depId") . It read {id} for the tenant and stopped there. How I found it: I was auditing my published API docs against the actual handlers, endpoint by endpoint. When I got to the rollback entry I went to write down what {depId} did, went to the handler to confirm, and found nothing reading it. The docs described an ID that the code never looked at. The worst part is that it returned 202 Accepted and then performed a real, successful rollback. Just not the one you asked for. There was no error to notice, no failed request in any log. The frontend had been passing the deployment ID into the URL since it was written ( src/lib/api.ts ), so the UI always believed the parameter was honored. Root cause: the handler created a rollback deployment row with no reference to any target, and the worker independently decided what to restore. In internal/worker/pipeline.go , runRo

Here's what the rumor mill tells us Google might be preparing for its next Pixel launch.

Every log has a story خب، روز سوم الان که دارم این لاگ رو می‌نویسم، روز تقریبا تموم شده و امروز از اون روزهایی بود که حس خوبی داشت اگر بخوام بهش نگاه کنم، می‌تونم بگم یکی از روزهای خوب ۱۴۰۵ بود البته امیدوارم بهترینش نباشه چون هنوز کلی برنامه داریم، کلی چیز هست که باید ساخته بشه و کلی روز بهتر قراره بیاد یک پیام غیرمنتظره دیروز ساعت 17:54 یک پیام دریافت کردم راستش آن لحظه خیلی آماده جواب دادن نبودم من معمولا پیام کسی را بی‌جواب نمی‌گذارم، حتی اگر ناراحت باشم یا فاصله‌ای ایجاد شده باشد اما بعضی وقت‌ها آدم نیاز داره سکوت کنه چند دقیقه، چند ساعت یا حتی بیشتر نه برای نادیده گرفتن، فقط برای اینکه بتونه با ذهن آرام‌تر و بی کینه تر جواب بده تایم نهار تصمیم گرفتم بخونم و جواب بدم هر چی نباشه اون کسی بود که موقع اعتراضات حالم رو پرسید حتی وقتی راجع به اون روز جمعه نکبت بار شنید با خطرات اون روزا برای عیادت من اومد ای کاش اون روزا بجای ساچمه تیر میخوردم ای کاش بعد دیدن اون کشتار من هم زنده نمی موندم شاید غریبه باشیم شاید دلخور باشم ولی خب هرگز خوبی ادم ها رو فراموش نمیکنم پیام طولانی بود خیلی طولانی و این دقیقا چیزی است که همیشه دوست داشتم آدم‌هایی که من را می‌شناسند می‌دانند که خودم هم معمولا جواب‌های کوتاه نمی‌دهم به نظرم نوشتن زیاد همیشه به معنی زیاد حرف زدن نیست گاهی یعنی برای توضیح دادن، برای فهمیده شدن و برای احترام گذاشتن وقت گذاشتی و این پیام هم همین حس را داشت نه فقط دفاع از خودت بلکه تلاش برای فهمیدن و توضیح دادن مرور خاطرات بعد از خواندن پیام، چند سال گذشته دوباره مرور شد بعضی آدم‌ها و بعضی روزها، حتی بعد از گذشت زمان، یک گوشه از ذهن باقی می‌مونن سال‌هایی که گذشت از ۱۳۹۹ تا ۱۴۰۲ سال‌هایی پر از تغییر، تجربه و اتفاق‌های مختلف پونه فرزانگان اختیاریه خب خیلی گذشته احساس پیری میکنم سال ۱۴۰۳ ارتباط کمتر شد و هر کسی مسیر خودش رو دنبال کرد تو کنکورت و من هم درگیر درد و دل با این باینری ها بودم اردیبهشت ۴۰۴ اتفاق‌هایی افتاد که شاید بهتر باشه فقط به عنوان تجربه به اون نگاه کنیم نه چیزی که هر روز دوباره مرور شه گاهی گذشته رو نمیشه تغییر داد و خب هممون اشتباه میکنیم بعد دوباره رسیدیم به یک نقطه جدید از ۴فروردین تا ۲۰ اردیبهشت امسال خب بازم شاید همون طوری که امروز گفتی هردو یه

This story originally appeared in The Algorithm, our weekly newsletter on AI. To get stories like this in your inbox first, sign up here. Reading OpenAI’s account last week of how some of its models broke their containment and hacked into the computer systems of Hugging Face, another AI company, was the first time I got…

The government says destroying his own data during an airport interrogation was illegal.

Google’s AI Overviews now appear in 43% of searches, underscoring how quickly AI-generated answers are becoming the default way people discover information online.

Manually checking what technologies power a website works once or twice. After that it gets slow, repetitive, and impossible to scale. Modern developers skip the manual step and detect tech stacks in code instead. Your program reads a response, pulls out the signals, and tells you what's running. No DevTools, no guesswork. This guide shows how that detection works and how to build it in Go with the open-source tooling ProjectDiscovery maintains. External resources: github.com/projectdiscovery/wappalyzergo projectdiscovery.io If you're new to the concept, start with technology fingerprinting for developers to understand the signals behind detection. What does "programmatic detection" mean? Programmatic detection just means letting software identify technologies instead of a person doing it by hand. Your application does five things: Sends a request Reads the response Extracts signals Matches fingerprints Outputs technologies No browser, no manual inspection. The same pipeline shows up in recon platforms, developer tooling, automation pipelines, and security workflows. Read detecting website technologies using Go first if you want the foundational walkthrough. Why developers prefer automated detection Manual workflows fall apart as systems grow. Scripted detection holds up because it's fast, consistent, and drops straight into a pipeline. Speed: scan hundreds of targets in minutes. Consistency: scripts don't skip clues a tired human would. Automation: pipe results straight into the rest of your tooling. Intelligence: raw HTTP turns into something you can act on. Building a fingerprint engine yourself means reimplementing years of pattern work. A mature library like wappalyzergo saves you those hundreds of hours. How programmatic fingerprinting works Most detectors run the same four-stage pipeline. Step 1: Fetch the target Send an HTTP request and keep the headers and body. Step 2: Extract signals Look for the clues a stack leaves behind: response headers, cookies, scr

Yet another Israeli mass surveillance company : Made by Israeli surveillance company Cognyte, the tech simulates a mobile phone tower, which forces nearby phones to connect to it. That enables cops to keep tabs on any phones in the vicinity ­ whether they’re owned by a suspect in a case or not. Cognyte’s contract with the state of Texas reveals that the simulator, called FalcoNet, can be concealed within the vehicles, hidden in a backpack for on-foot missions or attached to a helicopter. It’s the same technology as the infamous Stingray, one of the original cell-site simulators made by defense giant L3Harris...

The Go pod is running in production. CPU limit set to 2, metrics look reasonable. But under load, P99 latencies spike intermittently with no obvious cause. No errors, no goroutine leaks, just latency blowing up on traffic bursts. The root cause is usually invisible: GOMAXPROCS equals the number of CPUs on the physical node, not the container limit. Your Go app thinks it has 32 CPUs when it only has 2. The Linux kernel handles the gap in its own way — CFS throttling. What GOMAXPROCS reads (and what it ignores) By default, the Go runtime computes GOMAXPROCS via runtime.NumCPU() , which reads the number of CPUs available at the OS level. On a 32-core Kubernetes node, that returns 32 — regardless of what resources.limits.cpu says in your pod spec. Kubernetes CPU limits are enforced through Linux cgroups (v1 or v2). Cgroups are transparent to processes: a pod with limits.cpu: "2" doesn't see two virtual CPUs, it sees all the node's CPUs and gets suspended when it consumes too much. The Go runtime, historically, never read cgroups. It trusted the physical core count. package main import ( "fmt" "runtime" ) func main () { // Inside a pod with limits.cpu: "2" on a 32-core node fmt . Println ( runtime . NumCPU ()) // → 32 fmt . Println ( runtime . GOMAXPROCS ( 0 )) // → 32 } CFS throttling: how the kernel slows you down The Linux CFS (Completely Fair Scheduler) enforces CPU limits via two cgroup parameters: cpu.cfs_quota_us (allowed CPU time) and cpu.cfs_period_us (measurement window, 100 ms by default). A pod limited to 2 CPUs gets at most 200 ms of CPU time per 100 ms window. When Go spawns 32 OS threads for 32 parallel goroutines, those threads compete for physical CPUs. Once their combined usage exceeds the cgroup quota within the current window, the kernel suspends all threads in the cgroup until the next window starts. That's throttling: a complete application freeze lasting anywhere from a few milliseconds to several tens of milliseconds. A handful of these per second