标签：#iam

Most social-media automation tutorials stop at “call the API on a cron job.” That works, but it leaves the hard questions unanswered. Which account is the automation using? How does it avoid posting the same story twice? What happens when an API request times out after X has already accepted the post? And where should an AI agent’s editorial freedom end? I recently built a scheduled X publishing workflow with Codex and xurl , the official command-line client for the X API. The result is not just a timer attached to an AI prompt. It is a small publishing system with four distinct layers: An X developer application with read-and-write user authentication. xurl , which stores the credentials and communicates with the X API. A fixed-account Codex skill that verifies the identity before every write. A Codex scheduled task that researches, checks history, drafts, and publishes. That separation is the important part. Codex can make editorial decisions, but it cannot casually choose an account or improvise the publishing command. The skill owns the deterministic write boundary, while the scheduled task owns timing and editorial policy. In this article, I’ll show you how to build the same architecture. X developer settings, API packages, Codex features, and command-line options can change. The workflow below was verified in August 2026, but you should check the current upstream documentation before using it in production. What You Will Need Before starting, you will need: Codex on a Mac with access to Scheduled tasks. An X developer account and an application with read-and-write permissions. Homebrew. A dedicated or clearly identified X account for the automation. A local project containing the source material or editorial context the agent should use. You should also decide what the automation is allowed to publish before you give it access to an account. A good editorial policy is specific enough to reject a story, not merely broad enough to describe a topic. For example,

Today I did something I've wanted to do for a while — I took an app running on my own laptop and put it "live" on the internet using AWS. It sounds scary when you read about it online, but once I actually did it, it was just a bunch of small, simple steps, one after another. This post is me writing down everything I did, in plain, easy words, so that if you're a beginner like me, you can follow along without getting confused by fancy tech terms. What is AWS, in simple words? AWS (Amazon Web Services) is basically Amazon renting out computers over the internet. Instead of buying your own physical server and keeping it running 24/7 at home, you "rent" a computer from Amazon. That computer runs your app, and anyone with the internet can visit it. The specific service I used is called EC2 . Think of EC2 as one virtual computer that lives in Amazon's data center, and you get to control it like it's your own. Step 1: Set up IAM first Before touching any servers, I went to IAM (Identity and Access Management). This is AWS's way of managing "who is allowed to do what" in your account. In simple words: instead of using your main AWS login for everything (which is risky), IAM lets you create a separate user with its own permissions. It's like giving someone a spare key instead of your master key. I set this up first so my account stays safer. Step 2: Launch an EC2 instance Next, I went to the EC2 section and launched a new instance (a fancy word for "a virtual computer"). During this step, AWS also lets you create a .pem file — this is basically a secret key file. It's like a digital key to a lock. Only someone with this file can get into the server. I downloaded it and kept it safe, because if you lose it, you can't easily get back in. Step 3: Login to the server using SSH Once the server (EC2 instance) was ready, I needed a way to "log in" to it from my own laptop. For that, I used something called SSH, along with the .pem key file I downloaded earlier. In simple words: SSH

NVIDIA shipped a 30-billion-parameter model that can see, hear, and talk — and gave the weights away. The catch: the seeing and hearing parts didn’t run on a Mac. So I spent an afternoon writing the missing piece. Here is the whole thing in thirty-five seconds — the model reading a real cart off my own store, on the laptop, with nothing leaving it. Thirty-five seconds: the model reads a real cart off my own store, on the laptop, with nothing leaving it. The elapsed counter is the real measured latency. Every couple of weeks I go looking for whatever new open-weight model just dropped, pull it onto my laptop, and see what it can actually do. Most of the time it’s a coding model, I run it against the one I already use, and my current favorite wins again. That’s a fine result. It’s just not much of a story. This time I found something different. What Nemotron Omni actually is NVIDIA released Nemotron-3-Nano-Omni-30B-A3B — a “tri-modal” model, which is a fancy way of saying one brain with eyes and ears attached. You can hand it a picture, a sound file, or a video, and talk to it about what it saw or heard. It’s 30 billion parameters total, but only about 3 billion of them fire for any given word, which is why something this capable can run on a laptop at all. The weights are public. Someone had already done the hard, unglamorous work of shrinking it down to a 4-bit MLX version that fits on Apple Silicon — that’s yayr over at mlx-community, and this project doesn’t exist without that upload. About 19 GB on disk. Ready to go. Except for one line, buried in the model card: The text backbone loads with standard MLX nemotron_h tooling. The vision and audio towers require a multimodal runtime that implements the C-RADIO ViT-H and Parakeet Conformer forward passes (e.g. the Evorix on-device engine). Translated: the brain works on a Mac. The eyes and ears don’t. The weights for them are right there in the file — all the knowledge, sitting on your disk — but nothing I could find

why-we-open-sour-c1f013bf.webp alt: Building Digital Identity Tools - Why We Open-Sourced Our SSI SDK relative: false Self-Sovereign Identity (SSI) is a framework that allows individuals and organizations to control their own digital identities and share verified credentials without relying on a central authority. This paradigm shift empowers users with greater privacy and control over their personal data, while also providing robust mechanisms for verifying the authenticity of credentials. What is Self-Sovereign Identity (SSI)? SSI is built around the concept of decentralized identifiers (DIDs) and verifiable credentials. DIDs are unique identifiers that are controlled by the entity they represent, enabling them to manage their own identity data. Verifiable credentials are digital assertions that can be issued by one party and verified by another, ensuring the authenticity and integrity of the information shared. Why did we open-source the SSI SDK? Open-sourcing the SSI SDK was a strategic decision driven by several factors. First, fostering innovation within the community is crucial for advancing the field of digital identity. By making our SDK available to everyone, we encourage collaboration and experimentation, leading to new ideas and improvements. Second, promoting transparency is essential for building trust in digital identity systems. Open-source projects allow others to inspect the codebase, understand how it works, and identify potential vulnerabilities. This transparency helps build confidence in the security and reliability of the SDK. Finally, enabling a broader community to contribute to and benefit from secure digital identity solutions aligns with our mission to democratize access to these technologies. By lowering the barriers to entry, we hope to empower more developers and organizations to adopt and improve upon our work. What are the key features of the SSI SDK? The SSI SDK provides a comprehensive set of tools for building digital identity app

The Hidden Cost of Manual IAM Review Most teams don't track how long they spend reviewing IAM policies. When I started measuring it on my own team, the numbers were worse than I expected. A thorough manual review of one IAM policy takes 10 to 15 minutes. Not a quick scan. A real review: read every statement, trace every cross-account trust, verify every condition key, check for privilege escalation paths, confirm the resource ARNs match what you think they should. At 4 engineers touching IAM once a week, that's 4 hours a month. 48 hours a year of senior engineers reading JSON documents. And that's the optimistic case. Add a security incident. Add an audit. Add the emergency Friday-afternoon policy change that needs review before deploy. The real number is higher. What manual review misses The problem isn't just the time. It's that humans are bad at repetitive structured-data review, especially under time pressure. Here are the things I've seen slip through manual IAM reviews on production systems: iam:PassRole with no condition. This is the big one. PassRole lets a principal pass a role to a service — and if there's no iam:PassedToService condition, that role can be passed to any service that accepts roles. Including services the attacker controls. The reviewer saw the action, mentally categorized it as "role stuff," and moved on. It was statement 47 of 52 — the reviewer had already been reading policies for 40 minutes. Wildcard resource with sensitive actions. s3:* on Resource: "*" is obvious. s3:GetObject on "arn:aws:s3:::*-backup/*" with a wildcard in the bucket name — that's subtle. The reviewer reads it as "restricted to backup buckets" and moves on. But the wildcard means any bucket ending in -backup , including ones in other accounts if cross-account access is configured. Missing aws:SourceArn on Lambda invocation permissions. When you grant another service permission to invoke your Lambda function, you need aws:SourceArn to prevent the confused deputy

With funding from tennis star and angel investor Venus Williams, the French app WeWard says that it increases walking time by almost 25%.

Peter Diamandis is the latest tech executive to argue that global surveillance will make the world a better place, following Larry Ellison's comments in 2024.

Migrar 100 usuários manualmente no console da AWS é lento, suscetível a erros e impossível de auditar com precisão. Neste artigo você vai ver como automatizar esse processo usando AWS CLI e Shell Script direto no AWS CloudShell — sem instalar nada localmente. O resultado final: usuários criados, alocados nos grupos corretos e com MFA obrigatório, tudo em minutos. O que é o IAM? O AWS Identity and Access Management (IAM) é o serviço que controla quem pode acessar os recursos da sua conta AWS e o que cada pessoa ou serviço pode fazer. Com o IAM você gerencia: Conceito Descrição Usuário Identidade individual com credenciais próprias Grupo Conjunto de usuários que compartilham as mesmas permissões Política Documento JSON que define o que é permitido ou negado Role Identidade temporária assumida por serviços ou usuários A boa prática é nunca conceder permissões diretamente a um usuário — sempre use grupos. Visão geral da solução O fluxo é simples: Criar os grupos IAM no console Montar um arquivo CSV com os dados dos usuários Rodar um shell script no CloudShell que lê o CSV e cria tudo automaticamente Aplicar a política de MFA obrigatório nos grupos Passo 1 — Criar os Grupos IAM Antes de importar os usuários, os grupos precisam existir. No AWS Console , acesse IAM → User groups → Create group e crie um grupo para cada perfil do seu ambiente. Neste exemplo usaremos: RedesAdmin — administradores de rede LinuxAdmin — administradores de servidores Linux DBA — administradores de banco de dados Estagiarios — acesso limitado para estagiários Nomes de grupos suportam até 128 caracteres (letras, números e + = , . @ _ - ), são únicos por conta e não diferenciam maiúsculas de minúsculas. Passo 2 — Montar o arquivo CSV Crie uma planilha com os dados dos usuários e salve como CSV separado por vírgula (UTF-8) . O arquivo deve ter exatamente três colunas: Username , Group e Password . Username , Group , Password joao . silva , LinuxAdmin , Senha @2024 ! maria . souza , DBA , Senha @2024