标签：#ki

Looking to better protect your Kindle or add a little personality to your favorite e-reader? From cases and covers to page turners and even charms, this is the guide for you.

tailscale up --tun=userspace-networking gets you a green dot in the admin console and almost nothing else. The node appears in your tailnet, tailscale status looks healthy, and then you try to SSH into that container from your laptop and the connection hangs until TCP gives up. Two lines in the LXC config file fix it, and the container stays unprivileged. That's the whole post, really. But those two lines only make sense once you understand why every guide pushes you toward userspace mode in the first place, and what you're giving up by staying there. Who should care Anyone running services in unprivileged LXC containers on Proxmox who wants those containers to be real tailnet members with their own 100.64.0.0/10 address. Not reachable through something else. Reachable directly, over WireGuard, with a kernel network interface that ip addr can see. If you're already routing everything through a subnet router, you have a working setup and this is an optional upgrade. I covered that pattern in Tailscale Subnet Routers . Treat this as the next rung on the ladder: instead of one node advertising routes on behalf of everyone else, each container carries its own identity, its own ACL surface, and its own direct path to peers. What userspace networking actually costs you Every LXC-and-Tailscale guide I've read lands on the same instruction: pass --tun=userspace-networking and move on. It works because it sidesteps the problem entirely. Rather than asking the kernel for a TUN device, tailscaled runs a userspace TCP/IP stack (gVisor's netstack) inside its own process and never opens /dev/net/tun . Those costs stay invisible until you trip over one. Outbound traffic needs a proxy. In userspace mode, tailscaled exposes SOCKS5 and HTTP proxies on a local port. Nothing on the system routes to 100.64.0.0/10 automatically, because there is no interface and no route. Every client has to be told about the proxy: # userspace mode: this is the only way out export ALL_PROXY = socks5://l

Cloudflare, Astro, AI agents, GitHub Actions, issue triage, agentic AI, software architecture, open source, developer tools, AI automation, automated testing, human in the loop, agent workflows, GitHub, software engineering, AI software development, bug triage, continuous integration, developer productivity, autonomous agents, AI coding, Cloudflare Workers, Flue, triagebot By Leela Kumili

Senator Ron Wyden sent a letter to the U.S. federal watchdog requesting a comprehensive review of how the FBI, DEA, ICE's HSI, and the Secret Service use hacking tools and spyware against Americans.

Ich wollte kein Gesellschaftskapitel schreiben Ehrlich gesagt hatte ich es fest geplant, es wegzulassen. Das Buch sollte technisch bleiben. Guards, Skills, Crystallization-Loop. Harte Zahlen, echte Systeme. Kein Manifest, kein Aktivismus. Aber dann saß ich eines Abends vor meinem Dashboard und schaute auf eine Zahl, die mich nicht losließ: 1.087 autonom erledigte Tasks. Ohne mich. In einem einzigen Monat. Und ich dachte: Was passiert, wenn das nicht mehr mein persönliches Experiment ist, sondern die Standardausstattung eines Unternehmens? Was mein System jeden Tag beweist Mein Agentensystem läuft auf einer einfachen Architektur. Cron-Jobs feuern Tasks, Guards prüfen Ausgaben, Skills führen spezialisierte Workflows aus. Die Erfolgskennzahlen sprechen für sich: 232 aktive Cron-Jobs, die rund um die Uhr arbeiten 88,1% Aufgaben ohne menschliches Eingreifen abgeschlossen Durchschnittliche Reaktionszeit unter 4 Minuten für routinemaessige Entscheidungen Das ist kein Proof-of-Concept. Das ist mein Arbeitsalltag. Ein konkretes Beispiel: Jede Nacht um 2:00 Uhr laeuft ein Agent, der meine LinkedIn-Performance auswertet, Erkenntnisse in eine Wissensdatei schreibt und den naechsten Morgen mit priorisierten Empfehlungen vorbereitet. Ich wache auf und finde eine fertige Analyse vor. # Auszug aus meinem Cron-Setup 0 2 * * * claude --skill post-analyse --input performance/daily/ $( date +%Y-%m-%d ) .md 30 2 * * * claude --skill content-excellence --mode review Das ist Routine. Das laeuft jeden Tag. Das macht niemand manuell. Die Frage, die ich nicht ignorieren konnte Wenn eine Person mit diesem System die Produktivitaet von mehreren Vollzeitkraeften erreicht, dann stellt sich eine Frage, die ich nicht wegdefinieren kann: Was passiert mit den Arbeitsplaetzen, die diese Routinetaetigkeit bisher ausgefuellt haben? Der IMF schaetzt, dass 40% aller Arbeitsplaetze weltweit von KI betroffen sein werden. Nicht in zehn Jahren. Die Verschiebung findet jetzt statt, in kleinen Schritten, in je

VRP Is Ready for External Validation — Who Will Be the First to Pilot It? My name is Vitalijus Riabovas. I am the independent architect and creator of VRP — Veil Routing Protocol . VRP is a continuity-first networking architecture built around a simple principle: A logical session should not have to die simply because the network underneath it changed. Wi-Fi → LTE/5G. IP mutation. NAT / CGNAT churn. Temporary blackout. Path failure. Recovery. Replay attempts. Stale authority. Duplicate execution. For a long time, VRP was primarily architecture, runtime engineering and internal validation. That stage has changed. The public validation boundary exists now. And I am inviting serious engineers and organisations to test it. DON'T TRUST MY CLAIMS. TEST THEM. I am not asking the networking industry to believe a presentation. I built the measurement boundary. The public VRP Validation Kit provides engineers with an environment for evaluating observable behaviour independently. You can: clone the repository; run the Docker scenarios; inspect generated evidence; verify manifests and hashes; attack the evidence; delete events; duplicate events; reorder events; attempt replay; introduce stale conditions; corrupt artifacts; run the verifier; reproduce PASS / REJECT / INCOMPLETE outcomes. If you believe something is wrong, try to produce a reproducible contradiction. Give me: environment → scenario → commands → evidence → result That is useful engineering. WHAT HAS BEEN BUILT? VRP has moved far beyond an architectural diagram. The project now includes multiple engineering layers. Continuity architecture Logical session identity is designed to survive changes in the underlying network path. The architecture is being developed around continuity rather than assuming that transport identity and logical session identity must always be the same thing. Runtime The protected runtime implements the private VRP mechanisms. That implementation is not public . State and transition handling T

When I shipped KittyClaw two weeks ago, the tool did one thing: serve as a board. The Claude agents ran alongside - first by hand, then via a dispatcher.mjs : a Node script polling KittyClaw's API, triggering the right agent based on who was assigned to which ticket. The dispatcher worked great. It orchestrated Aekan's 13 agents for weeks. But it was an external process : one more node dispatcher.mjs to launch, a state file ( dispatch-state.json ) to keep in sync, logs to dig up in .agents/channel/debug.log , a config to copy-paste across projects in JS. Today, the dispatcher doesn't exist anymore. Orchestration lives inside KittyClaw . I run dotnet run on KittyClaw, nothing else. Aekan's 13 agents still run - but the infra that drives them is now a first-class citizen of the board. This shift from "dispatcher on the side" to "dispatcher inside the board" is small in lines of code, but it completely changes what the tool is. And how I work. This piece documents KittyClaw , the kanban orchestrator at the center of the Ekioo agent-fleet R&D. Alongside Bloomii (constructive-journalism media) and Kalceo (regulatory B2B SaaS for construction contractors), KittyClaw runs the AI agents that drive these projects in production. Before: two processes to run, two places to look The old setup was three stacked layers: KittyClaw - the board, with its UI and REST API. dispatcher.mjs - a separate Node script in the project's .agents/channel/ , launched manually in a terminal. Claude Code - the agents themselves, launched by the dispatcher. It worked. But every project had its own dispatcher.mjs , usually forked from Aekan and hand-adapted. Patterns duplicated: 30s polling, code lock, evaluator debounce, daily budget. Adding a feature (say boardIdle or subTicketStatus ) meant re-coding it in every dispatcher, or accepting that one project had it and others didn't. And visually, orchestration was invisible from the board . To see an agent's live activity, I'd pop a terminal, tail -f

I thought I was building a better planning engine. What I actually built was a machine for showing...

Subnetting errors rarely announce themselves as "bad math." More often, two devices make different decisions about whether a destination is local, a route points at the wrong boundary, or a cloud/VPN design contains two networks that cannot be unambiguously routed. These five failure modes are worth recognizing in live configurations. 1. The two hosts use different masks Consider Host A at 192.168.10.10/24 and Host B at 192.168.11.10/16 . A calculates that B is outside 192.168.10.0/24 , so A sends the packet to its default gateway. B calculates that A is inside 192.168.0.0/16 , so B treats A as local and tries ARP directly. The result can be asymmetric: one direction follows a router, while the reply is sent directly or never reaches the expected gateway. Check the actual prefix on both interfaces, not just the dotted decimal mask shown in a diagram. ip -br addr ip route ping -c 3 192.168.11.10 Correct the prefix so both endpoints agree, or intentionally route between two correctly defined subnets. 2. Overlapping subnets are assigned to different networks Suppose a branch uses 10.20.0.0/16 , while a cloud VPC or VPN peer also uses 10.20.0.0/16 . The problem is not that either mask is mathematically invalid. The problem is that a router cannot distinguish "the branch's 10.20.5.0/24 " from "the cloud's 10.20.5.0/24 " if both are reachable through different paths. Symptoms include traffic taking the wrong tunnel, routes that cannot be installed, or a VPN that connects but cannot reach some subnets. Inventory both sides of a tunnel and compare the complete network/prefix pairs. A longer, more specific route may make one destination appear to work while hiding the underlying overlap. ip route ip route get 10.20.5.25 traceroute -n 10.20.5.25 The durable correction is renumbering or using an intentional translation/design boundary. Adding increasingly specific routes is usually a brittle workaround. This is also why I prefer teaching subnetting inside routing and troublesh

Some fortnights the complaints scatter across a dozen topics; this one they clustered around two. Across the forums where paying AI users gather to compare notes, two things happened in the same window that left the same taste: the meter moved, and the mark landed. In both cases, something about the product changed without a clear announcement, and the users found out by running into it. Quotes sourced from: the OpenAI Developer Community and Hacker News. Every quote below was opened at its permalink and copied verbatim; each is listed with its handle, platform and date in the Sources section. We quote experiences, not verdicts — a forum post is one person’s felt reality, and we have framed it as exactly that. The $200 plan that lasted two days The loudest note this fortnight was the Codex usage drain. On the OpenAI Developer Community, a Pro subscriber posting as jjjnoronha laid out the damage plainly on 4 August: “I’m on the $200 Pro plan, and my weekly limit was completely exhausted in 2 days of serious development work. This is simply not viable.” He was refactoring a Rust backend with two agents running — one coding, one checking code quality — and described leaving Ultra mode on for three or four hours, which alone consumed 30% of his weekly allowance. But the complaint was not that the work was expensive; it was that the plan was sold with language suggesting far more headroom than what the cap delivered. “When someone pays for the highest consumer tier,” he wrote, “the expectation is capacity for sustained, professional work — not being locked out for the rest of the week after two days.” Others described something stranger. A user posting as kalani reported going to bed with 70% remaining after a Saturday reset, then waking up to find 0%. “Not like I had something running overnight, and yet all usage blocked until this next Saturday,” they wrote on 4 August. “Hard to trust a $200 / month service that is completely unpredictable about whether you’ll even be

This is a writeup of building a required CI gate for degraded-network behavior. The system under test is a robotics fleet substrate, but the finding applies to anyone shaping networks in CI. Ganglion exists to reach robots on networks nobody controls. Warehouse Wi-Fi, carrier CGNAT, a hospital VLAN, a customer firewall that was configured once in 2019 and has not been touched since. Until this week that claim was a sentence on a website. CI ran on clean loopback, everything was green, and the failure modes that actually matter in the field were the exact ones the test suite could never produce. That is now a required gate. Every push to main runs the full deploy, invoke and verify round trip over the relay against five shaped network profiles, and all five have to pass before anything merges. I build Ganglion, so treat the enthusiasm accordingly. The part worth your time is not that it went green. It is what I got wrong on the way there. The five profiles clean : baseline, no shaping. If this one fails, something else is broken. lossy : packet loss with light reordering. high-latency : 250ms round trip. asymmetric : plentiful downlink, starved uplink. This is the one nobody tests and the one teleop actually dies on, because control acknowledgements go the starved direction. nat-relay : endpoints with no route to each other at all, forcing hole punching to fail and relay fallback to carry the session. The last two are the ones I care about. Loss and latency are what people imagine a bad network is. Asymmetry and no-direct-route are what a bad network usually is. What I got wrong The original design assumed you can pin netem's seed and get a repeatable lossy run. Two profiles: a pinned-seed one that gates the build, and a nastier randomized one that runs nightly and is allowed to fail. You cannot pin netem's seed. Its loss and jitter draw from the kernel RNG and there is no seed parameter to set. A "deterministic lossy netem profile" is not a thing that exists. This m

Short version: An Application or Network Load Balancer costs ~$0.0225/hour, about $16/month, just to exist , plus capacity units. Classic Load Balancers run ~$18/month. Load balancers outlive the services behind them: the app gets torn down, the ALB keeps billing. Here's how to find load balancers with no real traffic or no healthy targets, and remove them safely. Why idle load balancers linger The hourly base charge is fixed - an ALB with zero requests bills the same ~$16/month as a busy one. Load balancers are usually created early (with an app or an IaC module) and deleted last, if ever. A handful of abandoned ALBs from old environments is real, recurring money. Step 1 - List load balancers and their traffic aws elbv2 describe-load-balancers \ --query 'LoadBalancers[].{Name:LoadBalancerName,Type:Type,ARN:LoadBalancerArn}' \ --output table For an ALB, check request volume over the last 7 days (the metric dimension is the tail of the ARN, e.g. app/my-alb/50dc6c495c0c9188 ): aws cloudwatch get-metric-statistics \ --namespace AWS/ApplicationELB \ --metric-name RequestCount \ --dimensions Name = LoadBalancer,Value = app/my-alb/50dc6c495c0c9188 \ --start-time " $( date -u -d '7 days ago' +%Y-%m-%dT%H:%M:%SZ ) " \ --end-time " $( date -u +%Y-%m-%dT%H:%M:%SZ ) " \ --period 86400 --statistics Sum \ --query 'Datapoints[].Sum' Near-zero request counts over a week is a strong idle signal. (For NLBs, use the AWS/NetworkELB namespace and ActiveFlowCount .) Step 2 - Check for empty or unhealthy target groups A load balancer with no healthy targets is doing nothing useful: for tg in $( aws elbv2 describe-target-groups \ --load-balancer-arn <lb-arn> \ --query 'TargetGroups[].TargetGroupArn' --output text ) ; do echo "== $tg ==" aws elbv2 describe-target-health --target-group-arn " $tg " \ --query 'TargetHealthDescriptions[].TargetHealth.State' --output text done Empty output (no targets) or all unhealthy alongside near-zero requests is a confident "delete me." Step 3 - Delete saf

A surprising share of "the app is down" pages resolve to a name-resolution problem, not a broken service. The service is fine; the client can't turn a name into an address. dig is the precision tool for proving that in seconds instead of guessing. Think about it as a resolution chain, not "is DNS broken" When a name fails, work the chain: which resolver did the client ask, what did that resolver return, and does it match what authoritative DNS actually says? Most incidents live in the gap between those three. The method is boring and reliable: observe the symptom, form a hypothesis about where in the chain it breaks, test with one query, read the evidence, fix, then validate. The single most important habit: query the name from the same host and the same resolver the app uses. Running dig from your laptop proves nothing about what the pod or VM sees. The record types worth knowing You don't need all of them, but you need to recognize them: A / AAAA — name to IPv4 / IPv6 address. The usual suspect. CNAME — an alias pointing at another name. A stale or wrong CNAME sends traffic somewhere unexpected. MX — mail routing. TXT — SPF, DKIM, domain verification, and other metadata. NS — which servers are authoritative for a zone. SOA — the zone's serial and TTL defaults; the serial tells you whether a change has propagated. PTR — reverse lookup, IP back to name. The commands that actually earn their place Start with the quick answer, then get precise. dig +short api.internal.example.com +short strips everything except the answer. If it prints an IP, resolution works from this host. If it prints nothing, you have a real failure to chase. Empty output is a signal, not an error. dig api.internal.example.com A The full form. Read the status in the header: NOERROR with an ANSWER section is good; NXDOMAIN means the name genuinely doesn't exist; SERVFAIL points at a broken upstream or DNSSEC issue. Also note which SERVER answered at the bottom — that's the resolver you're actually

The early website Hot or Not taught its users to rank people at scale. Twenty-six years later, dating apps are trying to escape the culture the site helped create.

The tunnel comes up. wg show prints a recent handshake. The client has its address inside the tunnel. And not a single byte reaches the internet. Almost every guide answers this with "open UDP 51820 in the firewall". You already did that — it is why the handshake works at all. The problem is somewhere else, and UFW makes the distinction easy to miss: Entering a machine and traversing it are two different permissions. ufw allow 51820/udp lets packets arrive at the server. Your clients' traffic does not stop there — it goes through the box and out the public interface. That path lives in the FORWARD chain, which UFW denies by default and which no allow rule touches. The four things to check, in order 1. IP forwarding — and the file that overwrites the other file This is the one that costs hours, because the setting looks done. UFW loads its own sysctl file at startup, and it takes precedence over the system one. A value you carefully set in /etc/sysctl.conf can be silently overwritten on the next ufw enable . The right place is /etc/ufw/sysctl.conf : net / ipv4 / ip_forward = 1 net / ipv6 / conf / default / forwarding = 1 net / ipv6 / conf / all / forwarding = 1 Then check the effective value, not the file you just edited: sysctl net.ipv4.ip_forward 2. Forwarding, which is not the same as ingress Targeted, and the one to prefer: sudo ufw route allow in on wg0 out on eth0 Or globally, in /etc/default/ufw : DEFAULT_FORWARD_POLICY = "ACCEPT" The second opens forwarding for every interface. It is a good ten-second diagnostic and a poor permanent configuration. 3. NAT, which UFW never adds on its own Without it, packets leave carrying their tunnel address, which nothing on the internet knows how to answer. In /etc/ufw/before.rules , at the very top , before the *filter line: *nat :POSTROUTING ACCEPT [0:0] -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE COMMIT Two classic mistakes here: putting this block after *filter (it is then ignored), and copying eth0 without chec

I've written before about SMESH, a coordination protocol modelled on mycorrhizal networks — the fungal web that lets trees in a forest warn each other about drought and disease with nothing in charge of the network. Signals diffuse, decay on their own, and get reinforced when independently confirmed. Consensus emerges instead of being orchestrated. That was the idea. This post is about the part where I found out whether it worked. The transport that had never run SMESH has had a QUIC transport in it for a while. Roughly 500 lines: a quinn endpoint that is simultaneously server and client, self-signed certs, length-prefixed bincode frames over unidirectional streams, an accept loop that spawns per-connection and per-stream tasks, connection pooling. Every test passed. The workspace was green. I could point at smesh-runtime/src/transport.rs and say "yes, it does peer-to-peer." Then I grepped for who actually constructed it: $ grep -rn "QuicTransport" --include = '*.rs' . smesh-runtime/src/transport.rs:177:pub struct QuicTransport { smesh-runtime/src/transport.rs:192:impl QuicTransport { smesh-runtime/src/lib.rs:16:pub use transport:: { QuicTransport, ... } ; Its own definition, and a re-export. Nothing else in the workspace had ever instantiated it. No binary opened a socket. SmeshRuntime imported TransportConfig , stored it in a struct field, and never looked at it again. I had a networking layer with tests, docs, and zero executions. Three bugs in the first twenty minutes I wrote an integration test that starts two runtimes, has one dial the other, and asserts a signal crosses. Here is what fell out before it went green. 1. It panicked on the first call. Could not automatically determine the process-level CryptoProvider from Rustls crate features. rustls 0.23 refuses to pick a crypto backend when more than one is compiled in, and quinn pulls in both through its own feature set. Every call to QuicTransport::new would have panicked for anyone, ever. Nobody noticed bec

Imagine opening a website from India while its servers are located in the United States. You request an image. Your request travels thousands of kilometers to the server, the server processes it, and the response travels all the way back to you. It works. But what happens when millions of users around the world do the same thing? This is where a CDN (Content Delivery Network) comes in. A CDN helps websites deliver content from servers that are geographically closer to users, reducing latency, improving performance, and taking load away from the main server. In this article, we'll understand how CDNs work, why they're important, and how they're used in large-scale systems. What Is a CDN? A Content Delivery Network is a globally distributed network of servers that stores and delivers frequently requested content closer to users. Without a CDN, requests might look like this: User ↓ Main Server ↓ Content With a CDN, a distributed layer is added between users and the origin server: ┌── CDN Edge Server ── User (India) │ Origin Server ────┼── CDN Edge Server ── User (Europe) │ └── CDN Edge Server ── User (USA) The main server is called the origin server . The distributed servers are commonly called edge servers or Points of Presence (PoPs) . Why Do We Need a CDN? Without a CDN, users from different parts of the world may have to communicate with the same origin server. For example: User in India ───────┐ User in Germany ─────┤ User in USA ─────────┼──→ Origin Server User in Japan ───────┘ As traffic grows, this creates several problems: Higher latency More traffic reaching the origin Increased server load Slower image and video delivery Poor performance for users far away from the server A CDN solves this by distributing frequently requested content geographically. How Does a CDN Work? Suppose your website contains an image: /images/product.jpg A user in India requests it. Instead of immediately contacting your origin server, the request goes through the CDN: User ↓ CDN ↓

Z.ai’s latest AI model release could help companies secure their systems—or find its way into the hands of hackers.

Created a VM with hardware from information in one of the many online tutorials on this topic, that is a few years old, and recommends 8GB HDD space on the VM Started the VM with the OPNsense installer DVD ISO mounted on virtual dvdrom drive Went through installer steps to the end where the installer says No space left on device Luckily... I found a forum post where someone mentions the swap partition alone consumes 8GB now, and the VM HDD needs to be 20-30GB Searched ProxMox docs and find the option to expand the size of disk, and enlarge the virtual HDD to 30GB Restarted, but HDD boot "bit" is already set from the "swap partition only" failed install, so the ISO installer won't "try again" and offers no option to wipe the HDD and start over. Decided to drop and re-create the HDD, so I "detached" it, but didn't notice that it hangs around until you "remove" it also, in a separate step. Added a new "blank" HDD... 32GB this time Did another full boot from ISO -> install process... which seemed to work this time (found enough disk space for swap AND install) The reboot at the end boots from installer ISO again. None of the tutorials I found mention that the ISO image must be unmounted before the reboot. Stopped the VM and unmounted the ISO from virtual dvdrom drive Restarted the VM but now the boot process / BIOS won't do anything but PXE network boot. 13 Noticed the initial "unused" HDD and used "remove" to finish getting rid of it. Restarted the VM and went through install process again (not sure why boot bit on the virtual HDD wasn't blocking it this time). Unmounted the ISO from the virtual dvdrom drive again, and rebooted again, but the BIOS is still skipping any attempt to boot from the HDD and tries to do PXE network boot again. Assumed that no boot from HDD might be because the attached HDD is the 2nd one added and has ID=1 (not 0). This might be adjacent to the actual problem (more on that later), but probably wasn't the actual cause. Detached AND "removed" A

“We're not necessarily building in a dogmatic fashion towards full autonomy.”