标签：#r

Last month, I had a problem with a popular mobile banking app in Southeast Asia. Nothing exotic. A transaction didn't go through, and my support ticket had been sitting untouched for two weeks. So I opened the app's chatbot. It greeted me warmly, asked how it could help, and then couldn't do a single useful thing. It couldn't look up my transaction. It couldn't check the status of my ticket. It couldn't tell me why my issue was unresolved. It could answer FAQ questions, and that was it. I called the hotline instead. Spent an hour navigating prompts, got bounced between menus, and every path ended the same way: "Please contact our chatbot or check your existing ticket." The system was built for deflection, not resolution. The ticket that nobody had touched for fourteen days. I gave up. And somewhere in that company's dashboard, my interaction counted as a successful AI chatbot deflection. The uncomfortable part: if you shipped a deflection-optimized bot this quarter, a customer somewhere is living this exact loop right now. Your dashboard is calling it a win. The Deflection Metric Everyone Loves (and Nobody Questions) Deflection rate measures the percentage of customer contacts handled without a human agent. It's cheap to track, easy to celebrate, and it maps directly to cost savings. Industry benchmarks citing McKinsey's 2026 service operations data put AI resolutions at $0.62 per ticket versus $7.40 for human agents. That's a 12x cost difference. Of course executives love this number. But deflection doesn't measure whether the customer's problem got solved. It measures whether the customer stopped asking. Those are very different things. This is Goodhart's Law applied to customer experience: when a measure becomes a target, it ceases to be a good measure. Deflection is cheap and easy to optimize. Resolution is hard and expensive to track. So companies optimize the proxy and stop looking at the goal. Gartner data, as reported by Forbes , confirms the gap: only 14% o

Over the past year, one concept has fundamentally changed how I think about AI applications. Not larger language models. Not better prompts. Not even AI agents. It's Model Context Protocol (MCP) . For a long time, most AI applications lived inside a closed environment. They could generate text, answer questions, or write code, but they couldn't easily interact with external systems. MCP changes that. It provides a standardized way for AI models to communicate with tools, databases, APIs, and applications. Instead of building custom integrations for every project, developers can expose capabilities through MCP servers. After experimenting with different workflows, these are five MCP servers that have had the biggest impact on how I build AI applications. 1. GitHub MCP Server If you're building software with AI, GitHub integration is one of the most valuable capabilities you can add. Imagine asking an AI assistant to: Read a repository Review pull requests Search issues Create commits Open new issues Inspect project structure Instead of manually copying files into ChatGPT, the AI can interact directly with your repository. For developers, this dramatically improves productivity. Typical workflow: Developer Request ↓ GitHub MCP Server ↓ Repository ↓ LLM ↓ Action or Response This is far more scalable than copying snippets of code into prompts. 2. Filesystem MCP Server Almost every AI workflow eventually needs access to local files. Examples include: Reading documentation Editing Markdown Creating reports Refactoring code Updating configuration files Without an MCP server, these tasks often require multiple manual steps. With a Filesystem MCP server, an AI application can safely interact with project directories. For example: Read: /docs/api.md Update: /src/routes.py Create: /reports/summary.md This makes AI assistants feel much more like development partners. 3. PostgreSQL MCP Server One limitation of traditional chatbots is that they don't know your data. Connecting an

We're upgrading Crawlberg to a new version: Crawlberg v1.0.0. It builds on the previous kreuzcrawl. It declares the public API frozen under the new project name. All technical features below shipped in v0.3.0 (2026-06-23); v1.0.0 is a stability declaration and rename, not a new feature release. The four production-facing changes most likely to require operational action: Package and env var rename - every artifact identifier has changed; see the migration table. SSRF defense is now on by default - internal crawl targets (localhost, RFC 1918, cloud metadata) will fail without CRAWLBERG_ALLOW_PRIVATE_NETWORK=1 . CrawlError::WafBlocked is now a struct variant - exhaustive match arms will not compile until updated. max_retries semantics changed - off-by-one fixed; max_retries=3 now produces exactly 3 retries. Precompiled binaries cover Linux (x86_64/aarch64), macOS (ARM64 and x86_64), and Windows x64. Homebrew bottles and Docker images on GHCR are also available. What Is Crawlberg? Crawlberg is a web crawling engine written primarily in Rust that exposes a single consistent API across 14 language runtimes. It handles HTTP transport, JavaScript rendering, robots.txt compliance, per-domain rate limiting, SSRF safety, and structured extraction. Extension points ( Frontier , RateLimiter , CrawlStore , EventEmitter , ContentFilter , WafClassifier , ProxyProvider ) are injectable traits; wire in your own frontier, storage backend, or proxy pool without forking the engine. A single scrape() call returns text, metadata, links, images, assets, JSON-LD, Open Graph tags, hreflang, favicons, headings, response headers, and clean HTML→Markdown. When a site requires JavaScript, the optional headless browser tier handles it transparently. v1.0.0 promotes v1.0.0-rc.2 and freezes the public API under the new project name. The features described in the sections below represent the platform that 1.0.0 declares stable; they shipped in v0.3.0. What v1.0.0 Declares Stable These capabilities

Windows Persistence Techniques (MITRE ATT&CK Mapped) – Complete Red Team Course Windows persistence is one of the most important topics for red teamers, malware analysts, DFIR professionals, and cybersecurity students. Understanding persistence techniques helps both attackers simulate real-world threats and defenders detect and respond to them. This article accompanies my full YouTube course, which covers Windows internals, persistence mechanisms, privilege escalation, post-exploitation concepts, and digital forensics in a controlled lab environment. 📺 Full Video What You'll Learn Windows Boot Process Windows Architecture Windows System Calls Windows Memory Management PEB & TEB Structures Windows Persistence Techniques Registry-Based Persistence DLL Hijacking Windows Services Scheduled Tasks Digital Forensics Registry Analysis Privilege Escalation Concepts Post-Exploitation Techniques MITRE ATT&CK Mapping Tools Covered Mimikatz AccessChk PowerUp PrivescCheck SharpUp RegRipper Registry Explorer Regshot SessionGopher LaZagne PSRecon Frogman Tool LogonTracer credump Course Structure Windows Internals Persistence Techniques Digital Forensics Privilege Escalation Post Exploitation MITRE ATT&CK Mapping GitHub Resources Windows Persistence Repository https://github.com/manikandantn68/window-persistence-Privilege-Escalation Frogman Tool https://github.com/manikandantn68/frogman-tool Intended Audience Cybersecurity Students SOC Analysts Blue Team Engineers Red Team Operators Malware Analysts Digital Forensics Investigators Penetration Testers Educational Disclaimer This course is intended solely for educational purposes and demonstrates techniques within an authorized lab environment. Always obtain proper permission before testing or assessing systems you do not own or administer.

The access you revoked in your last review is probably still live. I know how that sounds, but it is how most access recertification actually works. A tool generates a list, an owner clicks approve or revoke, the cycle gets marked complete, and then nothing touches the real resources. The review produces a record. The permissions stay exactly where they were. You attested to a state that was never made true. That gap bothered me for a long time, so I built something to close it and open-sourced it on AWS's aws-samples org. It is called VIGIL. The core idea A normal review answers one question: should this access still exist? The owner says no, a ticket gets filed, and maybe someone actions it next quarter. Between the decision and the change, the risk just sits there. I wanted the decision and the change to be the same step. So VIGIL does four things: It discovers resources by their owner tag and works out who actually has access to each one. It asks the owner to keep, trim, or remove that access. It applies that decision on the live resource. It records what happened in a way you can later prove. The part I care about most: scoped enforcement The lazy way to revoke someone's access to one bucket is to detach their policies. That nukes their access to everything, and it is how you cause an incident while trying to improve security. VIGIL never does that. If the access came from a bucket policy, it removes just that principal, or just the specific actions, from that bucket's policy. If the access came from the principal's own IAM policy, it adds a resource-scoped explicit Deny instead of touching shared policy, so nothing else the principal can do is affected. In practice it can remove only s3:PutObject for one principal on one bucket and leave everything else alone. If a change cannot be made safely and narrowly, it raises a ticket instead of guessing. I would rather it do nothing than do something broad. Making enforcement durable Enforcement is not a synchronous c

Key takeaways Summarizing conversation history can reduce costs by up to 60%. Implementing an effective summarization algorithm is key to efficiency. Balancing detail and brevity in summaries is crucial for context. Optimized context windows lead to faster response times and lower latency. The problem Startups leveraging large language models (LLMs) often face significant costs associated with managing context windows during conversations. Each token processed incurs a cost, and as conversations grow, replaying entire histories can lead to runaway expenses. Founders and engineers encounter this issue particularly during customer support interactions or chatbots, where lengthy dialogues require constant context retention, drastically inflating operational costs. What we found Our research indicates that instead of replaying the entire conversation history, summarizing the dialogue can maintain context while drastically reducing token usage. By distilling key points and intents into a concise summary, we can effectively minimize the number of tokens processed, leading to major cost savings without sacrificing the quality of interaction. This non-obvious insight repositions how we approach conversation management in LLMs. How to implement it Start by selecting a summarization algorithm suitable for your use case. Techniques like extractive summarization (e.g., using TextRank) can identify and retain essential sentences from conversations, while abstractive methods (e.g., fine-tuning a transformer model) rephrase the content. Next, integrate this summarization step into your workflow: after each interaction, generate a summary that captures the main points. Ensure that the summary is stored and utilized as context for subsequent interactions, replacing the need for the entire conversation history. Monitor token usage before and after implementation to quantify cost savings. How this makes life easier By summarizing conversation history, startups can see a reduction in c

Your docs pipeline, from the terminal PaperQuire v0.2.0 ships with a full command-line interface. Everything you can do in the desktop app — render, template, brand — now works from your terminal. This means you can automate document generation, integrate PaperQuire into CI/CD pipelines, and batch-process entire directories of Markdown without opening the GUI. Quick start If you installed via Homebrew, the paperquire command is already on your PATH: brew install --cask paperquire/paperquire/paperquire Verify with: paperquire version The simplest render is just: paperquire report.md This produces report.pdf in the same directory, using the default template. What you can do Render with options Apply templates, set metadata, control output: paperquire report.md -t corporate --title "Q2 Report" --author "Jane Doe" paperquire spec.md --page-size a4 --margins 0.75,0.75,0.75,0.75 --no-toc paperquire draft.md --watermark "DRAFT" -o drafts/draft.pdf All 22 flags from the desktop app's Document Setup panel are available. See the full list in the CLI Reference . Pipe through stdin/stdout PaperQuire works in Unix pipelines: cat notes.md | paperquire - --stdout > out.pdf Use - as the input file to read from stdin, and --stdout to write the PDF to stdout instead of a file. Batch render directories Render every Markdown file in a directory with one command: paperquire batch ./docs -o ./out paperquire batch ./project --glob "**/*.md" -t corporate paperquire batch ./docs --concurrency 8 --continue-on-error Use --dry-run to preview which files would be rendered without actually producing output. Manage templates List, inspect, create, and share templates: paperquire templates list paperquire templates show minimal-clean paperquire templates init my-template paperquire templates export corporate -o corporate.pqt paperquire templates import ./shared-template.pqt We also launched a community templates repo where you can browse all built-in templates and submit your own via pull request.

What building cross-service RBAC taught me about the difference between a fast check and a correct one VaultPay is a wallet microservice I built on top of AuthShield. Previous parts: Part 1 is here: I Built AuthShield and Immediately Knew It Wasn't Enough Part 2 is here: The Silent Failure I Never Saw Coming: What VaultPay Taught Me About Consistency Under Failure Part 3 is here: I Started With a Blocklist. That Was the Wrong Instinct and VaultPay Taught Me Why. Part 4 is here: I Watched Money Move Twice From the Same Request. That's When I Understood Idempotency. Part 5 is here: I Almost Hashed a Document Number That Needed to Be Read Again When I designed JWT validation for VaultPay, the only thing I was optimising for was speed. Local verification, no network call, decode the token with the shared secret, read the claims, move on. Every request gets this. It's fast - no round trip to AuthShield, no added latency on the hot path. That felt like the obvious right answer for a system processing financial transactions, where every millisecond on the request path matters. Then I asked myself a question I hadn't thought through properly: what happens if an admin gets deactivated in AuthShield right now, this second, while they still have a valid token sitting in their browser? The answer, with pure local validation, is uncomfortable. Nothing happens. The token is still cryptographically valid. The signature checks out. The claims say role: admin . VaultPay has no way of knowing that AuthShield revoked this person's access thirty seconds ago, because VaultPay never asked AuthShield. It just trusted the token. That's the moment dual-mode validation stopped being a performance optimisation and became a correctness requirement. Two Services, No Shared Database VaultPay and AuthShield are separate microservices with separate databases. AuthShield owns user accounts, login, JWT issuance, and role management. VaultPay owns wallets, transactions, KYC, and admin operations on t

I log commutes in a spreadsheet because mobility apps smooth over the ugly legs. Last week I added a column I should have tracked years ago: carry seconds ? time from curb to platform when stairs replace ramps. The hidden leg My one-wheel leg is fine on paper. Three metro exits on my route have no elevator during maintenance. Carrying a 14 kg wheel down 22 stairs does not show up in trip duration. It shows up in whether I arrive annoyed enough to skip coffee. What I logged (one week) Exit Stairs Carry time (s) Mood after (1-5) North gate 22 38 2 Side ramp (control) 0 8 4 East stairs 16 29 3 Battery delta on those days? Within noise. Mood delta? Not noise. A cheap decision rule I turned this into a go/no-go check before leaving: if stairs > 15 AND carry_weight_kg > 12: prefer transit-only or locker elif stairs > 0 AND wet_floor: walk the wheel (no riding in station) else: ride It is blunt. It works better than pretending every leg is rideable. Assumptions up front Wheel weight includes pads and charger pouch (~14 kg for my commuter setup). I am not timing competitive carries ? just whether I can do this daily without hating it. Your threshold differs if every exit has elevators. What I would do differently I would log carry seconds from day one, same tab as distance and battery percent. Range math without carry math is incomplete for anyone who mixes metro and one-wheel. I work around personal EVs and sometimes cross-check specs on the official Kingsong catalog. https://www.kingsong.com/collections/electric-unicycle

When the enemy is too strong to attack directly, attack what they hold dear. They will come to you...

submitted by /u/devAndreotti [link] [留言]

Comparing the most feature-rich React data grids in 2026, from pivot tables and tree data to...

XSDR is a unified pipeline for monitoring activity on X and the web. I built it because I wanted my agent to do things based on real-time events that were taking place instead of polling the web or scheduling cron jobs. With XSDR, you can trigger agentic loops based on real-time events. All you need is an API key, a webhook that can receive POST requests, and an idea of what you’re looking for. It currently supports X and Firehose (aka a persistent web crawler).

According to ChartMogul's 2026 analysis of 200 B2B software products, the median free-to-paid...