标签：#r

"The BOHR mission serves as a pathfinder for future nuclear-powered spacecraft."

Waymo will ditch human supervisors in San Diego, Las Vegas, Tampa and Denver.

Meta is adding a new safeguard to stop people from secretly recording others with its AI glasses. But the update comes as the company continues to expand how much personal data its AI products collect and use.

This week, Microsoft took a huge ax to its Xbox business. The company announced that it would be laying off 1,600 workers now, 1,600 more over the next fiscal year, and that it would be shedding four studios. Xbox CEO Asha Sharma hasn't been shy about why she's making such dramatic cuts, saying in a […]

If you’ve got a summer trip coming up, the last-gen Twelve South AirFly Pro is one of those gadgets that can make a long flight feel a little shorter. It lets you use your wireless headphones with in-flight entertainment systems, and right now it’s on sale for $39.99 ($15 off) at Amazon. That’s the best […]

Android Bench is evolving, and developers can help guide that process.

For Paradigm, the technical frontier will stretch beyond its cryptocurrency investment roots. This fund is expected to expand its investment focus to include robotics and AI.

Founded in 2024, Prime Intellect’s goal is to give organizations capabilities to train their own agentic systems without relying on frontier AI labs.

The cyberattack targeting a U.S. insurance giant is the largest known breach of driver's license numbers so far in 2026.

Renders of multiple new Samsung devices have arrived a few weeks before the company's next Unpacked event.

submitted by /u/DanielRosenwasser [link] [留言]

Most Dockerfiles work. That's the problem — "it builds and runs" hides a lot of quiet costs in security, speed, and size that don't announce themselves until an audit, an incident, or a cloud bill does it for them. Here are seven mistakes I see constantly, and what to do instead. 1. Running as root By default, the process in your container runs as root — and if someone breaks out, they're root on a surface they shouldn't be. Add a non-root user and switch to it: RUN useradd --system --uid 10001 appuser USER appuser Cheap, and it closes off a whole category of "well, at least it wasn't root" incidents. 2. FROM some-image:latest latest is not a version — it's "whatever was newest when this happened to build." Two builds a week apart can produce different images with no diff to explain it, and a surprise base upgrade is a fun way to spend a Friday. Pin a specific tag, ideally by digest: FROM node:20.11.1-slim 3. Baking secrets into layers COPY .env . or ARG API_KEY followed by using it — and now the secret lives in an image layer forever , recoverable by anyone who pulls the image, even if a later layer deletes the file. Layers are immutable and additive; you can't delete your way out of a leak. Use build secrets ( --mount=type=secret ) or inject at runtime, never at build. 4. No .dockerignore Without one, COPY . . sweeps your .git directory, local env files, node_modules , and test data into the build context — bloating the image and, worse, potentially baking credentials and history into a layer. A five-line .dockerignore is one of the highest-leverage files in the repo. 5. Layer order that destroys your cache COPY . . RUN npm ci # ← reinstalls on EVERY code change Docker invalidates every layer after the first change. Copy the lockfile and install dependencies before copying the rest of your source, so a one-line code change doesn't trigger a full reinstall. This is a build-speed bug hiding as a style choice. 6. Leaving package manager cruft in the image RUN apt-get

I wanted to understand how malloc actually works under the hood. Most explanations I found online described what an allocator does, but completely skipped over the "why" behind its design decisions. Rather than stopping at theory, I decided to build a cross-platform allocator in C that implements malloc , calloc , realloc , and free from scratch. This article documents the design of that allocator, the architectural tradeoffs I faced, and the core concepts I had to learn along the way. Table Of Contents Design Decisions Architecture Modern Allocator Strategies Core Concepts What's Next Project Overview A custom memory allocator does not create physical memory. Instead, it requests pages of raw virtual memory from the operating system and manages how that memory is partitioned, reused, resized, and released by the application. The goal of this educational project is to implement C's core memory management API using a modular, cross-platform architecture inspired by design principles found in modern allocators, rather than relying on legacy, single-platform tricks. Design Decisions #1: Why I am Skipping sbrk While many classic tutorials use sbrk for educational implementations, I deliberately chose a 100% mmap -based approach for two major reasons: sbrk is a fragile global bottleneck. It works by moving a single pointer (the program break) up and down. This means the allocator assumes it owns a contiguous line of memory. If a third-party library or another thread in the program secretly calls sbrk behind the scenes, the allocator's memory layout can break instantly. mmap , by contrast, provides isolated, independent chunks of memory. Cross-Platform Symmetry. Windows has absolutely no equivalent to sbrk , but it has a direct equivalent to mmap : VirtualAlloc . If we used sbrk , our architectural abstraction ( os_alloc ) would become awkward because Linux would deal with a moving pointer while Windows dealt with independent pages. Using mmap keeps the abstraction perfec

I tried to build an arbitrage bot between Kalshi and Polymarket. Sports seemed to be the easiest because the matcher is relatively easy compared to the other markets (economy, bitcoin, weather, etc.) The matcher worked, we got about ~98% of the sports and e-sports market. But there's barely any sizable arbitrage between Kalshi and Polymarket, and what shows up closes in under 10 seconds. For the Argentina vs Egypt, the match with the disputed VAR call and Argentina's stoppage-time comeback from two goals down. Every price swing on that match, including the two around the VAR call, closed inside about 45 seconds. Total arbitrage opportunity net of fees across the whole match: $439, against $20.8 million moving through Polymarket's market alone and $13.8 million in Kalshi open interest. ( https://dino.markets/blog/argentina-egypt-var-price-gap ) That's not an arbitrage opportunity. That's what an efficient pair of order books looks like once you finally have the tooling to watch them at the same time. I logged this properly over a full day too: 870 cross-venue price gaps in one 24-hour window, median time open about 9 seconds, 96 percent closed inside 30. ( https://dino.markets/blog/how-long-a-mispricing-lasts ). So I shipped the Polymarket-Kalshi sports market matcher as an API instead of an arbitrage trading bot. It turned out the matcher itself was the useful part. Free REST access to the matched feed and the confirmed-arb view, 60 requests a minute, MCP server included so an agent can read it without you writing a client. Planning to open source the matching engine itself at some point. After that, either extend it to other market pairs between Kalshi and Polymarket, or look at arbitrage against traditional sportsbooks. Nothing locked in yet. Feel free to use it and tell me what you think about it. Thanks!