标签：#t

The EPA has proposed a rule change that would let states decide how much input the public has on air pollution permits. It would be a huge boon for data centers increasingly reliant on fossil fuels.

"I don't think you get a model this strong and this quickly on the heels of Fable doing strictly distillation," one expert told TechCrunch.

Gas prices are up, and US car dealerships are full of hybrids. Customers are going for it.

The European Union has fined Google's parent company Alphabet €890 million (about $1 billion) for two separate violations of the bloc's Digital Markets Act (DMA). One penalty is for giving its own products preferential treatment in search results, while the other is for blocking Android developers from sending users to alternate payment options. A €460 […]

Here are the best delivery services and meal kits in 2026, including Martha Stewart’s meal service, a GLP-1–supportive plan, and a budget-friendly option.

MAGA-coded adult content playing off immigration crackdowns, white supremacy, and obeying the “natural order” is finding rabid audiences on X.

Jeremy Edberg & Qian Li discuss why external orchestrators decrease reliability and how to use your existing database for durable execution. They share how DBOS Transact uses standard tables, SKIP LOCKED queues, and unique primary keys to manage complex, fault-tolerant AI workflows with minimal latency, all without the operational overhead of separate distributed systems. By Jeremy Edberg, Qian Li

QCon AI New York 2026 (Dec 15-16) has opened registration at The Westin Jersey City Newport. Six tracks on production AI, chaired by Eder Ignatowicz with Faye Zhang and Wes Reisz. First sessions announced in August, full program by November. By Artenisa Chatziou

The next time you’re locked out of your Google account, you can use your face as part of the account recovery process.

The risks are real. But banning children from the internet could create new problems without solving the ones that really matter.

Google announced yet another way to gain access to your account if you get locked out, forget your password, or don't have access to the phone, computer, or two-factor authentication apps you typically use. As the name implies, selfie video lets you capture a short video of your face on a mobile device or PC, […]

Turn messy bank exports into clear financial decisions Discussion | Link

Data preservation layouts are no longer just an exercise in handling routine disk failures; they are a direct line of defense in an active cyber-warfare environment. Far too many system administrators blindly default to writing simple, unencrypted shell scripts tied to legacy system utilities. Operating obsolete data-mirroring procedures introduces severe vulnerabilities to enterprise architectures. Traditional file sync tools completely lack client-side encryption barriers, leaving raw production data completely exposed to third-party infrastructure hosts. Furthermore, standard backup approaches consume vast amounts of unnecessary bandwidth by redundantly transferring identical files over and over again. Restic completely destroys this insecure paradigm. Written from the ground up in Go, Restic enforces client-side AES-256-CTR cryptographic encryption by default, ensuring no plain-text data ever traverses the network interface. Leveraging advanced content-defined chunking algorithms, it performs lightning-fast block-level deduplication to compress your overall storage footprint to a minimum. Phase 1: The Backup Orchestration Myth Understanding the architectural superiority of a native Go-compiled, client-side encrypted backup engine is critical before designing your disaster recovery pipeline: Architectural Metric Legacy Sync Tools BorgBackup Platform Modern Restic Engine Native Cloud S3 Support Requires Rclone Mounts Requires Third-Party Proxy Layers Native Compiled Support Default Cryptography None (Plain-Text Transmissions) Client-Side AES-256 AES-256-CTR Client-Side Data Deduplication File-Level Verification Only Content-Defined Block Level Content-Defined Block Level Cross-Platform Portability Variable Compatibility Strictly UNIX/Linux Constrained Single Static Go Binary Phase 2: The Append-Only Lock Paradox (IAM Fix) The most dangerous operational vulnerability found in generic Linux documentation involves key privileges. Amateurs store fully unconstrained ad

Ink & Switch published bijou64, a variable-length integer encoding where every number has exactly one byte representation, closing the canonicality bug class behind attacks on PKCS#1, JWT libraries, and Bitcoin. The design also decodes two to ten times faster than LEB128. Community ports to Elixir, Go, Perl, and Java followed, while HN commenters debated SIMD performance and residual range checks. By Steef-Jan Wiggers

Over the past few months, I've been exploring how AI agents can fit into a modern CI/CD pipeline—not to replace engineers, but to eliminate repetitive work that slows teams down. Here's what worked well: ✅ Automatically categorized incoming pull requests ✅ Flagged potential security and dependency issues ✅ Suggested fixes for linting and test failures ✅ Generated review summaries for faster code reviews ✅ Reduced context switching for reviewers The biggest lesson? AI is most valuable before the human review begins. The Problem Every engineering team eventually runs into the same issue. Developers submit pull requests faster than reviewers can process them. A typical PR often goes through several repetitive steps: CI builds Unit tests Linting Dependency checks Security scanning Style comments Reviewer assignment Documentation validation None of these tasks require deep architectural thinking, yet they consume valuable engineering time. I started wondering: What if an AI agent handled the first round of triage automatically? The Workflow Instead of waiting for a human reviewer, the pipeline lets an AI agent inspect every pull request immediately after CI starts. Developer │ ▼ Pull Request Created │ ▼ CI Pipeline Starts │ ▼ AI Agent ├── Analyze changed files ├── Review commit summary ├── Detect risky changes ├── Check coding standards ├── Explain failing tests ├── Suggest fixes └── Generate PR summary │ ▼ Human Review By the time a reviewer opens the PR, much of the routine analysis is already complete. Example GitHub Actions Workflow A simplified workflow might look like this: name: AI Pull Request Review on: pull_request: types: [opened, synchronize] jobs: ai-review: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - name: Run Tests run: npm test - name: Run Linter run: npm run lint - name: AI PR Analysis run: ./scripts/ai-review.sh The AI step can analyze: Test failures Lint violations Changed files Security findings Dependency updates before publishing a r

The fast fix If your GitLab CI job fails with Cannot connect to the Docker daemon at unix:///var/run/docker.sock , your docker client is looking for a local socket that does not exist inside the job container, because DOCKER_HOST is not set. Point the client at the docker:dind service over TCP and the error goes away: build : image : docker:28.3 services : - name : docker:28.3-dind alias : docker variables : DOCKER_HOST : tcp://docker:2376 DOCKER_TLS_CERTDIR : " /certs" DOCKER_CERT_PATH : " /certs/client" DOCKER_TLS_VERIFY : " 1" script : - docker info - docker build -t my-app . That is the whole fix for the common case. The rest of this page explains why the socket variant of the error is different from the tcp://docker:2375 variant, and covers the two other setups (socket-mounted runners and the Kubernetes executor) where the same message shows up for a different reason. Why you get the unix socket variant specifically This error is not the same as Cannot connect to the Docker daemon at tcp://docker:2375 . The address in the message tells you exactly what the client tried: Cannot connect to the Docker daemon at unix:///var/run/docker.sock. Is the docker daemon running? When DOCKER_HOST is empty, the Docker CLI falls back to its compiled-in default, the local unix socket at /var/run/docker.sock . Inside a GitLab CI job that uses the docker executor, that socket file simply is not there. The daemon runs in a separate docker:dind service container, not in your job container, so there is nothing listening on the local socket. The client connects, finds no socket, and prints the message above. The tcp://docker:2375 form is the opposite problem: DOCKER_HOST is set correctly but the dind service is not reachable (missing service, no privileged mode, or a TLS mismatch). If you are seeing that address instead, read the companion write-up on the tcp://docker:2375 form of this error , which walks the service and privileged-mode causes in detail. This page is about the case w

Teams treat "externalize the rules" as two different decisions depending on the stack. In Node, it's "which npm package handles conditionals." In Java, it's "do we adopt Drools." Both framings are wrong in the same way — they turn an architecture decision into a product decision before anyone's actually designed the seam. The seam is the same regardless of language: rules become data instead of control flow, the boundary between your service and the rule layer is typed on both sides, and a contract test catches the moment a rule change would silently break what your code expects back. Get that seam right and it barely matters whether you're calling it from Express or Spring Boot. Get it wrong and you've just moved your if statements into a config file and called it progress. The seam: rules as data, not control flow The actual pattern is small. Instead of branching logic living inline in a handler or a service method, you define a typed input, a typed output, and a rule set that maps one to the other — evaluated somewhere the calling code doesn't need to know the internals of. That's it. That's the whole architectural move. Everything else — which engine, which language, how it's hosted — is an implementation detail on top of that seam. Most of the friction teams run into with a low-code layer in Node.js or a Java service isn't the rule engine choice. It's skipping the typed boundary and finding out three months later that a rule change silently returns a shape the calling code wasn't built to handle. Node.js: keeping the boundary typed Here's the seam in a TypeScript service. The route handler never sees a conditional — it sees a typed input going in and a typed decision coming out: interface PricingInput { userTier : " free " | " pro " | " enterprise " ; cartTotal : number ; couponCode ?: string ; } interface PricingDecision { discountPercent : number ; reason : string ; } async function evaluatePricingRule ( input : PricingInput ): Promise < PricingDecision > { c

A background worker sits quietly for weeks, chewing through a job queue without incident, and then one Tuesday afternoon it disappears mid-batch, taking forty in-flight jobs down with it. No stack trace pointing at the offending line, no alert until a customer notices their export never finished. Nine times out of ten, the culprit is one of the most under-discussed failure modes in server-side JavaScript: unhandled promise rejections. They are easy to introduce, easy to miss in code review, and in modern Node.js they no longer just print a warning — they can end your process outright. This post walks through what unhandled promise rejections actually are at the engine level, why they are far more dangerous in long-running Node.js services than in typical web requests, how Node's default behavior around them has shifted over the years, and the concrete patterns you can use to stop them from quietly killing your jobs. What an Unhandled Promise Rejection Actually Is At the JavaScript engine level, a promise is a state machine with three possible states: pending, fulfilled, or rejected. When an async operation fails — a network call times out, a database query throws, a JSON parse blows up — the promise representing that operation transitions to the rejected state and carries a reason, usually an Error object. That's all a rejection is: a value flowing down the promise's error channel instead of its success channel. The engine only considers a rejection "handled" if, by the time it does its bookkeeping (which happens on a microtask checkpoint, not synchronously), there is a .catch() handler, a second argument to .then() , or a surrounding try/catch around an await somewhere in that promise's chain. If none of those exist anywhere in the chain, the rejection is classified as unhandled. This is the precise, narrow definition of unhandled promise rejections: a promise that reaches the rejected state with zero handlers attached anywhere along its chain of consumers. It's wo

I cranked Apple’s iOS 27 beta to maximum transparency on my iPhone and enjoyed every warped second.

RAMageddon has claimed yet another victim, with Framework now announcing a "major and unfortunate" pricing update for its upcoming premium laptop - which also impacts folks who preordered it. Memory configurations for the Laptop 13 Pro have been adjusted after Framework says it received cost updates from its memory supplier that "are more than double […]