标签：#t

Amazon has released AWS FinOps Agent in public preview, a managed service that automates several common FinOps workflows. The agent can investigate cost anomalies, correlate spend changes with AWS activity data, and integrate with tools such as Slack and Jira to route findings to resource owners. By Renato Losio

Dilip Asbe said that newer UPI apps could be more competitive with a viable commercial model

Stop re-explaining your project to AI coding agents Discussion | Link

GitHub热门项目 | LTX Director and a variety of other custom ComfyUI nodes and workflows | Stars: 1,535 | 234 stars this week | 语言: JavaScript

One day a user reported an oddly asymmetric bug. In the "add new site" modal, picking an SSH profile and clicking "auto-detect WordPress install path" always failed with "no path found." But clicking the WP-CLI path test button on the same SSH connection worked fine . Same credentials, same host — one succeeded, the other failed. Tracing it down, the culprit was an old foe: csh / bash incompatibility on the server side . This post walks through the fix, sweeping the same bug across the rest of the codebase, and the static-analysis test we added to keep it from coming back. The smoking gun — find: 2: unknown primary or operator The server-side error log gave it away: find: 2: unknown primary or operator find itself is POSIX-standard, but it was dying with a mysterious 2 argument. That 2 is the leading number of 2>/dev/null — a redirect that was being passed as a literal argument to find because the shell never interpreted it as a redirect in the first place . Note: 2>/dev/null is the standard way to silently discard stderr in Bourne shell (sh) and bash. csh (C shell) uses different syntax and doesn't recognize it. Sakura Internet defaults users to csh We've documented this before in the four-host investigation of why WP-CLI doesn't run : on Sakura Internet (Japanese host), the default user login shell is csh / tcsh , not bash. This collides with how paramiko (Python's SSH library) works: exec_command runs the command through the user's login shell. Sending find ... 2>/dev/null to a Sakura host means csh tries to interpret it and chokes . That's the real error. The bash/sh idioms that fall over on csh include: 2>/dev/null (redirect) [ -f path ] (test syntax) for X in ...; do ... done (loop) cmd1 && cmd2 (short-circuit) \( ... \) (subshell) These all blow up with "unknown primary or operator" or "Missing }" on csh. "I fixed one site, so they're all fixed" — but they weren't This wasn't our first encounter with this issue. A few release rounds earlier, we'd noticed test

Why did I build Aegis Pulse? As always, it started with a simple thought that keeps getting me time and time again: "I should automate this." So, I announced Aegis Stack publicly on Reddit on December 3rd. From that very moment, I became great friends with the Unique Clones / Total Clones & Unique Visitors / Total Views charts in GitHub's analytics page. Due to the nature of aegis-stack, every stack that is spun up will clone the actual repo itself (outside of caching situations, which may vary from user to user). I didn't realize it at the time, but those clone numbers, especially the Unique Clones, would become the most important metric for me to track usage. There's this funny thing that happens when you release an OSS tool. You expect people to say something, maybe tell others, ask questions... just... something... Instead, the person looks at the tool, sees if it makes their life easier, and puts it in their bag of other tools. I know this, because this is me! I never thought about it until I'm on the other side. I had to mentally go through all the tools I had used over the years, and realized I never cared about anything other than the tool itself. And if it didn't work, I would try to make it work, and if not, just move on. Time is money, and all of that. All of that is to say, clones are something I have been tracking since day one. Now... GitHub has a 14-day rolling window period in which they have daily values, and the 14-day rolling totals. And when I say 14 days, I mean it. That's all you get, and it's on you to keep track of everything outside of that. Fair enough. Thus began the daily ritual of going and grabbing the latest numbers from the previous day, and pasting the data into 3 separate AI chats: ChatGPT, Claude Opus, and Google Gemini. I figured that since I was already storing all of this data, I might as well see what type of insights I could get from these chats (which were preloaded with enough context to know what's going on). It was a great

If you send SMS one-time codes, there's a decent chance you're paying scammers to phone-spam themselves on your dime. It even has a name: SMS pumping . And it's not a rounding error — Elon Musk claimed Twitter was losing ~$60M/year to fake 2FA traffic before they killed SMS 2FA for free accounts. Here's how the scam works, why SMS 2FA is structurally expensive, and why flipping the direction — mobile-originated (MO) 2FA , taken to its logical end over iMessage — fixes both the cost and the fraud at once. What is SMS pumping? SMS pumping (also called AIT — Artificially Inflated Traffic , or SMS toll fraud ) is a scheme where bad actors abuse a form that sends SMS one-time codes. They pump thousands of phone numbers — usually premium ranges they secretly control with a telecom — into your "send me a code" endpoint. You pay for every one of those messages. A cut of that termination fee flows back to the fraudsters via the carrier. The "users" never log in. They were never users. The entire point was to make your verification endpoint dial a meter that pays them. The structure that makes this possible is simple: you, the company, send (and pay for) the message. Every code is revenue for someone in the delivery chain — so there's a direct financial incentive to trigger as many as possible. Why SMS 2FA is expensive even without fraud Even with zero abuse, application-to-person ( A2P SMS ) is a bad cost curve: You pay per message. Volume spikes — a launch, a bot attack, an international audience — turn into surprise bills. International is brutal. Cross-border A2P carries steep carrier surcharges that vary wildly by destination. Carrier fees and registration overhead. In the US you're funneled through A2P 10DLC registration, brand vetting, and per-segment fees before you send a single legit code. So your 2FA line item is pay-per-event , unpredictable , and exploitable . Three bad properties for something that's supposed to be boring infrastructure. The Twitter/X case This

You exported a product CSV, edited it in Excel or Google Sheets, and uploaded it to Shopify. Shopify shows a generic error — or worse, it silently imports the wrong thing: a handle gets overwritten, a variant attaches to the wrong product, half your rows go missing. You find out days later from a customer. Shopify CSV Preflight Validator checks the file before you upload it. It runs locally on your machine, never touches your store, needs no API key, and returns three things: fixed_products.csv — a safe copy with the unambiguous, mechanical mistakes already corrected. errors.csv — a machine-readable list of every finding (row, rule, severity, suggested fix). report.md — a human-readable report you can read in 30 seconds. No login. No upload of your catalog to a third party. Just a file in, a verdict out. Why CSV imports fail (and why the error message doesn't help) Shopify's product CSV import is a two-stage process: it validates the file, then applies rows. A file can pass the upload dialog and still misbehave on apply. The most common ways merchants get burned: A spreadsheet adds a UTF-8 BOM to the first cell. The first header ( Title ) becomes invisible-garbage + Title , so Shopify can't find the title column. Header case / legacy names drift. title instead of Title , Handle instead of URL handle . Some get ignored, some get rejected. A variant row loses its parent handle. Shopify can't tell which product the variant belongs to. Two product rows share one handle. Shopify silently keeps one and overwrites/merges the other. Image alt text with no image URL, negative prices, compare-at prices below the real price — small data bugs that ship to your live storefront. These are not exotic. They're what happens every time a human edits a CSV in a spreadsheet. What the tool actually does — a real run Here is a messy export with several of the problems above. Running: csv-preflight check messy-product-import-sample.csv --out-dir ./out --lang en produces this report.md (ve

The decision to migrate an on-premises database to the cloud is rarely a simple one. It touches infrastructure, budget, team workflows, and application uptime all at once. Yet for most organizations, moving your on-premises database to the cloud is no longer a question of if but when — and more importantly, how to do it without bringing production systems to their knees. Whether you're running PostgreSQL on bare metal or SQL Server in a company-owned data center, the path to cloud-hosted data has predictable pitfalls and, when navigated carefully, significant payoffs. This guide walks through the full migration process: from pre-migration assessment to post-migration validation, with real configuration examples and the kind of hard-won detail that vendor documentation tends to skip. Why Organizations Make the Move On-premises databases carry hidden costs that compound over time. Hardware refresh cycles, licensing renewals, physical security, power, and cooling — these expenses are easy to underestimate when they're already baked into the operating budget. Cloud databases shift that burden to a consumption model, where you pay for what you use and scale without a procurement cycle. Beyond cost, there's the question of availability. Cloud providers like AWS, Google Cloud, and Azure run managed database services with built-in replication, automated failover, and point-in-time recovery that would take a dedicated DBA weeks to configure manually. A startup can get enterprise-grade durability out of the box. A mid-sized company can stop worrying about what happens when a hard drive fails at 2 a.m. Performance is another draw — though it comes with caveats. Managed cloud databases excel at read-heavy workloads and benefit from proximity to cloud-native application services. Latency-sensitive operations or highly custom storage configurations sometimes perform better on dedicated hardware. Knowing which category your workload falls into is the first real question to answer.

TeamLab 那片會跟著你走的花海，原理拆解＋DIY 先看這張圖 這是 TeamLab 在東京台場的《呼應燈之森林》。當你走過去，附近的燈會慢慢亮起；你離開後，燈又慢慢暗下去，像是真的森林一樣。 還有另一個作品《花與人的共存》，花叢會跟著你移動——你站的地方，花就開在你腳邊；你離開，花就凋謝。 這兩件作品的核心邏輯是一樣的。這篇文章就來拆解它。 原理一：偵測位置 TeamLab 的互動裝置需要知道「你在哪裡」。 最常見的方法有兩種： 紅外線感應 ：在地面下方埋紅外線接收器，你走過時阻擋光線，系統就知道有人在這個位置。缺點是只能測「有沒有人」，不能測「人在哪一個方向」。 深度相機（RealSense / Kinect） ：像 Xbox 的體感相機，透過紅外線測量每一個點到你相機的距離，生成一張「深度地圖」。軟體在深度地圖裡找出人體的位置，然後算出座標。 DIY 版本 ：一塊 Arduino + 超音波感測器（HC-SR04，大約 60 元）就能做到基本的「有人靠近」偵測。 原理二：控制回應 知道你在哪裡之後，系統要決定「要做什麼回應」。 TeamLab 的做法是 ：不是「觸發」，而是「強度變化」 。 傳統的感應燈：感應到人 → 燈全亮 → 人離開 → 燈全滅。 TeamLab 的邏輯：感應到人 → 燈慢慢變亮（0.5 秒）→ 人持續在 → 維持亮度 → 人離開 → 慢慢變暗（2 秒）。 「慢慢」是關鍵。瞬間變化讓人注意到「科技」；緩慢變化讓人以為「這個空間有生命」。 這就是「驚奇設計」的核心： 時機對了，物理反應看起來像生物反應。 原理三：集體行為 最後一個秘密：TeamLab 的裝置很少只有一個「回應」。 通常會有 100-500 個元素（燈、花、光點）。每個元素各自計算自己與你的距離，決定自己的亮度或顏色。 當 500 個燈各自以稍微不同的速度亮起和暗下，你看到的不是「一個燈亮了」，而是「一片森林在你腳下呼吸」。 心理錯覺 ：你把「一群各自輕微不同步的簡單反應」，詮釋成「一個整體有意志的生物」。 用 Arduino 自己做一個迷你版 材料： Arduino Uno（大約 200 元） 超音波感測器 HC-SR04（大約 60 元） LED 燈 x 3（大約 15 元） 麵包板和杜邦線 原理很簡單： 超音波感測器偵測距離 距離越近，LED 越亮（用 PWM 訊號控制） 距離越遠，LED 越暗 int trig = 7 ; int echo = 6 ; int led = 9 ; void setup () { Serial . begin ( 9600 ); pinMode ( trig , OUTPUT ); pinMode ( echo , INPUT ); pinMode ( led , OUTPUT ); } void loop () { digitalWrite ( trig , LOW ); delayMicroseconds ( 2 ); digitalWrite ( trig , HIGH ); delayMicroseconds ( 10 ); digitalWrite ( trig , LOW ); long duration = pulseIn ( echo , HIGH ); long distance = duration * 0.034 / 2 ; // 距離越近，LED 越亮 int brightness = map ( distance , 0 , 100 , 255 , 0 ); brightness = constrain ( brightness , 0 , 255 ); analogWrite ( led , brightness ); delay ( 50 ); } 這不是 TeamLab，但這是你自己做的「會呼吸的燈」。每個 maker 都是從這裡開始的。 庭庭：這個看起來很難 真的沒有你想的那麼難。 需要的東西全部可以在蝦皮買到，全部加起來大約 300 元。網路上有超多 Arduino 教學，關鍵字搜「Arduino 超音波 LED」就有幾十篇中文教學。 你不需要懂電子，只需要跟著步驟做，做完會有「哇，我自己做出了一個會亮的東西」的感動。 如果你想更進一步 TeamLab 的進入門檻其實不是技術，是「你要把技術藏在美學後面」。 推薦兩個方向可以繼續研究： p5.js + webcam ：用 p5.js 讀取你的 webcam 影像，偵測顏色或移動。相當於用軟體做到 Kinect 的效果，零硬體成本。 Processing + 投影機 ：把電腦畫面投射到牆上或地面上，加上感測器，就是一個簡單版互動投影。投影機在蝦皮一兩千元就有。 今日概念 ：TeamLab 的魔法不是魔法，是三個原

【互動藝術 DIY】用 p5.js 做一塊會呼吸的粒子背景 先問自己：阿哲會想動手嗎？ 看完這個效果，阿哲可能會想： 「那如果我把粒子排成自己的名字，滑鼠靠近時會散開嗎？」 這就是正確的方向—— 讓讀者想自己動手改參數 ，而不是背程式碼。 這個方法厲害在哪？ p5.js 官網有很多炫技的粒子效果，但大部分只是給你看「很厲害」。 這次不一樣——我要教你 用最少程式碼，做出最有呼吸感的互動 。 秘密是：用「距離」控制行為，用「lerp」讓移動變溫柔。 教學順序 先建立粒子：讓一群點組成畫面 教動畫：用 sin() 做出呼吸節奏 教距離感：用 dist() 偵測滑鼠 教溫柔散開：用 lerp() 柔和移動，不是瞬移 最後加美感：透明度、殘影、暖色 第一步：讓粒子回家 class Particle { constructor ( x , y ) { this . homeX = x ; // 記住家的位置 this . homeY = y ; this . x = x ; this . y = y ; } // 讓粒子回家的力量 returnHome () { this . x = lerp ( this . x , this . homeX , 0.05 ); // 每次移動5%的距離 this . y = lerp ( this . y , this . homeY , 0.05 ); } show () { noStroke (); fill ( 255 , 180 , 120 , 200 ); // 暖橙色 ellipse ( this . x , this . y , 4 ); } } 第二步：偵測滑鼠距離 function draw () { for ( let p of particles ) { let d = dist ( mouseX , mouseY , p . x , p . y ); if ( d < 100 ) { // 滑鼠靠近時，輕輕推開 let force = 0.05 * ( 100 - d ) / 100 ; p . x += ( p . x - mouseX ) / d * force ; p . y += ( p . y - mouseY ) / d * force ; } p . returnHome (); p . show (); } } 第三步：加呼吸節奏 let breathPhase = 0 ; function draw () { breathPhase += 0.02 ; let breath = sin ( breathPhase ); // -1 ~ +1 來回循環 background ( 10 , 8 , 5 ); // 暖暗色背景 for ( let p of particles ) { let d = dist ( mouseX , mouseY , p . x , p . y ); if ( d < 100 ) { let force = 0.05 * ( 100 - d ) / 100 ; p . x += ( p . x - mouseX ) / d * force ; p . y += ( p . y - mouseY ) / d * force ; } p . returnHome (); p . show ( breath ); // 把呼吸相位傳進去 } } function show ( breath ) { noStroke (); // 呼吸時變亮，吐氣時變暗 let alpha = map ( breath , - 1 , 1 , 150 , 255 ); fill ( 255 , 180 , 120 , alpha ); ellipse ( this . x , this . y , 4 ); } 第四步：殘影效果 function draw () { // 不要每幀清掉背景，而是蓋一層半透明黑色 fill ( 10 , 8 , 5 , 30 ); rect ( 0 , 0 , width , height ); // ... 其餘粒子邏輯 } 這樣粒子移動時會留下淡淡的光跡——很有沉浸式裝置的 feel。 阿哲可以怎麼玩？ 參數 預設值 改成... 效果 感知半徑 100px 50px 只有非常靠近才有反應 回家速度 0.05 0.02 超級慢，像在水裡 回家速度 0.05 0.2 快一點回覆 粒子數量 200 50 稀疏的星塵感 粒子颜色 暖橙 淡粉 更柔和的感覺 延伸練習 把粒子排成自己的名字 ：讓粒子組成「阿哲」或英文字母輪廓，滑鼠靠近時文字散開，離開後慢慢聚回來。 滑鼠不是破壞者，是一陣風 ：不只是排斥，而是讓粒子沿著滑鼠移動方向飄

I spent last month migrating 23 client sites from JPEG/PNG to WebP and AVIF. Here's what I wish someone told me before I started. AVIF vs WebP: the real numbers AVIF is about 30% smaller than WebP at the same quality level. But Safari support is still patchy — if your traffic is 40%+ iOS, you need <picture> tags with WebP fallback. No way around it. The biggest win wasn't the format The single biggest reduction came from capping max image width at 1200px and setting quality to 80. One site went from 9.4MB to 318KB per page — a 97% reduction — just from those two settings plus lazy loading. The format switch was the cherry on top, not the cake. Tools I used daily SmartImgKit — quick batch conversions in the browser. No uploads, no signup, drag and drop. Handles the 80% case where you don't need a CLI pipeline. Supports JPG, PNG, WebP, AVIF, GIF, BMP, TIFF. ImageMagick — server-side batch jobs for when you need automation. Squoosh — one-off fine-tuning with visual comparison. Sharp (Node.js) — build pipeline integration. The HEIC surprise Every iPhone user's photos are HEIC. Most web tools crash on them. You need a converter that handles them before the pipeline — SmartImgKit's HEIC converter works locally in-browser, no uploads. The 80/20 rule Format + max width + lazy loading = 80% of the gain. Everything else is diminishing returns. Don't over-engineer it.

I Deployed 6 AI Systems Live — Here's What Actually Broke A few weeks ago I wrote about the 5 bugs that cost me 60+ hours building 49 AI systems. Every one of those bugs lived inside the code itself wrong array layout, a renamed model class, a serialization mismatch. This article is the second half of that story, and it taught me something more uncomfortable: code that runs perfectly on your machine can fail completely the moment it leaves your machine for reasons that have nothing to do with your code. I took 6 of my pinned GitHub projects and deployed every one of them live on Streamlit Cloud. Locally, all 6 worked without a single error. Deploying them surfaced 5 failures I had never seen before, none of which were bugs in my logic. Here they are, in the order I hit them. Failure 1 — A Module That Existed Yesterday, Gone Today My RAG chatbot used this import, unchanged for weeks: from langchain.chains import ConversationalRetrievalChain Locally: works. Deployed: instant crash. ModuleNotFoundError: No module named 'langchain.chains' The cause had nothing to do with my code. My local environment had an old, cached version of LangChain installed months ago. The deploy environment did a clean install and pulled whatever the latest version was at that moment and recent LangChain releases moved legacy chain classes like this one out of the core package entirely. The fix that actually worked pin the exact version that still contains the class, rather than chasing the newest API pattern under deployment pressure: langchain = =0.3.7 langchain-community = =0.3.7 The lesson: "it works on my machine" is frequently true specifically because your machine never reinstalled anything recently. A clean deploy environment has no such luxury it gets whatever is newest the moment it builds. Pin your versions before you ever need to debug this at 1 AM. Failure 2 — A File That Exists, Until It Doesn't My construction RAG project loads a prebuilt FAISS vector index from disk: vectorstor

The Kotlin Multiplatform (KMP) ecosystem moves fast. To stay at the cutting edge, ImagePickerKMP has recently undergone a major architectural upgrade in version 1.0.42 , adopting the latest stable versions of Kotlin and Compose Multiplatform. For the latest requirements and installation guides, always refer to https://imagepickerkmp.dev/ . Major Version Upgrades The v1.0.42 release brings significant updates to the core dependencies of the library: Dependency New Version Previous Version Kotlin 2.3.20 2.1.x Compose Multiplatform 1.10.3 1.9.x Ktor 3.4.1 3.0.x Android Gradle Plugin 8.13.2 8.x Warning: Kotlin 2.3.x brings breaking ABI changes. Projects using Kotlin < 2.3.x will fail to compile with an "ABI version incompatible" error when using ImagePickerKMP 1.0.42. Why the Upgrade Matters Performance: Kotlin 2.3.20 includes numerous compiler optimizations that result in smaller and faster binaries for both Android and iOS. Stability: Compose Multiplatform 1.10.3 resolves several rendering issues on iOS and Desktop, providing a smoother user experience. Future-Proofing: By moving to these versions, ImagePickerKMP is ready for the upcoming features in the Kotlin roadmap. How to Upgrade Your Project To use the latest version of ImagePickerKMP, you must update your build.gradle.kts file: plugins { kotlin ( "multiplatform" ) version "2.3.20" id ( "org.jetbrains.compose" ) version "1.10.3" } dependencies { implementation ( "io.github.ismoy:imagepickerkmp:1.0.42" ) } If your project is not yet ready for Kotlin 2.3.x, you can continue using version 1.0.41 of the library, which maintains compatibility with older Kotlin versions. Conclusion Staying updated is crucial for security, performance, and developer happiness. ImagePickerKMP makes it easy to leverage the power of the latest Kotlin features while maintaining a simple, unified API for media picking. Explore the full API reference and new features at https://imagepickerkmp.dev/ . References [1]: ImagePickerKMP Documentati

A few weeks back I shared some early Zen code examples. Since then, a lot has changed. We're now at v1.1.1 and the language actually has real tooling. What's new: Full CLI with package management zen publish - publish packages directly from CLI zen install - install packages from the registry zen list - browse all published packages with pagination Language improvements Struct support with literals and returns Regex with POSIX ERE ( matchRegex ) File I/O with binary support FFI bindings to C functions 162 stdlib functions across math, strings, fs, os, http, crypto, path utilities Package Registry (v1.0.0) JWT-based authentication GitHub-hosted packages Support for both runnable apps and libraries Semantic versioning The reactive variables concept from the first post is still there (that was my favorite feature), and now you can actually write real programs and share them with the community. Full docs: https://jishith-dev.github.io/zen-doc/site/ Install: curl -fsSL https://raw.githubusercontent.com/jishith-dev/Zen/main/install.sh | bash Next up: HTTP server APIs, better imports, and whatever the community asks for. Open to feedback and collaborators 💻 ✨ zen #programming #compiler #llvm #packagemanager #opensource #programminglanguage

Santa Clara, 2029. A speculative fiction about hegemony, sanctions, and the playbook nobody followed.

Original post: tachiosports.com What we're building By the end of this guide, you'll have a Discord bot that posts live CS2 match scores to a channel, updates every 60 seconds, and shows team names, current map, and odds. No database required — everything comes straight from the API. Prerequisites You'll need Node.js installed (v18 or newer), a Discord bot token from the Discord Developer Portal, and a free Tachio Sports API key. Sign up on the homepage with GitHub to get yours. Step 1 — Create the Discord bot Go to discord.com/developers/applications and create a new application. Under the Bot tab, click Add Bot and copy the token. Invite the bot to your server with the 'bot' and 'Send Messages' permissions. Keep your token secret — it's like a password for your bot. Step 2 — Set up the project mkdir cs2-discord-bot cd cs2-discord-bot npm init -y npm install discord.js Step 3 — The complete bot code const { Client , GatewayIntentBits , EmbedBuilder } = require ( " discord.js " ); const DISCORD_TOKEN = process . env . DISCORD_TOKEN ; const API_KEY = process . env . TACHIO_API_KEY ; const CHANNEL_ID = process . env . CHANNEL_ID ; const client = new Client ({ intents : [ GatewayIntentBits . Guilds , GatewayIntentBits . GuildMessages , ], }); async function fetchLiveMatches () { const res = await fetch ( " https://api.tachiosports.com/esports/live/cs2 " , { headers : { " x-api-key " : API_KEY } }, ); if ( ! res . ok ) return []; const data = await res . json (); return data . matches ?? []; } function buildEmbed ( match ) { const home = match . teams . home . name ?? " TBD " ; const away = match . teams . away . name ?? " TBD " ; const score = match . score ?. display ?? " vs " ; const map = match . current_map ?? "" ; const format = match . match_format ?? "" ; const league = match . league . name ?? "" ; const oddsHome = match . odds . match_winner . home ?? " – " ; const oddsAway = match . odds . match_winner . away ?? " – " ; return new EmbedBuilder () . setColor (

What We Know: The Basics of the Breach Polymarket, one of the largest prediction market platforms in the crypto space, confirmed on X that hackers stole funds from users after attackers compromised a third-party vendor. The breach allowed the attackers to inject malicious code directly into Polymarket's website, though the company specified the code ran "for some users" — a detail that raises immediate questions about whether the attack was deliberately targeted or only partially executed before detection. Polymarket spokesperson Connor Brandi confirmed to TechCrunch that the vendor compromise resulted in direct theft of user funds. Beyond that confirmation, the company declined to answer specific questions about the incident, leaving the scale of the financial damage, the identity of the compromised vendor, and the exact mechanism of the malicious code injection all officially unaddressed. The platform says it has contained the breach and is reaching out directly to affected users, committing to full refunds. No figure for total stolen funds has been disclosed. Blockchain monitoring firm PeckShield flagged suspicious activity around the same time Polymarket made its public announcement, adding an independent layer of confirmation that something significant moved on-chain during the incident window. What stands out immediately in the crypto security community is where the failure originated. The Polymarket platform itself was not the direct point of entry — a third-party vendor was. That distinction matters enormously. Users who trusted Polymarket's smart contract security and on-chain transparency had no visibility into the web infrastructure dependencies sitting between them and the prediction market interface. The malicious code injection attack, a technique that exploits trusted website supply chains, bypassed the decentralized architecture that crypto platforms often promote as a security feature. The incident joins a growing list of Web3 platform breaches wher

Ship Faster with TanStack, Cost Less with Cloudflare Discussion | Link

Most multi-tenant email-agent setups give every customer the same caps. Your free-tier user who signed up an hour ago and your enterprise account doing thousands of sends a day hit the exact same daily send limit, the exact same storage ceiling, the exact same retention window. That's fine right up until a free trial account starts hammering your infrastructure, or an enterprise customer files a ticket because their agent stopped sending at noon UTC and nobody can explain why. Free-tier and enterprise tenants shouldn't share the same caps. They have different risk profiles, different contractual obligations, and different billing. The trick is to make the quota a property of the tier, not a property of each individual account — so when you provision a new tenant you don't compute limits, you just drop them into the right bucket and the limits come along for free. With Nylas Agent Accounts that bucket is a workspace , and the caps live on a policy you attach to it. Set up one policy per tier, attach each to its tier's workspace, and every Agent Account in that workspace inherits the policy's send, storage, and retention limits automatically. No per-account configuration, no drift. I work on the Nylas CLI, so the terminal commands below are the exact ones I reach for when I'm wiring this up. As always, I'll show both the raw HTTP call and the CLI equivalent for every step, because half of you live in scripts and the other half live in your app code. What you actually get An Agent Account is just a Nylas grant with a grant_id — a managed mailbox that can send and receive on a domain you've registered. Everything grant-scoped works against it: Messages, Drafts, Threads, Folders, the lot. There's nothing new to learn on the data plane. A policy is a reusable bundle of limits and spam settings. One policy can govern many accounts. The limits we care about for tiering are: limit_count_daily_email_sent — how many messages an account can send per day. limit_storage_total — t