标签：#t

Detecting what powers a website looks simple: send a request, read the response, match fingerprints. In real environments it rarely stays that clean. False positives slip through, infrastructure hides behind CDNs, old scripts linger after migrations, and fingerprints keep evolving. Developers who treat fingerprinting as a basic utility end up acting on misleading data. This guide covers the mistakes engineers make detecting website technologies and how to avoid them. Modern detection workflows lean on ProjectDiscovery's libraries, which cut these problems through structured pattern matching and maintained datasets. External resources: github.com/projectdiscovery/wappalyzergo projectdiscovery.io If you're new to the space, start with technology fingerprinting for developers before these pitfalls. Mistake 1: Trusting a single detection signal Relying on one clue is the fastest way to get a wrong answer. A script file may linger after a framework migration, a header can be spoofed, and a cookie might belong to a third-party service. Correlate several signals instead: headers, cookies, HTML patterns, script paths, metadata. When multiple indicators point at the same technology, confidence goes up. ProjectDiscovery's libraries are built around that multi-signal approach. Mistake 2: Treating detection as a one-time task Stacks change constantly. Organizations migrate infrastructure, update frameworks, and swap platforms more often than developers expect. Scan once and trust it forever and you're working from stale data. Schedule periodic scans. Many teams wire detection into automation pipelines so infrastructure changes get captured on their own. To operationalize this, see detect website technologies programmatically in Go . Mistake 3: Ignoring reverse proxies and CDNs Modern architectures hide origin servers behind proxy layers. You might detect a CDN and miss what actually powers the app. Detecting a CDN doesn't make the origin invisible. It means you need to look fur

Every engineering team that ships an AI feature eventually has the same meeting: someone pulls up a pricing page, someone else pastes a benchmark screenshot from a forum post, and the decision gets made on vibes. That's a bad way to pick the model provider your product will depend on for the next two years. The OpenAI vs Anthropic API decision isn't really about which model is "smarter" this quarter — model quality leapfrogs every few months, and today's edge is gone by the next release cycle. What actually determines whether your AI feature is pleasant to build, cheap to run, and easy to maintain is the shape of the API underneath it: how it handles conversation state, how reliably it calls tools, how it prices repeated context, and how much application logic ends up welded to one vendor's conventions. This post is a practical, engineering-first look at those structural differences, written for teams past the demo stage trying to ship something that works in production, at scale, for paying customers. Why the OpenAI vs Anthropic API Comparison Matters More Than Model Quality It's tempting to treat this as a leaderboard question — whichever model scores higher on the latest benchmark wins. That's the wrong axis to optimize for a production SaaS feature. Benchmarks measure narrow tasks under ideal conditions; your feature has to survive malformed input, network failures, cost constraints, and the reality that whatever model you pick today will be superseded within months. What doesn't change as quickly is the API contract: request and response schema, conventions for multi-turn state, the tool-calling protocol, and the caching and rate-limiting behavior your infrastructure has to accommodate. Get those decisions right and swapping model versions later is a config change. Get them wrong and you're rewriting your orchestration layer every time a new model ships. That's why an OpenAI vs Anthropic API comparison for a production team should spend more time on API design

The first time I audited seriously, I opened the biggest contract in the repo and started reading line one. Two hours later I had a headache and zero findings. I had memorized how the code worked without ever asking what it was supposed to guarantee. That is backwards, and it took me a while to unlearn it. Now I do not read Solidity first. I read the scope, and before I look at a single function body I write down what must always be true. Bugs are violations of those truths. If you do not know the truths, you are just admiring the code. Step one: write the invariants before you read An invariant is a property the protocol claims will always hold, no matter who calls what in what order. For a contest, I start with money and control, because that is where severity lives. Two questions cover most of it: Who can move funds, and under what conditions? What must always hold about the accounting? For a lending-pool-shaped protocol my starting invariant list looks like this, written in plain language before I care how any of it is implemented: The sum of all user deposits minus all borrows equals the pool's available liquidity plus outstanding debt. Accounting must reconcile. A user can only withdraw up to their own balance, never more, never someone else's. A position can only be liquidated when it is actually under the health threshold. Interest accrues monotonically, it never goes backwards in a way that lets someone repay less than they owe. Only the borrower, or a liquidator on an unhealthy position, can reduce a debt. Nobody except governance can change interest rate parameters or the oracle. Notice none of that mentions a function name. These are the promises. Now my job for the rest of the contest is simple to state: find an ordering of calls that breaks one of these. Step two: map the external entry points Funds do not teleport. Something has to be called from outside for state to change. So I list every externally reachable function, because the attack surface is

Originally published on nejckorasa.github.io . When a team moves from a monolith into microservices and event-driven, asynchronous systems, it inherits a class of problems that used to be someone else's: work that fails halfway through, steps that must not run twice, calls that return before the work is done. Temporal is a durable execution engine that handles a lot of this - you define a multi-step process, and it guarantees the process runs to completion even when workers crash in the middle. I've spent the better part of a decade building distributed systems in the money-movement core of banks - ledgers, payments, credit cards - a lot of it on Temporal, from short request-triggered workflows to ones that stayed open for weeks. This is the high-level guide I'd give a team making that jump: the principles worth internalising before you ship, not a full tutorial. Most of them aren't really about Temporal. They're the habits the async shift demands - Temporal just punishes you quickly when you skip one. Durable Execution: The Problem It Solves Distributed work fails in the middle. You call service A, it succeeds. You call B, it times out. The pod dies before C. Now you have half-finished work and no memory of how far you got. The usual fix is a pile of status columns, a cron job to find stuck rows, and retry logic hand-rolled for every step. Temporal's promise is that any process you start runs to the end. The runtime picture: there's a Temporal service (its own cluster), and your app runs worker processes that poll it and execute your code. As a workflow runs, Temporal records every step to an event history . If a worker dies, another picks the workflow up and replays that history to rebuild state, then carries on from where it left off, retrying anything that failed. The history is the source of truth, and it survives the crash. Most of the rules below fall out of that one fact. The Golden Rule: Workflows Decide, Activities Do There are two kinds of code in Tempora

Clean out that cable junk drawer every so often and keep only the things you actually need.

This is Part 18 of my series on the Microsoft Agent Framework. You can read the original post over on lukaswalter.dev . In the previous article , we looked at observability for agents. The main idea was to make a run visible as a chain of model calls, tool calls, approvals, and workflow events. Testing starts from the same idea. An agent run is not one answer string. It is a small application flow with several boundaries: user input -> prompt and context -> model request -> model response -> tool selection -> tool arguments -> tool execution -> structured result or final answer -> routing or workflow state If the only test is an end-to-end prompt against a live model, all of those boundaries are mixed together. When the test fails, you do not know whether the problem is the prompt, the model, the tool schema, the router, the workflow, or the real dependency behind the tool. The solution is not to pretend that an LLM is deterministic. The solution is to test each boundary at the level where it is deterministic, then add a smaller number of evaluation-style tests for behavior that genuinely depends on the model. This post covers: fake model clients tool contract tests structured output tests routing tests workflow tests eval-style regression checks The examples use xUnit-style assertions, but the testing approach does not depend on xUnit. The snippets focus on the relevant testing boundary and omit some application-specific factory and workflow setup. Do not start with the live model A live model test is useful. It is also expensive, slow, sometimes flaky, and difficult to diagnose. That makes it a poor replacement for normal unit and integration tests. I use a testing pyramid for agent applications: evals realistic model and user examples application integration tests agent + tools + storage + workflow boundaries deterministic component tests fake model client, tools, schemas, routing The bottom layer should be the largest. It should catch ordinary programming mistak

A few weeks ago, I set out to build a small portfolio project: a Streamlit app that could take any tabular dataset, understand something about its structure, and give honest guidance on how to model it. I called it ContextLens . I expected it to be a practical exercise in Python, machine learning, and deployment. What I didn't expect was how closely it would connect with the same questions I work with every day in my PhD research on context-aware intelligent systems. The problem I started with Most introductory machine-learning tutorials follow a familiar sequence: Load a CSV. Choose a model. Train it. Check the accuracy. What often gets skipped is the layer of judgment that should come before any of that: Is this actually a classification problem or a regression problem? Is the target so imbalanced that accuracy becomes misleading? Is that "ID" column secretly leaking the answer into your model? Are there duplicate rows, missing values, high-cardinality categories, or too many features for the number of available observations? Experienced practitioners make these judgments almost automatically. But that reasoning usually remains invisible—it sits in someone's head rather than inside the system, where another person can inspect it. ContextLens is my attempt to make that layer visible. Upload a dataset, and it profiles the data, flags structural risks—missingness, duplicate rows, likely identifier columns, class imbalance, and high-dimensional settings—and adapts its evaluation guidance to what it finds before training a single model. The point is not simply to train a model. The point is to ask whether the modelling process makes sense in the first place. Why I call it "context-aware" rather than "AI-powered" I was deliberate about this distinction, just as I have been throughout my PhD work, and it turned out to be the most important design decision in the whole project. ContextLens does not claim to be intelligent in the way a human expert is. It does not hide its

Microsoft does not create expert-tier certifications for experiments. An expert credential is a market declaration: this discipline is mature, hireable, and worth filtering résumés on. Multi-agent orchestration just got that stamp. The credential is Microsoft Certified: Multi-Agent AI Solutions Expert , earned by passing Exam AI-500 , now in beta with limited discounted seats per Microsoft's announcement . If you are weighing an exam AI-500 beta seat, this piece gives you what it tests, how it differs from AI-102 and AB-100, and a clear book-or-wait call. No menu of options. A decision. The short version of my position: the skills outline matters more than the badge. Microsoft just published its multi-agent product roadmap and formatted it as an exam blueprint. Read it either way. What AI-500 actually covers The announcement positions the certification for practitioners who can, in Microsoft's words, "operate at expert level in the agentic era." That phrase is doing real work. It is not about calling a model endpoint. It is about designing, orchestrating, and running systems where multiple agents cooperate, hand off work, and stay inside guardrails. Microsoft's own framing in the announcement names three capabilities: architecting complex, production-ready AI systems; orchestrating multiple agents and tools; and delivering scalable, governed AI solutions. My read of what those mean in practice, and why they are the right three: Orchestration of multiple agents and tools. Not one agent with a prompt. Several agents with routing, handoffs, and shared context. Governance. Identity, permissions, content safety, evaluation, and audit as exam material, not appendix material. Production-readiness. Deployment, observability, and lifecycle. The stuff that separates a demo from a system someone is paged for at 2 a.m. To be clear, that numbered list is my interpretation of the announcement's language, not a reprint of the skills-measured document. Pull the exact blueprint your

The carmaker has said it's owed a refund in the "tens of millions of dollars."

Tesla's electronic door handles that have been linked to several deaths could lead to tougher safety rules for the entire auto industry. In a notice published today, the National Highway Traffic Safety Administration said that complaints about Tesla's mechanical door release don't warrant a defect investigation. Instead, the issue is better addressed through a broader […]

Most Chromebooks ship with only 8GB of RAM, which is enough for some people, but certainly not enough for me. Multitaskers who want more memory in their next Chromebook should check out Best Buy, which is discounting Acer’s Chromebook Plus Spin 514 for the remainder of the day. Originally $749 for the configuration with 12GB […]

Boox's new Tile lineup will take on Xteink's popular e-readers that are small enough to stick on the back of an iPhone with MagSafe. As spotted by Good E-Reader, the first one is the Picco, which will feature a 3.97-inch front-lit, black-and-white e-paper display and expandable storage with an SD card slot. Boox confirmed to […]

The AI “startups” worth billions of dollars are raising alarm bells about Chinese AI. The smaller players have a totally different take.

Following its Unpacked launch event for the Galaxy Z Fold 8 series, Samsung briefly opened a theme pub in the middle of London.

This is Optimizer, a weekly newsletter sent from Verge senior reviewer Victoria Song that dissects and discusses the latest gizmos and potions that swear they're going to change your life. Optimizer will be taking a two-week break and will be moving to Wednesdays starting August 12th. Opt in for Optimizer here. My For You page […]

Rule would allow states to decide how much—if any—public input there can be.

ChatGPT Voice on desktop can work with both ChatGPT Work and Codex to complete tasks and control agents.

Modern EV batteries aren't just holding up, they're outperforming what was expected.

Jörg Schad explains how to tame the complex "data management hairball" to build scalable, safe architectures for AI. He shares how autonomous data products act like containers for data, encapsulating pipelines, schemas, and metadata. Discover how progressive tool discovery via protocols like MCP limits context rot, enforces governance policies, and ensures reliable, multi-modal access. By Jörg Schad

GitHub热门项目 | Self-hosted audiobook and podcast server | Stars: 13,677 | 111 stars this week | 语言: JavaScript