标签：#t

Originally published on MRTD.NET — fast, sourced news on crypto security, cyber & SEO. The uncomfortable first lesson You built a clean site, submitted a sitemap, maybe pinged IndexNow — and Google still shows nothing. Here's the part most guides skip: getting indexed by Google and getting indexed by everything else are two different problems , and conflating them wastes weeks. We separate what actually moves Google in 2026 from the folklore that just feels productive. Bing, Yandex and ChatGPT are the easy half If you've set up IndexNow , you've largely solved discovery for Bing, Yandex, Naver, Seznam and Yep — you POST your new/changed URLs to one endpoint and they get notified instantly. And because ChatGPT Search retrieves from Bing's index , confirmed Bing indexing effectively gates your visibility in ChatGPT's web results. That's a big chunk of the modern search surface handled with one integration. The catch: Google does not use IndexNow. It has said so repeatedly. So every "instant indexing" claim that leans on IndexNow is talking about Bing's world, not Google's. For Google, you need different levers. What actually gets you into Google There are really only two fast paths, plus one slow one. 1. Google Search Console — the only direct lever. Verify your domain (a private DNS TXT record; it does not trigger penalties or "re-evaluation," a common fear), submit your sitemap.xml , then use URL Inspection → Request Indexing on your key pages. There's a soft daily cap (~10–12 URLs), so spread a new site's pages over a few days. GSC is also the only place you can see whether a domain carries an inherited problem — essential if you bought an aged or expired domain. 2. Links on pages Google already re-crawls hourly. Googlebot's crawl budget for a brand-new, zero-authority domain is tiny. The fastest way to get a new URL discovered is a link to it from a page Google visits constantly — Reddit, Hacker News, Medium, established communities. These links are usually nofoll

AI Agent 的记忆系统通常只解决一个问题：「记住」。gbrain 存知识图谱，Hindsight 存向量，Memory tool 存偏好。三个仓库堆满数据，但你问 Agent「我上周看的那篇关于 Agent memory 的文章说了什么？」——它答不上来。不是因为记不住，是因为它的记忆系统没有「采集」这一层。 这就是 Knowledge-and-Memory-Management（KMM）的定位：不是另一个记忆数据库，而是一个 知识采集 → 精炼 → 召回 → 同步 的全链路插件。v0.0.2 把这条链路做完了。 架构思路：把「采集」和「记忆」解耦 KMM 不做记忆存储，它只做三件事： 采集 — 从 40+ 工具把原始知识拉进来 精炼 — 把原始材料变成结构化笔记 + 知识图谱节点 同步 — 写 OneDrive，让所有设备共享同一个知识池 下方是三层采集管线示意： 层 工具数 代表工具 网页 9 Scrapling (CF 绕过)、Chrome DevTools Protocol、GStack Browser 视频 12 抖音批量转录、yt-dlp、Whisper ASR (99 语种) 文档 9 SenseNova PDF/PPT/Word 引擎、MinerU、book_cache (710+ 本) 3 层召回：不让任何一条知识掉队 搜索时先查本地 FTS5（毫秒级），没命中就走 Hindsight 向量（语义近似），再不中就落 gbrain 知识图谱（关联推理）。三层兜底，基本不存在「查不到」的情况。 代码片段：rclone 做云盘双向同步 KMM 的 CloudSyncEngine 不造轮子，直接用 rclone 做统一同步层。核心代码很直白： class CloudSyncEngine : def __init__ ( self ): self . _check_rclone () def _check_rclone ( self ): result = subprocess . run ([ " rclone " , " version " ], capture_output = True , text = True ) if result . returncode != 0 : raise RuntimeError ( " rclone not installed " ) def bidirectional_sync ( self , local_path , remote_path ): """ 双向增量同步，每 4h 自动执行 """ cmd = [ " rclone " , " bisync " , local_path , remote_path , " --resync " ] return subprocess . run ( cmd ) 这没什么黑科技，关键是架构决策：用 rclone 支持 12+ 云盘（OneDrive / 阿里云盘 / 百度云盘 / Dropbox / Mega / 天翼云等），不需要为每个云盘写专属 SDK。一份配置，双向同步，cron 每 4 小时自动执行。 一个完整的采集流 用户丢过来一个抖音视频链接 → collect_video() 自动走三条线并行： yt-dlp 下音频 → Whisper ASR 转文字 → PaddleOCR/EasyOCR 提关键帧文字 。输出汇总后 → generate_note() 写结构化笔记 → create_note() 入 gbrain 知识图谱 → sync_to_cloud() 推 OneDrive。全自动，零人工参与。 踩过的坑 不要用 Python 重写云盘同步 。KMM v0.0.1 试过直接调各云盘 REST API，token 刷新、分片上传、断点续传全要自己处理，维护成本极高。v0.0.2 切到 rclone bisync 后问题归零。 视频分析不只看语音 。抖音很多技术号用字幕 + PPT 画面讲内容，语音只占信息量的 60%。必须 OCR 做画面补充，否则丢失大量知识。 去重不做在采集层 。采集层只管拉，去重交给 gbrain 的 content_hash 和 nightly_maintenance 的 orphan compaction，职责分离更干净。 适用场景 如果你的 AI Agent 已经跑了一段时间，积累了几千条笔记 / 几百个知识图谱节点，但你还是觉得「它好像什么都不懂」——问题很可能出在知识摄入链路上。KMM 适合你已经有一套记忆系统，缺的是一个自动化的知识采集和同步层。 仓库： github.com/mage0535/Knowledge-and-Management ，MIT 协议，PR

GitHub added a tiny field to the Copilot usage metrics API this week that is going to create a lot of very confident spreadsheets. Enterprise and organization admins can now see ai_credits_used in the user-level Copilot usage reports. One field. Per user. Available for single-day and 28-day reports. It is not the invoice, and GitHub is careful to say it is a consumption signal rather than a billed total. Still, the shape is obvious. Now AI usage can sit next to adoption, activity, team, department, cost center, and whatever else the company already exports into a dashboard. That is useful. It is also exactly how a tool metric becomes a management metric. And once that happens, the question is no longer "can we measure AI usage?" The question is "what weird behavior will this metric create?" every useful metric becomes a temptation I understand why this field exists. If a company is paying for Copilot, especially with usage-based pieces attached to more expensive models and premium features, it needs some way to understand consumption. Platform teams need budget signals. Engineering leaders need adoption signals. Procurement needs something more concrete than "people seem to like it." Finance will eventually ask why one org burns through credits much faster than another. That is normal. The problem starts when a consumption signal is treated as a productivity signal. High AI credit usage might mean a developer is doing valuable work with agent mode, code review, test generation, refactoring, or research. It might also mean the developer is stuck, repeatedly asking the model to solve the wrong problem, generating code that gets deleted, or using a heavyweight model where a small one would have been fine. Low AI credit usage might mean a developer does not need much help. It might mean the work is mostly design, review, debugging, incident response, mentoring, or architecture. It might mean the codebase is small and well understood. It might mean the developer is skept

As software engineers, we often architect solutions in a virtual ideal: fast networks, elastic resources, and servers that never physically degrade. But what happens when your carefully crafted systems need to interact with the messy, unpredictable physical world? Think factory floor monitors, real estate camera networks, or remote tracking devices. Suddenly, those cloud assumptions about infinite uptime and perfect connectivity crumble. My journey, particularly architecting and maintaining a continuous 24/7 camera livestream for a real estate group over six years, has been a masterclass in this reality. It's revealed that true reliability in the physical realm demands a hybrid approach – one that intelligently merges the power of edge computing with the scalability and data insights of the cloud. This isn't just about connecting devices; it's about building resilience into the very fabric of your architecture. In this article, I'll share the battle-tested strategies and design principles that enable systems to not just survive, but thrive, despite the harsh realities of physical deployment. 1. The Core Strategy: Smart Edge, Simple Cloud One of the most common pitfalls in hybrid architecture design is treating the edge device as a mere 'dumb' terminal, solely responsible for streaming raw data to a powerful cloud backend. This approach creates a critical single point of failure: if the network drops, the entire system grinds to a halt. Instead, I advocate for a Smart Edge, Simple Cloud architecture. This principle establishes a clear division of responsibility: The Edge : This is where the magic happens locally. The edge system should be robust enough to handle local processing , data filtering , buffering , and immediate hardware control . Critically, it must be capable of operating autonomously for extended periods without an active cloud connection. Think of it as a mini data center, designed for self-sufficiency. Benefits of a Smart Edge : Reduced bandwidth cost

I've wanted easy trunk-based development for Salesforce for years. Short-lived branches, frequent merges, small pull requests, and CI fast enough that developers aren't afraid to commit. The same practices that engineering teams use everywhere else. Every time I tried to make it work, I hit the same wall: Apex tests require an org. That single dependency turns every validation run into an infrastructure problem. Before a test can execute, you need authentication, environment provisioning, metadata deployment, test execution, and cleanup. The result is feedback loops measured in minutes instead of seconds. I got tired of waiting and built Nimbus, a local Apex runtime that executes Apex tests without an org. This is what I learned while trying to make trunk-based development actually work for Salesforce. Why trunk-based development is hard in Salesforce Trunk-based development depends on fast feedback. If validation takes seconds, developers make smaller changes, merge more frequently, and keep branches short-lived. If validation takes fifteen minutes, behavior changes. Pull requests get larger, unrelated work gets batched together, and validation stops happening continuously because validation itself becomes expensive. Salesforce has always had a structural challenge here because Apex only runs inside Salesforce. A typical validation pipeline looks something like this: sf org login jwt sf org create scratch sf project deploy start sf apex run test sf org delete scratch There is nothing inherently wrong with these steps. The problem is that most of them have nothing to do with testing. They're infrastructure management. The actual validation of business logic is only one part of the process. The longer I worked with Salesforce CI, the more obvious it became that the bottleneck wasn't Apex itself. The bottleneck was everything required to create an environment where Apex could run. The solutions I tried first Before building a local runtime, I tried solving the problem

I know it sounds strange, but I am in my first year in CS Major, and I don't like posting things on social media, but I found lately that companies are more likely to hire people who are active on social media like X (Twitter). For me, I genuinely post my projects on LinkedIn, but not sharing things like today I learned something new etc... What's your opinion about that? Or How can I manage that?

A notes app that lives in your MacBook's notch. Discussion | Link

Every time you open a new session with an AI coding tool, it starts from zero. It does not know what you decided yesterday, what failed last week, or what comes next. You have to explain the project again. And again. EGC (Extended Global Context) fixes this. EGC is a local runtime that gives every AI coding tool you use a persistent memory. At the end of each session, the AI saves what it learned: decisions made, what failed, your preferences, what comes next. At the start of the next session, it loads that state back automatically. One install. Every tool. Every session. Website: https://fmarzochi.github.io/EGCSite What it looks like in practice You open Claude Code on a project you have not touched in two weeks. Without typing anything: State loaded from egc-memory via ~/.egc/state/Projects--MyApp.md Context and preferences acknowledged. Ready to pick up: - Test full install on a clean machine - Add GEMINI.md with session memory protocol - Publish v1.0.1 fix after clean install test passes The AI already knows what you were building, what decisions you made, what failed, and exactly where you stopped. You did not type anything. You just started working. How it works EGC ships two MCP servers that run locally during every session. egc-memory: 14 tools for persistent memory Tool What it does get_state Loads project memory at session start update_state Saves decisions, preferences, and next steps store_decision Persists a single decision to SQLite query_history Returns past decisions by timestamp search_history Full-text search with BM25 ranking working_memory_set Stores transient context with a TTL lesson_save Records cross-session knowledge with confidence decay lesson_recall Retrieves active lessons above a threshold detect_patterns Surfaces repeated commands and recurring errors compress_observations Compresses hook events to save token budget State files live at ~/.egc/state/<project-slug>.md . One file per project. Plain Markdown. Human-readable. egc-guardian:

The Quest Begins (The "Why") Honestly, I was tired of staring at charts at 2 a.m., trying to catch that perfect entry while my coffee went cold. I’d set a manual alert, jump onto the exchange, click “buy”, and then second‑guess myself as the price slipped away. It felt like I was playing a never‑ending game of Whac‑A‑Mole, and I kept losing the mole. One night, after yet another missed opportunity, I thought: What if I could offload the repetitive bits to a script? Not a fancy AI that predicts the future—just a simple bot that watches the market, checks a condition, and places an order when the condition is met. If I could automate the boring part, I could focus on strategy, learning, and maybe even get some sleep. That was the dragon I wanted to slay: the exhaustion of manual trading. The Revelation (The Insight) The big “aha!” moment came when I realized I didn’t need to build a high‑frequency trading engine from scratch. There are solid, well‑tested libraries that handle the messy bits—authentication, rate limits, WebSocket connections—so I could concentrate on the logic. Using CCXT (a unified crypto exchange library) and a touch of asyncio , I could write a bot that: Connects to an exchange (I used Binance’s testnet so I wouldn’t lose real money). Polls the ticker for a symbol at a reasonable interval. Checks a simple condition—like “price > 20 % above the 20‑period moving average”. Places a market order if the condition holds, then waits for the next cycle. It felt like Neo dodging bullets in The Matrix when the bot finally executed a trade without crashing or getting rate‑limited. The relief was genuine: I could now let the code do the watching while I worked on the next idea. Wielding the Power (Code & Examples) The Struggle – A Naïve Loop My first attempt was a blocking while True loop with time.sleep . It looked harmless, but it had two nasty traps: Trap #1 – No error handling. A network hiccup would raise an exception and kill the whole script. Trap #2 – I

There is a class of feature that used to be impossible to ship for free: anything that needed a language model. You wired up an API key, you ate the per-token bill, and every prompt your users typed went off to someone else's server. For a small public tool, that math usually killed the idea before it started. That changed. Recent versions of Chrome ship a language model, Gemini Nano, and expose it to any web page through the Prompt API . The model runs on the user's own machine. No API key. No inference bill. No data leaving the browser. We put this into a real, live tool, a free Mermaid diagram editor where you describe a diagram in plain English and the browser writes the Mermaid code for you. This post is the developer's version of that story: how the API actually works, the code that makes a small on-device model trustworthy, and an honest accounting of what you gain and what you give up. What "AI in the browser" means in 2026 The important word is built-in . This is not WebGPU plus a 4 GB model you download and run yourself. The model ships with Chrome, and you talk to it through a small standard-track JavaScript API. As of Chrome 148, the Prompt API is stable for web pages (it had been available to extensions since Chrome 138). It is the general-purpose member of a growing family of built-in APIs: Prompt API ( LanguageModel ): general natural-language prompting, now multimodal (text, plus image and audio input). Summarizer, Writer, Rewriter, Proofreader : task-specific, text-to-text. Translator and Language Detector : backed by expert models, desktop only. The Prompt API is the one you reach for when you need something the task APIs don't cover, like "turn this description into Mermaid source." So that is the one this post focuses on. The 15-line version Here is the whole happy path. Check availability, create a session, prompt it. // Feature-detect first. Old browsers won't have this at all. if ( ' LanguageModel ' in self ) { const status = await LanguageMod

As SaaS platforms grow, the codebase becomes harder to maintain. Features expand, integrations multiply, and the system starts to feel tightly coupled. Modular architecture solves this problem by splitting the platform into independent, self‑contained components that evolve without breaking each other. What modular architecture means A modular system is built from isolated components that communicate through well‑defined interfaces. Each module has: its own logic, its own data boundaries, its own responsibilities, minimal knowledge about other modules. This separation reduces complexity and makes the platform easier to extend. Benefits of modular design A modular architecture provides several advantages: Independent development: teams can work on different modules without conflicts. Faster deployments: small modules deploy quickly and safely. Better testability: each module can be tested in isolation. Improved reliability: failures are contained within a single module. Easier scaling: only the modules under load need more resources. This approach is especially useful for platforms that integrate with multiple external APIs. Real‑world example Modern property management systems often use modular design to separate booking logic, pricing engines, messaging workflows, and synchronization services. A good example is an API‑driven rental operations automation system , where each module handles a specific part of the workflow and communicates through events. If you want to explore how a real SaaS platform structures its modules, you can check PMS.Rent . Conclusion Modular architecture is not just a design choice — it is a long‑term strategy for building scalable, maintainable, and reliable SaaS platforms. When each module is independent and well‑defined, the entire system becomes easier to evolve and operate.

Chaos engineering sounds expensive. Netflix built Chaos Monkey to randomly kill production servers. Google runs DiRT (Disaster Recovery Testing) across their entire infrastructure. Amazon does game days where they intentionally take down services. You're building a Node.js API. You don't have a platform team. You don't have a chaos infrastructure. But you still need to know: what happens when your dependencies get slow? The good news is that 80% of the value of chaos engineering comes from one question, and you can answer it locally in five minutes. The one question that matters What does my application do when a dependency responds slowly or not at all? Not "what if the server catches fire" — that's infrastructure chaos. What about application chaos: the database is slow, the payment API is timing out, Redis is having a bad day. These happen constantly in production and they're almost never tested. The failure modes look like this: Your DB gets slow under load → your API response times climb → your timeout fires → you retry → now you're sending twice the load to an already-slow DB Your Redis cache goes down → every request hits Postgres directly → Postgres gets slow → same cascade Stripe's API takes 3 seconds instead of 200ms → your checkout route times out → users get errors → you're losing revenue Every one of these is a latency failure , not a crash. The service is still up. It's just slow. And slow is the hardest failure mode to test because your local environment is fast. Why local testing misses this When you test locally, your "database" is either: A real local Postgres running on the same machine (sub-millisecond latency, not production-like) A mock that returns instantly ( jest.fn().mockResolvedValue(data) ) A fake with a flat delay ( await sleep(200) ) None of these produce realistic latency. A real production database has: Fast responses most of the time (p50 ~5ms) Occasional slowdowns (p95 ~50ms) Rare but real spikes (p99 ~200ms, p99.9 ~2000ms) The spik

For 13 years I have worked in production at a steel-tube manufacturer. Not in an office — on the floor, with the machines, the night shifts, the handovers at 6 a.m. A few years ago I started building software in my free time. Not tutorials for their own sake — tools that solve problems I actually see every day. Why a factory worker writes code In production you learn one thing fast: it does not matter what looks good on a slide. It matters what works at shift handover. That perspective turned out to be my biggest advantage as a self-taught developer — I know the problem before I write the first line. What I have built PIPEZ — a shift & part-count PWA. Offline-capable, running on Cloudflare Workers + D1, live in production to capture shift and piece-count data that used to live on paper. A tool-management app. A multi-user client-server app with optimistic concurrency and a local AI assistant, used daily in the office to manage the lifecycle of dies in tube production. DeepCode — an agentic AI coding client. Electron + React + TypeScript, with its own tool loop, a swarm mode, and CI/tests. The project I am proudest of. Plus multi-agent systems, RAG pipelines, and n8n automations that run every day. The stack Python/FastAPI, TypeScript/React, Node, Docker, PostgreSQL + pgvector, Cloudflare Workers, MCP, computer vision. Writing in public I will be writing here about the bridge I keep coming back to: real production experience plus building with AI. If you are automating something messy and real, I would love to compare notes.

Project Log #9: My AI Agent Works on My Phone. But What About Yours? Okeke Chukwudubem Okeke Chukwudubem Okeke Chukwudubem Follow Jun 20 Project Log #9: My AI Agent Works on My Phone. But What About Yours? # ai # webdev # programming # productivity 1 reaction Add Comment 3 min read

Day 9. Template matching works. But screen sizes, resolutions, and Android versions might break everything. Eight days ago, the agent was an idea. Now it can read text, handle interruptions, and find icons on a screen. But there's a question I've been avoiding: does it work on any phone other than mine? The Cross-Device Problem Every screenshot I've taken, every icon I've cropped, every coordinate I've mapped—it's all on one device. My phone. Same screen size. Same resolution. Same Android version. Same DPI. Template matching relies on reference images that look exactly like the target on screen. Change the screen density, change the icon size, change the font scaling, and the match confidence drops. Suddenly "send_button.png" doesn't match anymore, and the agent can't press send. This isn't a bug in my code. It's a fundamental challenge in computer vision: reference-based matching breaks when the visual context changes. Today's Experiment I tested the same agent on a friend's phone—different manufacturer, different Android version, slightly larger screen. The results were humbling. Task My Phone Friend's Phone OCR (text recognition) ✅ 95% accuracy ✅ ~90% accuracy Find "Mom" in contacts ✅ Found ✅ Found Template match: send button ✅ 94% confidence ❌ 62% confidence Template match: back button ✅ 91% confidence ❌ 58% confidence OCR held up reasonably well because text is text. Fonts might change slightly, but the characters are the same. But the icons—the send button, the back arrow—were rendered at a different size and slightly different pixel arrangement on my friend's device. The agent failed to send the message. Why This Matters An AI agent that only works on one phone isn't an agent. It's a script. If I want this to be useful to anyone else—or even to myself if I change phones—it needs to be device-agnostic. Possible Solutions I'm Exploring Solution Pros Cons Multi-resolution icon library Simple. Just crop icons at different DPIs. Tedious. How many variants are eno

Calendar synchronization is one of the most challenging parts of building a multi‑channel rental platform. Every booking, cancellation, modification, or pricing update must propagate across all connected channels quickly and without conflicts. A single missed update can lead to double bookings, lost revenue, or unhappy guests. Why calendar sync is difficult Calendar data is dynamic and often inconsistent across platforms. Common issues include: out‑of‑order updates, conflicting changes from different sources, slow or rate‑limited APIs, missing or duplicated events, timezone inconsistencies, partial updates that overwrite each other. A reliable sync engine must handle all of these edge cases gracefully. Core principles of a robust calendar sync A well‑designed sync system follows several key rules: Event‑driven updates: every change triggers an event rather than a full resync. Incremental synchronization: only changed data is processed. Conflict resolution: timestamps or version numbers determine the winning update. Idempotency: repeated updates produce the same result. Queue‑based processing: heavy operations run asynchronously. Audit logs: every update is traceable. These principles ensure that calendars remain consistent even under heavy load. Real‑world example Short‑term rental platforms rely on accurate calendars to avoid double bookings. A good example of this approach can be seen in an event‑driven short‑term rental calendar synchronization system , where each update is processed through queues, validated, and applied idempotently. If you want to explore how a real SaaS platform handles calendar synchronization, you can check PMS.Rent Conclusion Calendar synchronization is not just a technical feature — it is the foundation of trust between property managers and their tools. When the sync engine is event‑driven, idempotent, and conflict‑aware, the entire platform becomes more reliable and predictable.

Securing LLM Agent Teams: Inside NRT-Defense v0.4.0 Multi-turn autonomous LLM agents are expanding rapidly in safety-critical systems. However, a major vulnerability has been exposed by Lee et al. (2026) in the NRT-Bench paper : adaptive multi-turn attacks can exploit disjoint model vulnerabilities, causing a 8.7% to 12.1% loss of Critical Safety Functions (CSFs) . To solve this, I am open-sourcing NRT-Defense , an adaptive multi-turn defense framework designed to monitor agent sessions and reduce the attack success rate to <1% . The Threat: Context Drift and Disjoint Exploits Standard guardrails evaluate prompts in isolation (single-turn). Attackers leverage this by spreading an exploit across multiple conversational turns. Turn by turn, the context drifts until the agent team completely bypasses its safety containment. The NRT-Bench paper demonstrated this in a simulated nuclear power plant control room with 5 operator roles, 4 attack channels, and 6 critical safety functions. The results were alarming: Metric Value Attack success rate 8.7% — 12.1% Sessions analyzed 149 Models tested 4 frontier LLMs Vulnerability overlap Nearly disjoint The key finding: vulnerabilities are nearly disjoint across models . An attack that works against GPT-4 may not work against Claude. This means model diversity is itself a defense — but only if you can detect and respond to attacks in real-time. The Solution: 3-Step CMPE Defense nrt-defense neutralizes this threat through a continuous, multi-component pipeline: Per-Turn Message Analysis: Evaluates channel risk and turn-escalation metrics. Each message is scored for adversarial content using keyword detection, pattern matching, and channel-specific risk weights. Real-Time CSF Monitoring: Tracks 6 operational critical safety functions simultaneously. Risk accumulates over turns and triggers alerts when thresholds are breached. Context-Aware Misdirection Prompt Engineering (CMPE): When an anomaly is detected, instead of a blunt reject

"These are not your friends. These are not conscious beings. These are not sentient interlocutors.”

So ... what's your In the Weights score?

Give every customer their own Hermes or OpenClaw agent Discussion | Link