标签：#tco

디지털 자산 생태계는 혁신과 파괴의 최전선에서 전례 없는 속도로 진화하며, 기술적 선견지명과 끊이지 않는 규제 마찰이라는 두 가지 특징을 동시에 보여준다. 지난 10년간 이 역동적인 환경을 관찰해 온 연구자로서, 이 산업이 본질적인 암호화 위협부터 전통 금융 시스템 및 정부 감독과의 복잡한 상호작용에 이르기까지 다층적인 문제와 씨름하며 성숙해지고 있음이 분명하게 느껴진다. 최근의 여러 사건들은 이러한 다면적인 현실을 더욱 명확히 보여준다. 이는 미래 인프라를 보호하기 위한 선제적 조치들, 새로운 금융 상품을 정의하고 규제하려는 지속적인 노력, 그리고 디지털 자산 시장이 전 세계 거시경제적 요인에 점점 더 민감하게 반응하는 현상들을 부각한다. 리플(Ripple)이 XRP Ledger(XRPL)의 양자 내성 강화를 위해 추진하는 야심 찬 계획은 미래 지향적인 접근 방식을 잘 보여준다. 이는 가상의 것이지만 잠재적으로 치명적인 암호화 취약점에 대해 그 위협이 현실화되기 훨씬 전부터 대비하는 모습이다. 이러한 전략적 움직임은 현재의 공개키 암호화를 해독할 수 있는 양자 컴퓨터의 이론적 출현, 즉 'Q-Day'에 대한 업계 전반의 인식을 반영하며, 탄력적이고 미래에 대비하는 금융 인프라를 구축해야 하는 절박한 필요성을 강조한다. 동시에 미국 예측 시장 산업은 최근 Kalshi에 대한 연방 항소법원의 판결에서 볼 수 있듯이 심각한 법적 난관에 봉착했다. 이 판결은 혁신적인 플랫폼에 대한 주() 대 연방 규제 관할권에 대해 '판례 충돌(circuit split)'을 야기했다. 이러한 규제 분열은 신생 부문의 성장과 법적 명확성에 상당한 걸림돌이 된다. 이와 동시에 비트코인(Bitcoin)의 최근 가격 움직임은 연방준비제도(Fed) 의장의 매파적 발언 이후 주춤하며, 디지털 자산 시장이 전통적인 거시경제 지표와 중앙은행 정책에 얼마나 깊이 통합되어 있고 또 취약한지를 여실히 보여준다. 이 세 가지 독특하지만 서로 연결된 이야기는 끊임없이 변화하는 글로벌 패러다임 속에서 기술적 우위, 규제 명확성, 그리고 시장 안정성을 추구하는 산업의 모습을 종합적으로 그려낸다. 블록체인 네트워크를 포함한 거의 모든 현대 디지털 시스템의 근본적인 보안은 공개키 암호화의 견고함에 기반한다. RSA와 타원곡선 암호화(ECC) 같은 알고리즘은 개인키와 디지털 서명을 보호함으로써 거래의 무결성과 디지털 자산의 소유권을 보장해왔다. 그러나 충분히 강력한 양자 컴퓨터의 이론적 출현은 이러한 암호화 기본 요소에 실존적 위협을 가한다. 특히 쇼어 알고리즘(Shor's algorithm)이 대규모 양자 컴퓨터에서 실행된다면, 큰 숫자를 효율적으로 인수분해하고 이산 로그 문제를 풀 수 있어 현재의 공개키 암호화를 무력화할 수 있다. 이러한 'Q-Day' 시나리오가 현실화되면 공격자들은 공개된 정보로부터 개인키를 유추해 디지털 지갑과 블록체인 원장의 불변성을 침해할 수 있다. 양자 컴퓨팅 능력의 정확한 시기는 여전히 불확실하지만, 잠재적인 파괴적 혼란 가능성은 리플이 XRP Ledger에 대해 보여준 선견지명처럼 선제적이고 장기적인 인프라 계획을 필수적으로 만든다. 이러한 기술적 당위성과 나란히, 디지털 자산 공간 내 혁신적인 금융 상품에 대한 규제 환경은 여전히 격전지다. 예측 시장은 미래 사건의 결과에 베팅할 수 있는 플랫폼으로, 정보 집약과 금융 파생상품의 흥미로운 교차점을 보여준다. 이러한 시장은 투명성과 효율성을 위해 블록체인 기술을 자주 활용하며, 다양한 실제 결과에 대한 가격 발견과 헤징을 위한 독특한 메커니즘을 제공한다. 하지만 이들의 분류는 중대한 도전 과제를 안고 있다. 과연 이들은 상품선물거래위원회(CFTC)와 같은 연방 규제 기관의 관할권에 속하는 합법적인 금융 '스왑(swaps)'일까, 아니면 주() 차원의 도박 규제를 받는 '스포츠 베팅'과 유사한 것일까? 이러한 정의의 모호성은 규제 공백과 관할권 분쟁을 야기하며, Kalshi와 관련된 현재 진행 중인 법적 분쟁이 이를 잘 보여준다. 통합된 규제 프레임워크의 부재는 혁신을 저해하고 법적 불

Scalable Guardrail Service ASP.NET Core Kubernetes: Architecture, Code, and Ops Quick Answer Scalable Guardrail Service ASP.NET Core Kubernetes: A dedicated ASP.NET Core guardrail microservice on Kubernetes validates LLM requests, enables instant policy updates via Redis, and scales with custom HPA for high‑throughput. Scalable Guardrail Service ASP.NET Core Kubernetes: Why a Dedicated Guardrail Microservice Matters When you expose an LLM‑powered API to the world, every request is a potential compliance risk. A single malformed prompt can surface PII, trigger a policy violation, or even cause a brand‑damaging output. In my experience, the first version of such a system is a set of ad‑hoc filters sprinkled across controllers. Under load, those filters become latency bottlenecks, policy updates race, and audit trails vanish. The root cause is a missing architectural layer that treats guardrails as a first‑class microservice that can scale horizontally, be updated live, and be observed independently. Guardrail Layer Requirements We need a guardrail layer that: Validates every request before it hits the LLM engine. Can be updated without redeploying the entire API surface. Provides per‑tenant isolation and versioning. Logs every decision for compliance and red‑team analysis. Runs at the same scale as the LLM inference service. When This Fails in Production Policy updates are applied via a shared ConfigMap and the pods do not reload, so new rules are never enforced. The guardrail service is single‑instance; a spike in requests triggers a queue that exceeds the LLM engine’s rate limit, causing a cascading failure. Audit logs are written to local disk; a pod crash loses events. Latency spikes because each request performs a synchronous Redis lookup for every policy. Common Mistakes Engineers Make Embedding guardrail logic inside the API controller rather than a dedicated middleware. Using in‑memory policy caches without a TTL, leading to stale rules. Ignoring the fact that

디지털 자산 시장은 지금 변곡점에 서 있다. 블록체인 기술이 본래 파괴적이고 반체제적인 힘에서 벗어나 전 세계 금융 시스템의 점점 더 통합된 구성 요소로 진화하면서, 심오한 변화를 목격하고 있기 때문이다. 이러한 패러다임 전환은 흥미로운 이중성을 보여준다. 한편으로는 전통 금융 기관(TradFi)이 기존 시스템을 강화하기 위해 블록체인을 적극적으로 수용하고 있고, 다른 한편으로는 암호화폐 기반 기업들이 주류 금융과의 간극을 메우기 위해 규제적 정당성을 끊임없이 추구하고 있다. 최근의 이러한 움직임들은 분산원장기술(DLT)이 새로운 하이브리드 금융 아키텍처의 토대가 되는 미래를 예고하며, 이 복잡한 춤사위를 더욱 부각한다. 이러한 흐름의 중요한 한 걸음은 미국 주() 은행 협회들이 2027년 출범을 목표로 전국적인 블록체인 네트워크인 "뱅크체인 얼라이언스(BankChain Alliance)"를 발표한 일이다. 39개 주 협회의 지원을 받는 이 이니셔티브는 스테이블코인, 결제, 토큰화된 예금을 은행 시스템의 규제 범위 내에서 육성하는 것을 목표로 한다. 동시에, 암호화폐 인프라 기업인 제로해시(Zerohash)가 초반의 난관에도 불구하고 미국 통화감독청(OCC)의 신탁은행 인가를 확보하려는 끊임없는 노력은 암호화폐 산업이 주류의 수용과 규제 통합을 향해 나아가려는 의지를 잘 보여준다. 이러한 사건들은 고립된 현상이 아니다. 블록체인의 혁신적인 잠재력이 기존 금융 구조에 의해 형성되고 흡수되는 한편, 암호화폐 벤처들은 확립된 법률 및 규제 준수 프레임워크 내에서 운영하려 하는 중요한 단계를 나타낸다. 광범위한 기술적 야망의 맥락에서, 일론 머스크의 스페이스엑스(SpaceX)가 루이지애나에 1,000억 달러 규모의 우주공항을 건설할 계획이라는 소식은 블록체인과 직접적인 관련은 없지만, 미래 인프라를 재정의할 최첨단 기술에 막대한 자본과 전략적 투입이 이루어지고 있음을 보여준다. 이는 디지털 자산 인프라에 대한 금융 부문의 대규모 구축과도 유사하다. 이 글은 이러한 금융 블록체인 발전의 함의를 깊이 탐구하고, 기술적 기반, 실제 선례, 그리고 내재된 한계를 분석할 것이다. 블록체인 기술의 탄생은 특히 2009년 비트코인(Bitcoin)과 함께, 2008년 금융 위기 동안 전통 은행 시스템의 실패와 중앙집중화에 대한 인식에 대한 직접적인 대응이었다. 탈중앙화, 투명성, 중개자 제거라는 핵심 원칙은 가치 이전과 기록 보관에 대한 대안적인 비전을 제시했고, 이는 처음에는 전통 금융의 회의적인 시선을 받았다. 그러나 기반이 되는 DLT가 성숙해지면서, 금융 기관들은 운영 효율성을 높이고, 결제 시간을 단축하며, 비용을 절감하고, 데이터 무결성을 개선할 수 있는 심오한 잠재력을 인식하기 시작했다. 이처럼 전면적인 거부에서 전략적 채택으로의 점진적인 변화는 지난 10년간의 특징적인 흐름이었다. 전통 금융이 블록체인에 매력을 느끼는 이유는 현재 번거롭고 비용이 많이 드는 프로세스를 간소화할 수 있는 능력 때문이다. 블록체인에서 실제 자산을 나타내는 토큰화된 자산은 즉각적인 결제, 분할 소유권, 그리고 유동성 증가를 약속한다. 특히 규제 대상 기관이 보유한 법정화폐 준비금으로 뒷받침되는 스테이블코인은 암호화폐의 프로그래밍 가능성과 효율성을 전통 화폐와 관련된 안정성 및 신뢰와 결합한 디지털 교환 매체를 제공한다. 이러한 융합은 미국 내에서 복잡하고 진화하는 규제 환경 속에서 진행되고 있다. OCC, SEC, 그리고 주 은행 부서와 같은 다양한 연방 및 주 기관들은 디지털 자산과 DLT 응용 프로그램을 어떻게 분류하고 감독할지에 대해 고심하고 있다. 기술적 야망의 엄청난 규모는 금융 분야에만 국한되지 않는다. 스페이스엑스가 2027년 건설을 시작하고 2029년 첫 비행을 목표로 루이지애나에 1,000억 달러 규모의 우주공항을 건설할 계획을 발표한 것은 다양한 분야에서 최첨단 인프라에 막대한 투자가 이루어지고 있음을 증명한다. 이 프로젝트는 블록체인과는 별개이지만, 궤도 데이터 센터든 차세대 금융 레일이든 미래 기술 패러다임을 지원하기 위한

Short answer: the best way to reduce LLM cost for a product catalog is to measure cost per accepted record, then route each job by difficulty. Count prompt tokens before the call, use a small model for the easy summarize/classify/extract-JSON cases, reserve a stronger model for exceptions, and batch work that can wait. The winning option is the one that preserves the required fields at the lowest cost per accepted result, not the one with the lowest token rate. I build RAG and agent features in Python, so I want this decision to survive contact with production. A catalog description such as “blue jacket, recycled nylon, sizes S–XL” looks easy until one tenant sends HTML, another sends translated attributes, and a third puts three products in one paragraph. The useful unit is therefore a tenant-scoped record with an outcome, a token count, a retry count, and a review decision. Start with the record, not the model For this workflow, the data path is short: normalize a description, count the tokens in the planned prompt, choose a route, request a typed result, validate it, and write the result and its cost to an append-only ledger. A rejected result must remain visible. Otherwise, a cheap model can appear successful simply because invalid JSON and missing attributes disappeared from the report. The ledger needs enough identity to answer a boring but important question: which tenant paid for this retry? I use a job ID, tenant ID, source revision, model route, input token count, output token count, latency, validation status, and review status. Keep the raw description out of ordinary cost dashboards when it contains customer data; the ledger can hold a reference to the source revision instead. Prompt-token counting is a gate, not a decorative metric. If an HTML description expands the prompt beyond its budget, the worker can strip markup, split the record, send it to review, or select a different route. Those choices have different quality consequences, so record the re

The Sliding Window pattern is one of the most vital algorithmic techniques for optimizing array and string problems. Instead of repeatedly processing overlapping subarrays - which leads to brute-force quadratic O(N^2) or O(N*K) complexities, the sliding window technique reuses previous computations to achieve linear time complexity $O(N)$ . In this guide, we will break down the mechanics, core variations, identification rules, real-world applications, and a curated list of 18 LeetCode problems with key solution strategies. 💡 What is the Sliding Window Pattern? A sliding window performs operations over a contiguous sub-segment (subarray or substring) of data structure. As the window "slides" across the array from left to right, elements entering and leaving the window are updated incrementally. Time Complexity Comparison Brute-Force Nested Loops: O(N^2) or O(N * K) Sliding Window Strategy: O(N) (each element is processed at most twice: once entering and once leaving) 🛠️ Recognition & Identification Rules When to Use Sliding Window Contiguous Input: The problem requires evaluating contiguous subarrays or substrings. Window Metric Criteria: You need to calculate statistics such as minimum/maximum length, sum, average, or character frequency targets. Monotonicity Property: Expanding the window strictly increases (or maintains) a target metric, while shrinking the window strictly decreases it (e.g., sum > K or at most K distinct elements over positive numbers). When NOT to Use Sliding Window Negative Numbers in Sum Constraints: If an array contains negative numbers and you are tracking a cumulative sum, expanding the window does not monotonically increase the sum. Use Prefix Sum + HashMap instead. Non-Contiguous Sequences: If the problem asks for subsequences (where elements do not need to be adjacent), sliding window fails. Non-Monotonic Metrics: If moving pointers does not give a predictable increase or decrease in your decision metric. 🔄 Fixed vs. Variable Length Slid

ASP.NET Core Output Caching: How to Make Web APIs Faster in .NET When an API receives the same request repeatedly, performing the same database query and rebuilding the same response every time can waste valuable resources. For example, imagine this endpoint: GET /api/products If thousands of users request the same product catalog, your application might repeatedly: HTTP Request ↓ Controller ↓ Database Query ↓ Business Logic ↓ JSON Response For data that doesn't change frequently, this can create unnecessary database load. ASP.NET Core provides Output Caching to help solve this problem. Instead of executing the complete request pipeline every time, the application can temporarily store the generated response and reuse it for subsequent requests. In this tutorial, we'll look at how Output Caching works, how to configure it, how to invalidate cached responses, and when you should avoid using it. What Is Output Caching? Output caching stores the generated response from an endpoint. For example: First request ↓ GET /api/products ↓ Execute controller ↓ Query database ↓ Generate response ↓ Store response in cache Later: Second request ↓ GET /api/products ↓ Cached response ↓ Return immediately The database doesn't need to be queried again while the cached response is valid. Output Caching vs Response Caching These two concepts are often confused. Response Caching Response caching mainly relies on HTTP caching semantics and headers. Output Caching Output caching is controlled by ASP.NET Core and allows your application to decide which responses should be cached and for how long. Output caching provides more control over server-side response caching. 1. Add Output Caching Start by registering the output-cache services. var builder = WebApplication.CreateBuilder(args); builder.Services.AddControllers(); builder.Services.AddOutputCache(); var app = builder.Build(); app.UseOutputCache(); app.MapControllers(); app.Run(); The important pieces are: AddOutputCache() ↓ Configure cac

A two-factor flag in the user store looks like a reassuring authorization check. It tells us the account has a second factor configured. For a sensitive operation, however, that is only half the question. The other half is about the session in front of us: did this cookie actually complete a second-factor challenge? Those facts can change independently. Treating them as interchangeable can silently promote an old password-only session after the account enables MFA. Two questions that look like one Account capability answers questions such as: Is a factor enrolled now? Could the account complete an MFA challenge? Has that capability since been disabled? Session assurance answers different questions: Which authentication steps produced this session? Did the framework issue this cookie after an MFA challenge? Is the evidence trusted, or merely a user-supplied claim? An enrolled account can still have a password-only session. A previously verified session can also outlive a later change to the account’s factor state. One signal cannot safely stand in for both. The transition that exposes the gap Snapshot tests often miss this because the final state looks correct. The account has MFA enabled, the user is authenticated, and a policy succeeds. Now test the transition instead: Sign in with a password and receive a normal application cookie. Enable MFA for the account without replacing that cookie. Use the original cookie against a sensitive operation. If authorization checks only the current enrolment flag, step three may succeed. Nothing about the original authentication ceremony changed, but the session has effectively been upgraded by a later database write. That is the important boundary: changing account capability must not rewrite the history of an already-issued session. Use two independent signals A generalized policy can be expressed like this: if (! session . IsAuthenticated || ! session . HasTrustedMfaEvidence ) return Deny ; if (! await accountStore . IsMfaStil

MCP 2026-07-28 dropped sessions. The initialize handshake is gone. The Mcp-Session-Id header is gone from Streamable HTTP. Protocol version, client info, and capabilities now travel in a _meta field on every request, so any instance can serve any call. The protocol is cleaner for it. This is the largest revision since launch, and it leaves both of the questions that block enterprise agent deployments exactly where they were. MCP standardizes how a model reaches a tool. Neither question lives inside that scope, and no future revision is likely to put them there: Who is the agent acting as, and what is it allowed to do? What happens when a process takes three days and the model context is gone? The spoiler: on AWS the parts already exist. Policy in AgentCore evaluates every Gateway call in Cedar against a principal, an action, and a resource, and writes the allow or deny to an audit log. Temporal policies, added in August 2026, extend that across an agent's trajectory, including human approval ahead of a privileged action. AgentCore Identity distributes the credentials. Step Functions holds anything measured in days. The remaining work is composition: deciding which principal each agent acts as, and what it may commit to. No service ships that decision. What the stateless redesign actually solved The stateless redesign removes real pain. Long-held SSE connections forced sticky routing, which pushed teams into shared session stores and gateway packet inspection just to scale horizontally. The new model provisions for request rate instead of concurrent users. A round-robin load balancer is now enough. Lambda, Cloud Run, and Workers become viable backends. Multi Round-Trip Requests (SEP-2322) handle elicitation without a held connection. The server returns an InputRequiredResult carrying what it still needs plus an opaque requestState blob. The client collects the answers and re-issues the same call with inputResponses and the echoed state. Any instance picks up the retr

Since AWS Blocks entered public preview in June 2026, I have been making small contributions to the open-source project. AWS Blocks on GitHub In my previous post on AWS Blocks, Amplify, and App Studio , I looked at how these tools differ and what each is trying to achieve. While revisiting the Agent Block, one detail caught my attention: The AWS Blocks Agent is not currently running on Amazon Bedrock AgentCore. At a glance, it is easy to assume the relationship looks like this: AWS Blocks └─ Agent └─ Amazon Bedrock AgentCore But that is not how the current implementation works—at least not on main as of August 12, 2026. Then the story gets interesting. When I wondered whether an agent should simply use AgentCore directly, I found a fairly concrete set of pull requests that proposes moving the Agent Block's execution model to AgentCore Runtime. I contribute to AWS Blocks, but this is not an AWS statement or a roadmap. It is my reading of the public documentation and the open-source repository, from the perspective of both a user and a contributor. TL;DR The Agent Block on the current main branch does not run on AgentCore Runtime. It combines the Strands Agents SDK with AsyncJob , Realtime , FileBucket , and DistributedTable . A five-PR stack proposes migrating the Agent Block's execution model to AgentCore Runtime. As of August 12, 2026, all five migration PRs are still draft and unmerged. They are not an official roadmap. A separate open PR proposes Blocks for AgentCore Memory, Gateway, and Identity. So the most accurate conclusion today is this: AWS Blocks Agent is not AgentCore today, but the repository contains concrete proposals for bringing the two together. The Agent Block today is not AgentCore Let's start with the implementation on main . The Agent Block uses the Strands Agents SDK . But it is not a standalone agent runtime; it composes several Blocks to handle execution, streaming, and persistence. At a high level, the structure looks like this: Agent ├─ St

TRON processed $2.1 trillion in USDT transfers during Q2 2026, according to Messari. During the same quarter, circulating USDT on TRON reached $87.9 billion, putting it ahead of Ethereum. Those numbers point to something developers working with stablecoins have to consider more carefully: the blockchain underneath a token can shape the entire payment experience. USDT on TRON uses the TRC-20 token standard. That means a USDT transfer is a smart contract transaction rather than a native TRX transfer. The wallet signs the transaction, the network executes the token contract and the resulting balance change is recorded on-chain. For an application accepting USDT, this creates several technical requirements. The system needs to identify the correct token contract, monitor the relevant transfer events and wait for sufficient confirmation before crediting the user's balance. Checking the address balance alone is not enough. TRON's developer documentation provides APIs for retrieving TRC-20 transaction history and filtering transfers by contract address. A payment system can use this data to monitor incoming USDT deposits and associate them with the correct customer account. The transaction also has a resource cost. TRON uses Bandwidth and Energy to process transactions. Regular transactions consume Bandwidth, while smart contract execution requires Energy. When an account does not have enough available resources, TRX is burned to cover the remaining cost. This creates an operational detail that users may never see. Someone can hold USDT in a wallet and still need TRX to send it. A payment provider can handle this in several ways. It can maintain TRX balances, stake TRX for resources or use delegated Energy. Another design can leave the requirement with the user. The choice affects the product. The amount of Energy required can also change depending on the destination account. TRON's documentation notes that a USDT transfer to an address that already holds USDT generally re

From Learning to Teaching: Building Bitcoin Tools in Rust Susan Githaiga Susan Githaiga Susan Githaiga Follow Aug 10 From Learning to Teaching: Building Bitcoin Tools in Rust # rust # bitcoin # opensource # buidl4africa 1 reaction Add Comment 3 min read

The cryptocurrency and decentralized finance ecosystems generate an overwhelming amount of data every single day. For developers building financial dashboards, algorithmic trading tools, or market research platforms, accessing clean, standardized, and reliable data is absolutely critical. Token Terminal has established itself as a premier provider of fundamental financial data for the crypto space, offering institutional-grade metrics across various blockchains and decentralized applications 1 . However, integrating complex third-party APIs into enterprise PHP applications often requires writing significant amounts of boilerplate code to handle edge cases, rate limits, and unexpected response structures. To solve this problem and streamline the developer experience, the PHP community now has access to a dedicated solution: the tokenterminal-php SDK. This new open-source package provides a robust, fully-typed, and developer-friendly PHP 8.1+ client for the Token Terminal API v2 2 . Designed with modern PHP standards and framework integration in mind, it abstracts away the complexities of the underlying HTTP transport, allowing developers to focus entirely on building their applications rather than wrestling with API mechanics. The Challenge of Integrating Financial APIs When working with comprehensive financial data APIs like Token Terminal, developers frequently encounter several architectural challenges. First, there is the issue of rate limiting. Token Terminal enforces a strict limit of 1,000 requests per minute 3 . When building data pipelines that ingest historical metrics across hundreds of assets, hitting this limit is practically guaranteed. A naive implementation will simply crash or drop data, requiring manual intervention. Second, the cryptocurrency space moves rapidly. Projects frequently rebrand, merge, or migrate to new smart contracts. The Token Terminal API handles this gracefully by issuing HTTP 308 Permanent Redirects when a requested project ID ha

Originally published by InvisibleHill Research . This cross-post preserves the original research cut-off and source list. Research cut-off: July 30, 2026. Miner signaling is a live metric and may have changed after publication. BIP 110 begins with a problem that many Bitcoin users can recognize. A miner can collect a one-time fee for including an image, token payload, or other arbitrary data, while thousands of node operators absorb the cost of downloading, validating, and sometimes storing it. The proposal's authors see that mismatch as a subsidy for data storage and a threat to Bitcoin's use as money. Their answer is a temporary soft fork. For about one year, BIP 110 would make several currently valid transaction structures invalid under consensus rules. It would cap OP_RETURN outputs at 83 bytes, limit many data pushes and witness items to 256 bytes, restrict large output scripts and Taproot control blocks, and disable several Taproot upgrade paths and script features that can carry data. Adam Back agrees with the premise more than his opposition sometimes suggests. He has said that Bitcoin is about money and that spam has no place in its timechain. He also designed Hashcash to make spam costly. His objection is to the remedy. In Back's view, an annoyance that fits inside Bitcoin's existing block limit does not justify a contentious consensus change, especially one that can be bypassed, can interfere with legitimate scripts, and has not earned technical or economic agreement. That distinction is the center of the debate. BIP 110 asks whether Bitcoin should discourage an unwanted use through local policy and fees, or declare some forms of that use invalid for everyone. Back's case is stronger on this question. The proposal identifies a real externality, but it offers an asymmetric bargain: incomplete filtering in exchange for a new consensus precedent, a more complicated upgrade path, and a material risk of a minority chain. A policy dispute became a consensus pro

When a Go application needs on-chain and protocol-level data, the HTTP request itself is usually the easy part. The difficult work starts afterward: defining request models, decoding inconsistent payloads, respecting rate limits, recovering from transient failures, and deciding what to do when one part of a multi-metric query succeeds while another part does not. Those concerns can quietly turn a small integration into a maintenance burden. tokenterminal-go is an open-source, production-oriented Go SDK for Token Terminal API v2 that aims to remove that plumbing. The project supports all 24 documented API routes across Assets, Projects, Market Sectors, Metrics, and Datasets; it requires Go 1.21 or newer and uses only the Go standard library. 1 It is a focused choice for engineers building internal analytics services, data jobs, dashboards, research tooling, or any application that needs Token Terminal data without hand-rolling an HTTP client. The practical promise: keep the integration idiomatic and type-aware, while the client handles the failure modes that normally appear only after an application reaches real traffic. Why an SDK matters here Token Terminal’s API gives programmatic access to its data, but it requires an API key and an API-enabled plan. 2 That makes the client layer part of the application’s operational surface: it needs to handle credentials, request timeouts, rate limits, pagination or filtering parameters where relevant, and failures that should not crash a larger data pipeline. The library addresses these needs with a small, deliberate design. Its client methods take a context.Context , its response envelopes use generic Result[T] types, and its errors can be inspected with standard Go mechanisms such as errors.Is and errors.As . 1 In other words, callers can keep control of cancellation and business policy instead of receiving opaque, string-only errors. Capability What it means in practice Why it is useful Zero external dependencies The packag

A security vulnerability in the cryptocurrency hardware wallet Coldcard is allowing hackers to drain the crypto from victims’ wallets. The total losses amount to more than $130 million, according to blockchain-monitoring firms.

A product search, a filter list that kept growing, and a status code I hadn't seen in years. Filters went in the query string, the way they always do. That held up fine until someone saved a "filter set" with a few hundred SKUs in it and the endpoint started answering with 414. I rebuilt a small version of it to find the exact wall. Same search, filters as repeated ?sku= values, count going up in steps of a hundred: 1) GET with filters in the URL 100 filters | request line 1534 bytes | 200 OK 200 filters | request line 3034 bytes | 200 OK 300 filters | request line 4534 bytes | 200 OK 400 filters | request line 6034 bytes | 200 OK 500 filters | request line 7534 bytes | 200 OK 600 filters | request line 9034 bytes | 414 RequestUriTooLong Kestrel's default max request line is 8 KB, and the request line is the method plus the URL plus the HTTP version. Somewhere between 500 and 600 filters, my URL stopped being a URL. Every fix I knew was a compromise. A body on GET is undefined by spec and some proxies quietly drop it. POST works, but POST announces "this might change something", so caches skip it, gateways won't auto-retry it, and anyone reading your API docs has to guess whether POST /search is actually a search. Cramming the filters into a header is the kind of idea that sounds clever for about a day. The method that was missing RFC 10008 defines QUERY , and it's exactly the thing that spot in the matrix was waiting for. The body carries the query. The method is safe and idempotent, so it can be retried after a dropped connection without anyone panicking. Responses are cacheable, and the spec is explicit that the cache key has to be built from "the request content and related metadata". There's also a nice touch on the response side: Content-Location can point at a URL where those exact results can be fetched with a plain GET. The one-line version I keep giving people: it's a GET with a body, and that's the entire point. Wiring it up in ASP.NET Core 10 .NET 10 shi

Disclosure: This post includes affiliate links; I may receive compensation if you purchase products or services from the different links provided in this article. Credit: codemia.io Hello Devs, if you're preparing for software engineering interviews, particularly in MAANG, you already know that Data Structures & Algorithms (DSA) and System Design are two key areas where you will be rigorously tested. While LeetCode is the go-to platform for DSA, system design has always been a challenge. While there are many websites and platforms to prepare for System Design Interviews like ByteByteGo , DesignGurus.io , Exponent , Educative , and Udemy , there is nothing like LeetCode. These are great resources to learn fundamentals, go through case studies, and understand the theory part of system design, but LeetCode-style practice is one thing that is missing - until now. I recently found Codemia.io , and I must say, it feels like the LeetCode for System Design. If you've struggled with structuring your system design answers, getting real feedback, or knowing whether your approach is correct, Codemia.io is a game-changer. They not only have the biggest collection of System Design and OOP Design problems for practice, but they also have a free System Design course called Tackling System Design Interview Problems , which is a great free resource to learn essential System Design concepts. It's a short course with 2 hours of content, but it's powerful and also has quizzes to test your skills. Here are all the key System Design topics you can learn on this free course: Now, let's check out how Codemia.io can help you to prepare better for your System design and OOP Design interview, and why I think it's like Leetcode for System design. Most system design resources today are long, text-heavy articles or expensive courses. The problem? No hands-on practice - Reading about system design isn't enough; you need to actively design solutions. No structured progression --- Unlike DSA, where

The first time I audited seriously, I opened the biggest contract in the repo and started reading line one. Two hours later I had a headache and zero findings. I had memorized how the code worked without ever asking what it was supposed to guarantee. That is backwards, and it took me a while to unlearn it. Now I do not read Solidity first. I read the scope, and before I look at a single function body I write down what must always be true. Bugs are violations of those truths. If you do not know the truths, you are just admiring the code. Step one: write the invariants before you read An invariant is a property the protocol claims will always hold, no matter who calls what in what order. For a contest, I start with money and control, because that is where severity lives. Two questions cover most of it: Who can move funds, and under what conditions? What must always hold about the accounting? For a lending-pool-shaped protocol my starting invariant list looks like this, written in plain language before I care how any of it is implemented: The sum of all user deposits minus all borrows equals the pool's available liquidity plus outstanding debt. Accounting must reconcile. A user can only withdraw up to their own balance, never more, never someone else's. A position can only be liquidated when it is actually under the health threshold. Interest accrues monotonically, it never goes backwards in a way that lets someone repay less than they owe. Only the borrower, or a liquidator on an unhealthy position, can reduce a debt. Nobody except governance can change interest rate parameters or the oracle. Notice none of that mentions a function name. These are the promises. Now my job for the rest of the contest is simple to state: find an ordering of calls that breaks one of these. Step two: map the external entry points Funds do not teleport. Something has to be called from outside for state to change. So I list every externally reachable function, because the attack surface is

You built something. Tests pass. You're days from mainnet. Before you either skip security entirely (please don't) or spend weeks lining up a full audit, here's a self-check you can run in 20 minutes that catches the mistakes I see most often in first-time deployments. I run security reviews for small and new protocols, and the same handful of issues come up again and again. None of these need a tool — just your eyes and this list. 1. Who can call what? Open every external / public function that moves funds, mints, pauses, or upgrades. For each, ask: should a random address be able to call this? If not — is there an onlyOwner / onlyRole / require(msg.sender == ...) guarding it, in the function itself or in every internal function it calls? The classic bug isn't a missing modifier. It's a function that looks unguarded but delegates to a guarded internal one (fine), or one that looks guarded but the guard is in a branch a caller can skip (not fine). Trace the call, don't trust the signature. 2. The first-depositor trap (if you have a vault) If you mint shares from deposits (ERC-4626 or anything share-based), the first depositor can sometimes donate assets directly to the contract to inflate the share price, so the second depositor rounds down to zero shares and loses funds. Fix: virtual shares, a dead-shares mint at deploy, or a minimum-liquidity lock. OpenZeppelin's ERC-4626 handles this out of the box — a hand-rolled vault usually doesn't. 3. Reentrancy — but only the real kind Not every external call is reentrancy. It's a bug when an attacker-controlled call can re-enter and corrupt shared storage before you've updated it. Quick checks: Do you update state before the external transfer (checks-effects-interactions)? Is there a nonReentrant on functions that move value? Is the call target a trusted, immutable contract, or an arbitrary address the attacker supplies? A call to a protocol-owned contract, or a memory /local variable written after the call, is usually not

There's a romantic idea about Bitcoin's chain: that it's a wall of human messages. Proposals, memorials, "Vahe was here," pizza jokes, the occasional protest note pinned into the world's most expensive append-only log. I wanted to know if that was actually true. So I counted. Every OP_RETURN output, from the genesis block to block 958,893, no sampling. The answer is no, and it's not close. The one number All human-readable OP_RETURN text ever mined into Bitcoin: 3,827,227 outputs. Runes, one token protocol, in its own era: 171,114,058 OP_RETURN outputs. That's a ratio of 44.7 to 1 . One machine protocol, in a single two-year stretch, wrote about 45 times more to the chain than every human-readable message in Bitcoin's entire history combined. The evidence, per era I split the chain into four eras by block height, not by any label stored in my database. Height boundaries are canonical and anyone can check them against a node, so the result doesn't depend on trusting my extractor's tags. era height range boundary event pre-ordinals 0 – 767,429 before the first inscription ordinals 767,430 – 779,831 inscription #0 to BRC-20 deploy boom-brc20 779,832 – 839,999 BRC-20 ordi deploy to Runes runes 840,000 – 958,893 Runes launch at the halving Then I counted the full population of OP_RETURN outputs in each era. Human-readable text, Runes token messages, and binary blobs (Veriblock and OMNI proof-of-proof timestamping, mostly). era total OP_RETURN human text human % Runes Runes % binary binary % pre-ordinals 51,965,944 861,532 1.66% 7 0.00% 51,103,723 98.34% ordinals 261,767 32,189 12.30% 3 0.00% 229,544 87.69% boom-brc20 2,980,954 402,161 13.49% 40,251 1.35% 2,538,248 85.15% runes 177,474,762 2,531,345 1.43% 171,114,058 96.42% 3,828,604 2.16% Here's the honest twist When I started, I expected to find a fall. A golden human era that machines later ate. That's the clean story, and it's wrong. Look at the human % column again. Human text was never the majority of OP_RETURN. Not