Quinn Hughes says his feet are ‘planted’ in Minnesota, Wild deal 'could happen soon' https://www.nytimes.com/athletic/7720935/2026/10/24/wild-quinn-hughes-contract-talks/ A day after Team USA teammate Connor Hellebuyck was traded to the Devils, Hughes said his "feet are planted" in Minnesota. #IceHockey #Hockey
Search
398 results for “heppen”
-
So ... Post Uchiha Clan Massacre, What Exactly Happened to That Part of Town
https://www.resetera.com/threads/1669433
#resetera -
#VoteEarly because somehow, this is where we’re at in 2026‼️
🚨 TEXAS - Early Voting happening now thru Oct 30!
🗳️Vote for TX Democrats up and down the ballot!
Teams Hinojosa, Talarico, Goodwin, Johnson, Eckhardt, Tucker, Rosenthal, Flores, Garcia #CD35 🤠
More info: texasdemocrats.org/our-candidates -
Every week, we issue a new weekly post that summarizes what happened on Week 43 (10/24/2026).
#Aptivi #AWTN #WeeklyDigest #TechNews #TechUpdates #Blog #Blogging #Website
https://officialaptivi.wordpress.com/2026/10/24/aptivi-weekly-tech-news-issue-21-week-43-10-24-2026/
-
Look, world. You need to stop trying to get my hopes up. It's not happening. I am determined to brace for the worst for as long as required. (Though it is probably shaving months off my lifespan.)
@alternet_rss_bot https://mas.to/@alternet_rss_bot/117512995171294143
-
I get tired of the same types of "THIS is gonna be the end of Trump!! We have evidence of ____" posts and nothing ever happens.
-
CW: Digger spoiler
The bit where dripping water is staining the set and getting collected in buckets is great because it still kind of reads ambiguously: is this part of the play or not? Because the full revelation of what the world outside the play looks like hasn’t happened yet, it’s can’t be fully understood as you look at it, you just get to look at the image bemusedly.
-
Why existential thoughts occur? Why they seem to be desired?
I theorize it creates some stimulating feeling of mystery, self-awareness. It is stimulating, that is is why it happens?
-
An AI agent should never keep access simply because nobody remembered to remove it. Start...#agents #ai #cybersecurity #security #software #coding #development #engineering #inclusive #community
The Dangerous Part of Agent Access Is What Happens After the Task -
Hmmm … #macOS #GoldenGate has been updated from 27.0.1 to 27.2
Without updating to #macOSGoldenGate 27.1 on the way.
I wonder what happened, there?
-
Math.random()is not a key generator. Everyone knows this. And yet — when a widely deployed SM2 library seeded its key material at module load, that's effectively what happened. Except worse: in Node.js, the randomness pool was never even filled.This is the story of CVE-2026-73567, a vulnerability I reported and got credited for after independent reproduction by the maintainer, and what it teaches us about the whole class of weak-entropy key compromises.
The discovery
While auditing key-generation paths in SM2 (the Chinese national elliptic-curve standard, mandatory in regulated industries there), I noticed something odd in the dependency chain: a big-number library harvested entropy fromMath.random()— the non-cryptographic, browser-grade PRNG — at module initialization, and used it to seed its internal state. That state then fed private-key generation.The publicly discussed impact assumed ~128
Math.random()calls at startup. When I built an instrumented Node victim and counted, the real number was zero. V8 defersMath.random()'s pool initialization in a way that left the seeding path reading predictable values — the effective root cause was a clock-only seed, and the advisory's root cause was corrected accordingly.The consequence: given roughly a millisecond-scale time window, private keys were recoverable by enumeration. Sub-second. On an ordinary laptop.
And it didn't stop at static keys. The same RNG stream also fed signing nonces and ephemeral encryption keys. That means a key used only for signing was equally recoverable, and ciphertext from affected versions could be decrypted without the key.
What happened next
- The maintainer independently reproduced my findings, corrected the advisory's root-cause description, expanded the impact statement (nonces, ephemerals), and shipped a fix requiring caller-supplied CSPRNG.
- My credit line — "Guigui Wang (Correctover)" — is now part of the public advisory.
- Versions before the fix remain vulnerable forever. Every key generated by an unpatched build in a predictable-time window should be considered compromised.
This is a class, not an incident
One library got caught. But weak entropy is a systematic failure mode across the key-management stack:- V8's PRNG (
Math.random(), xorshift128+ / MWC1616 eras) can be fully state-recovered from a handful of consecutive outputs — meaning any JS wallet or signing code that ever touches non-CSPRNG randomness is one observation away from compromise. - Historical events (Randstorm-class bugs, 2014-era wallet RNG flaws) show the same pattern repeating across ecosystems.
- Cross-address clustering: weak-RNG victims often reuse exposed material across chains and address types, turning one bad key into a trail of them.
- The SM2 ecosystem is structurally exposed here: guomi compliance pushes SM2 into places where the surrounding JS/Node key hygiene was never designed for it.
If your product generates keys, signs, or encrypts — in JavaScript especially — the question isn't whether your crypto is strong. It's whether your entropy path is.
What we do about it
At Correctover we recover keys from weak entropy — to prove the exposure before someone malicious does, and to build evidence that holds up:- Black-box weak-entropy health checks on key generation and signing paths
- Real recovery demonstrations in isolated environments, with signed, timestamped evidence receipts (Ed25519 + RFC 3161) — findings a court or auditor can verify without trusting us
- Coordinated disclosure done right: the advisory process above is our reference case
If you build wallets, custody, or exchange infrastructure and want your entropy path audited against this exact attack class, reach out: [email protected].
Guigui Wang is the credited reporter of CVE-2026-73567 (GHSA-vh45-f885-3848). Correctover builds runtime verification and evidence infrastructure — receipts over promises.#security #cryptography #blockchain #web3 #software #coding #development #engineering #inclusive #community
Your keys are weaker than your cryptography: CVE-2026-73567 and the dead RNG that seeded SM2 keys -
This is one of the arguments/stories I'm going to tell in my talk "Mapping Biases to Testing in the LLM era" at Oredev and the Agile Testing Days in November.
I will also make a video of this talk after those conferences have happened.
And that will be my last contribution to tech for the foreseeable future.
-
Up until version 4.12, when #syslog_ng ran into an error jumping to a saved #systemd #journal position, it read the journal from the beginning. With the latest syslog-ng version, you can configure what happens in case of such an error.
https://www.syslog-ng.com/community/b/blog/posts/syslog-ng-journald-source-how-to-avoid-log-bombs-on-errors -
🤔 Are you still running #ingress #nginx?
🛑 Did you know retirement for self-managed was announced in November 2025 and the last update happened in March 2026?
🚦 And that #AKS managed add-on provides extended support through November 2026 which end in 35 days?
🏃➡️ #Migrate now to Gateway API https://learn.microsoft.com/en-us/azure/aks/app-routing-nginx-to-gateway-api-migration
-
Most banner blockers do the same thing: they hide the banner with CSS and call it a day. The banner...#privacy #webdev #chrome #gdpr #software #coding #development #engineering #inclusive #community
Hiding a cookie banner is not consent — what actually happens when you click "Reject all" -
'Genocide is not a modern invention. What is modern is the attempt to define it, prohibit it, and — crucially – to deny it while it is happening.'
#unitednations #israel #usa #zionism #racism #terrorism #crimesagainsthumanity #genocide #boycottdivestsanction #freepalestine #fromtherivertothesea
https://theaimn.net/the-destruction-of-truth/ -
The Now Now
The show where we interview guests, review current movies and shows, learn something new or spend an hour talking about what's happening now...Great Australian Pods Podcast Directory: https://www.greataustralianpods.com/the-now-now/
#AusPods #Podcasts #Podcasting #Australia #Society #Culture #Conversations #Film #TV #Reviews #Universities
-
Still new to #Toronto, but every poll I saw and the reporting indicated that the mayor election was going to be close, or even go to Bradford. But Chow just *crushed* Bradford. Curious to know what happened. (If I could vote here, it would have been for Chow).
-
omg i recognized that i had some friction in my life and now i can start figuring out how to solve it
is this how people always have side projects? i've never really been good at recognizing the friction when it happens and being like "i could fix this"
-
-
Halfway through a two-day batch run I noticed that one answer looked suspiciously like the answer to the item two rows above it, and I could not prove which input it came from. Has that ever happened to you — the job finished, the output looked plausible, and you had no way to defend a single row of it? These are my field notes from fixing that, with the harness I ended up keeping.
What I was actually trying to do
I had a flat list of short, independent text items, and I wanted one short answer per item, written to a ledger I could re-run safely. Sending one request per item is the obvious path, but it doubles the number of round trips, and every round trip is another chance to miss a wall-clock deadline. So I tried the cheaper-looking option: put two items in one prompt and ask for two answers back. Note that this is not a quota argument — I never measured a quota, and I am not claiming one exists. The motivation was purely fewer round trips and fewer half-finished batches.For context, the driver ran on MonkeyCode's free server option, and the calls went through its free model access. Disclosure: This article was prepared as part of MonkeyCode's product outreach. I will keep the product out of the technical claims, because the failure below is a property of my prompt and my validator, not of any provider.
Day one: the harness I wrote
The whole thing is one file with no dependencies beyond the Python standard library, which was deliberate. If the harness can move between machines withscpand nothing else, I can debug it anywhere, including on a machine I do not own. Here is the shape of it.# batch_harness.py — stdlib only; you supply call_model()
import hashlib
import json
from dataclasses import dataclass, fielddef item_id(text: str) -> str:
return hashlib.sha256(text.strip().encode("utf-8")).hexdigest()[:12]@dataclass
class Item:
text: str
id: str = field(init=False)def __post_init__(self):
self.id = item_id(self.text)def build_prompt(items):
blocks = "\n".join(f'<item id="{i.id}">{i.text}</item>' for i in items)
return (
"Answer each item separately. Return a JSON array only, no prose.\n"
'Each element must be {"id": "<id from the item tag>", "answer": "<answer>"}.\n'
"Copy ids exactly. Do not renumber, merge, or reorder the items.\n\n"
+ blocks
)The important line is the id, and it is deliberately boring: a hash of the input text, truncated. Same input, same id, forever — so a second run of the same ledger is a no-op by construction. If the id were derived from the model's output, a reworded answer would look like a brand-new item, and the queue would quietly grow.
The validator, which is where the actual work lives
def validate(items, raw):
try:
payload = json.loads(raw)
except json.JSONDecodeError as exc:
return None, f"not_json: {exc.msg}"
if not isinstance(payload, list):
return None, "not_a_list"rows = [r for r in payload if isinstance(r, dict)]
got = [str(r.get("id", "")).strip().lower() for r in rows]
want = [i.id for i in items]if len(got) != len(set(got)):
return None, "duplicate_ids"
if set(got) != set(want):
missing = sorted(set(want) - set(got))
extra = sorted(set(got) - set(want))
return None, f"set_mismatch missing={missing} extra={extra}"answers = {r["id"].strip().lower(): r.get("answer", "") for r in rows}
if any(not isinstance(a, str) or not a.strip() for a in answers.values()):
return None, "empty_answer"
return answers, "ok"Two details I will defend. First, I lowercase and strip the id before comparing, because that transform is lossless — an uppercase hex string identifies exactly one item. Second, I refuse every lossy match: no positional mapping, no prefix matching, no edit distance. Fuzzy matching is precisely how you end up with two answers for one item and a warm feeling that everything is fine.
What broke on day two
Two failure modes showed up, and both were invisible to atry/exceptaround the HTTP call.- Answers came back without ids. The response was a clean JSON array of
{"answer": ...}objects, in a plausible order. Nothing errored. A positional mapper would have accepted this and been right — probably. - Ids came back that I never sent. One batch returned eleven-character ids instead of twelve; another returned ids that were valid hex but belonged to nothing in my prompt. Set equality caught both instantly; a length check would not have.
Why is partial acceptance worse than a loud failure here? Because a batch that is 50% valid does not stop the run — it just moves two items into the wrong bucket, and you discover it when someone reads the output.
The fix: fail the batch, then fall back to one
def run_batch(items, call_model, attempts=2):
for attempt in range(1, attempts + 1):
raw = call_model(build_prompt(items))
answers, verdict = validate(items, raw)
if verdict == "ok":
return answers, {"attempts": attempt, "verdict": verdict, "fallback": False}out = {}
for item in items:
raw = call_model(build_prompt([item]))
answers, verdict = validate([item], raw)
out[item.id] = answers[item.id] if verdict == "ok" else None
return out, {"verdict": "fallback_single", "fallback": True}python batch_harness.py --input items.jsonl --batch-size 2 --ledger runs/ledger.jsonl
tail -n 3 runs/ledger.jsonl{"batch": ["9f2c41ab07de", "41ab9f2c07de"], "attempt": 1, "verdict": "set_mismatch", "extra": ["7d10c3a1f0b2"], "fallback": true, "model_string": "<record what you actually got>"}
The ledger excerpt above is illustrative — the values are placeholders, and the deliverable is the columns, not the numbers. Record the model string you actually received, because free access is not the same thing as a pinned version, and a drifting model is a variable you want in the log.
The run sheet I would keep
ColumnWhy it earns its placebatch(sorted ids)Reproducing a failure needs the exact inputs, not the item countattemptTells you whether retries are rare or structuralverdictDistinguishesnot_jsonfromset_mismatch, which are different bugsextra/missingThe invented ids are the signal that the prompt driftedfallbackA rising fallback rate means the batch size is too aggressive
Items per callUse it whenDo not use it when1Items are long, or ordering is contractualYou are already comfortable with the fallback path2Items are short, independent, and id-stableOne bad item can poison its neighbour4+You have eyes on the ledger during the runYou cannot inspect the first hundred rows by hand
And a decision table for batch size, which is really a question about failure cost:What I would repeat, and what I would not
I would repeat the input-derived id and the strict set-equality check on day one, not day two; both are ten lines and they replace a whole class of late-night doubt. I would repeat keeping every model call behind one function, because it made the fallback trivial to write. I would not repeat starting at batch size two before watching a hundred single-item calls go through cleanly. The boring baseline is what tells you whether batching is safe for your particular items.Who should not do this
- Anyone whose items reference each other, since batching changes what the model can see at once.
- Anyone under a hard latency or availability guarantee, because a free endpoint is a shared one and I make no promises about it.
- Anyone who cannot hand-inspect the first hundred outputs, since the validator checks shape and nothing else.
- Anyone paying per token on a long shared instruction, where duplicating it per item costs more than the round trips you save.
The harness does not know whether an answer is correct — it only knows that every id it sent came back once. That is a smaller promise than it sounds, and it is the one I can actually keep. If you run this drill on the free model access, start at batch size one and let the ledger tell you when two is safe.#python #ai #testing #debugging #software #coding #development #engineering #inclusive #community
48-Hour Field Notes: I Batched Two Items Per Call and Lost Track of Which Answer Belonged to Which Input - Answers came back without ids. The response was a clean JSON array of
-
The market is going to be flooded with gently used Nvidia GPUs and I wouldn’t want to be long on NVDA when that happens. @yuchenj_uw https://bird.makeup/users/yuchenj_uw/statuses/2114043133734637735
-
Politics Insider: Prime Minister calls Indian Act racist legislation, says he’s open to abolishing it
Hello, I’m Marie Woolf standing in for Ian Bailey. Welcome to Politics Insider. Let’s look at what happened…
#Canada #MarkCarney #newsletter #noastack #nodelphi
https://www.europesays.com/canada/265527/ -
I wired up a free model endpoint last month. I sent one request. It returned 200 OK. I shipped the feature. Then the tool calls never happened. The endpoint accepted the request. It just ignored half of it. Sound familiar?
Here is my question. What does a 200 actually prove? My answer: almost nothing about capabilities. It proves the transport worked. That is it.
So I stopped trusting status codes and started probing the contract. This post is the FAQ I wish I had read first. It ends with a script you can run in about two minutes.
Myth 1: A 200 means the model supports my feature
The server can accept atoolsarray and silently ignore it. The model then answers in prose. No error. No warning. Your code sees a normal response and skips the branch. Is that a bug in the model? No. It is a bug in your assumption.The corrected model: support is a property of the endpoint, not of the model name. Probe it. Record it. Re-probe when anything changes.
Myth 2:
finish_reasonis optional metadata
It is the most important field in the response.lengthmeans the model ran out of output budget. Your answer looks fine and is probably cut in half. I have watched a parser happily eat a truncated JSON object.{"choices":[{"finish_reason":"length","message":{"content":"{\"items\": [1, 2, 3, 4"}}]}
If you do not branch on
finish_reason, you are parsing whatever bytes arrived. That is not a feature. That is a coin flip.Myth 3: Streaming and non-streaming are interchangeable
They are two different code paths. In streaming,finish_reasonarrives in the final chunk, not the first. Some servers only report token usage when you ask for it explicitly. Some omit it entirely.Ask yourself: does my client read the last event? Mine did not, for a week. I was logging
Noneas the finish reason every single time.Myth 4: JSON mode means my schema
It means valid JSON. It does not mean your keys. It does not mean your types. Validate every response against a schema before it touches business logic. Treat model output like user input, because that is what it is.Myth 5: Retries are always safe
Retry a failed read, fine. Retry a tool call that already wrote a row, and now you have two rows. I learned this from a duplicate charge, not a blog post.Add an idempotency key your tool honors. Make the retry decision depend on the operation, not on the exception class.
The artifact: a five-minute capability probe
This script uses only the Python standard library. It assumes a chat-completions-shaped endpoint. Adjust the paths if yours differs.# probe_capabilities.py — smoke test only, not a benchmark
import json, os, time, urllib.request, urllib.error, concurrent.futures as cfBASE = os.environ["BASE_URL"].rstrip("/")
KEY = os.environ["API_KEY"]
MODEL = os.environ["MODEL"]def call(payload, stream=False, timeout=60):
req = urllib.request.Request(
BASE + "/chat/completions",
data=json.dumps(payload).encode(),
headers={"Content-Type": "application/json",
"Authorization": f"Bearer {KEY}",
"Accept": "text/event-stream" if stream else "application/json"},
method="POST")
t0 = time.time()
try:
with urllib.request.urlopen(req, timeout=timeout) as r:
return {"status": r.status, "ms": int((time.time()-t0)*1000),
"raw": r.read().decode("utf-8", "replace")}
except urllib.error.HTTPError as e:
return {"status": e.code, "ms": int((time.time()-t0)*1000),
"raw": e.read().decode("utf-8", "replace")}def probe_truncation():
p = {"model": MODEL, "max_tokens": 8,
"messages": [{"role": "user", "content": "List ten colors."}]}
r = call(p)
if r["status"] != 200:
return {"probe": "truncation", "ok": False, "why": r["status"]}
ch = json.loads(r["raw"])["choices"]
[0] return {"probe": "truncation", "ok": True,
"finish_reason": ch.get("finish_reason"),
"reports_usage": "usage" in json.loads(r["raw"])}def probe_tools():
p = {"model": MODEL, "max_tokens": 128,
"messages": [{"role": "user", "content": "Read ./README.md and report its first line."}],
"tools": [{"type": "function", "function": {
"name": "read_file",
"description": "Read a file from disk.",
"parameters": {"type": "object",
"properties": {"path": {"type": "string"}},
"required": ["path"]}}}]}
r = call(p)
if r["status"] != 200:
return {"probe": "tools", "ok": False, "why": r["status"]}
msg = json.loads(r["raw"])["choices"][0]["message"]
return {"probe": "tools", "ok": True,
"returned_tool_calls": bool(msg.get("tool_calls"))}def probe_json():
p = {"model": MODEL, "max_tokens": 128,
"messages": [{"role": "user",
"content": 'Reply with only JSON: {"status":"ok","count":3}'}]}
r = call(p)
if r["status"] != 200:
return {"probe": "json", "ok": False, "why": r["status"]}
text = json.loads(r["raw"])["choices"][0]["message"]["content"]
try:
obj = json.loads(text)
return {"probe": "json", "ok": True,
"keys_match": sorted(obj) == ["count", "status"]}
except json.JSONDecodeError:
return {"probe": "json", "ok": True, "keys_match": False,
"note": "not parseable as JSON"}def probe_concurrency(n=2):
p = {"model": MODEL, "max_tokens": 16,
"messages": [{"role": "user", "content": "Say ok."}]}
with cf.ThreadPoolExecutor(max_workers=n) as ex:
codes = list(ex.map(lambda _: call(p)["status"], range(n)))
return {"probe": "concurrency", "ok": True, "statuses": codes,
"saw_429": 429 in codes}if __name__ == "__main__":
for fn in (probe_truncation, probe_tools, probe_json, probe_concurrency):
print(json.dumps(fn(), sort_keys=True))Run it like this. Keep the key in the environment, never in the file.
export BASE_URL="$YOUR_ENDPOINT"
export API_KEY="$YOUR_KEY"
export MODEL="$YOUR_MODEL"
python3 probe_capabilities.pyReading the output: a decision table
Probe resultWhat it meansWhat I do nextreturned_tool_calls: falseTools accepted, not acted onDrop the agent branch, or change endpointfinish_reason: "length"on an 8-token capNormal, expectedKeep the check; raise budget in real callsfinish_reason: nullin streamingClient is not reading the final eventFix the parser before anything elsereports_usage: falseNo token accounting from serverCount tokens client-side, or accept blind costkeys_match: falseValid JSON, wrong shapeAdd schema validation at the boundarysaw_429: trueat n=2Very low concurrency ceilingQueue work; never fan out blindly
Nothing here measures quality. Nothing here measures speed. Those are different experiments with different controls.Where I run this
I run probes from a throwaway box, not my laptop. Same reason I do not test migrations on my main database. The probe should not touch anything I care about.MonkeyCode's free model access and free server option are the two pieces I use for that. The free model access gives the probe something to talk to. The free server option gives it a disposable place to run. Disclosure: This article was prepared as part of MonkeyCode's product outreach.
I am not claiming the free tier is fast, generous, or permanent. I do not know its limits, and I am not going to guess at them. Run the concurrency probe and read your own numbers. That is the whole point of this post.
Limitations and who should skip this
- This is a smoke test. It is not a benchmark and not a load test.
- Results describe one endpoint, one model, one moment. They expire.
- Paid tiers can behave differently from free ones. Re-probe after switching.
- Only probe endpoints you own or are authorized to test.
- Do not use this to grade answer quality. It checks contract shape only.
Skip this approach if you need contractual latency SLOs, deterministic output, or guaranteed tool-call behavior. Buy a plan with a written contract. A probe will not save you from a missing SLA.
The corrected mental model
Treat every free endpoint as a set of separate promises. Transport, truncation, tool calls, JSON shape, and concurrency are five different promises. A 200 only confirms the first one.Which promise broke on your last integration? I keep a one-page probe log per endpoint now. It has saved me two weekends so far.#ai #api #testing #python #software #coding #development #engineering #inclusive #community
200 OK Proves Nothing About Tool Calls: A Free-Model Capability FAQ With a Probe -
Wow. Sunset is already at 6:05pm tonight. That sure happened fast, or seems like it did. Next weekend we change the clocks? So 5pm is lights out. Not my favorite thing about the winter. #Time
-
I contacted Nabisco. They say it's a combination of salt, oil, and crumbs and it happens. They said there's no peanut butter processed in facilities that make regular Ritz.
-
i can't believe it's been another year of pasta-ing.....
in this video i go through everything that happened in year 2. helpful if you've fallen out of the loop! though this video might leave you more confused. it doesnt help that you cant hear what i'm saying. anyway i did a mini mini pastamontage at the end too, hope you enjoy it -
Chapter 14 - "Evacuation"
The evacuation of Nies is going well until Skenn detects some Aleph military ships in the vicinity. This curtails their emergency mission prematurely and threatens to leave some of the inhabitants behind. Voight is determined to ensure that this is not going to happen, but can she get everyone left on the last few shuttles?
