Now that we’ve reached the end of Apple TV’s sixth season of Slow Horses, here is my combined review of the two books adapted for this season, Joe Country and Slough House.
Search
1000 results for “that_marouk_ish”
-
About That Contested Elizabeth Holmes Quote to The Times
https://fed.brid.gy/r/https://www.nytimes.com/2026/10/22/insider/elizabeth-holmes-backstory.html
-
And that’s it! Officially done with the current job. One week of funemployment begins now, then it’s on to the new adventure. Really excited to get started.
-
Well that big one was fun to split. Rock solid Elm , had to cut six individual wedges and apply a sledgehammer. Should be able to get three decent size bowls out of it though . #photography #woodwotking #woodcarving #wood
-
Craving that minty green shake without leaving home? This easy copycat Shamrock Shake brings cool, creamy flavor right to your kitchen with very little fuss! #drink #recipes #glutenfree
Posted into Delicious Recipes You Need to Make NOW @delicious-recipes-you-need-to-make-now-HonestAndTruly
-
Ordered that banana cream coffee, obviously. Always a sucker for coffee drinks with condensed milk.
Okay, this is a desert. And not bad in that role.
-
-
"The assumption is that partners know more about the geography and the industry-specific issues." More takeaways from n8n's recent conference in Berlin. https://www.getgrist.com/blog/three-perspectives-from-n8ns-in-the-loop-conference/
-
It turns out that #MRI scans are more stressful than anticipated if you are a) very mildly claustrophobic, and b) have an inner ear / brain issue being diagnosed that means you can't keep your head still with your eyes closed.
I definitely do not feel 100%.
-
"it is believed that tighter budgets have made it harder for the publisher to maintain such [exclusivity] arrangements with photographers." Sort of an AI effect without the AI, so, capitalism. https://petapixel.com/2026/10/26/vogue-elle-and-wsj-hire-same-photographer-for-three-identical-covers-in-one-week/
-
An agent that feels instant on a laptop can feel broken the moment its model call crosses a network boundary, and the postmortem usually blames the model. The regression more often comes from three numbers nobody recorded before the move: cold-start latency, payload size leaving the device, and behaviour when the remote seat is unreachable. The scenario below is illustrative rather than a customer story, but the failure shape is common enough to plan around.
This article builds a small probe that records those three numbers for any endpoint pair and turns them into a residency decision. It assumes you already have an agent that runs end to end and you are choosing where the model call happens. Nothing here depends on one vendor, and every threshold below is a starting point you should retune for your own product.
Why three measurements beat one benchmark
Public leaderboards measure model quality on fixed prompts, and they say almost nothing about the machine your agent actually runs on. Residency is a property of your process, your network path and your prompt size, so it has to be measured in place. A single latency number is also easy to game: a warm local runtime can win on the median and lose badly on the first request after a laptop wakes up.The probe therefore records a distribution rather than a point estimate, and it pairs that distribution with two non-latency signals. The payload audit answers what content leaves the device, which matters when prompts carry repository context or customer records. The offline check answers whether the agent degrades into a queue or into an exception, and that difference decides how much of the fallback path you have to build.
Step 1: Fix one request shape for both endpoints
The comparison is only meaningful when both sides receive the same bytes, so define one request body and reuse it. Keep the system prompt and user prompt in files, and let environment variables supply the base URLs. This also makes the probe cheap to rerun whenever a runtime updates.mkdir -p prompts
printf 'Summarise the three functions in this diff.\n' > prompts/short.txtexport LOCAL_BASE_URL="http://127.0.0.1:8080/v1/complete"
export REMOTE_BASE_URL="https://your-endpoint.example/v1/complete"The two URLs are placeholders, and the script below does no vendor-specific shaping. If your local runtime expects a different JSON envelope, adapt
build_bodyonce and keep the rest identical. That single edit point is what makes the numbers comparable later.Step 2: Measure first body byte, with explicit honesty about it
Time to first token is the metric developers feel, but most HTTP clients only expose time to first body byte. The probe reads exactly one byte and stops, then labels the result as an approximation. It also reports p50 and p95 separately, because tail behaviour is where remote seats and cold local runtimes diverge.The script also counts failures instead of hiding them behind a mean. A run that times out is data, and a remote seat that fails two of seven attempts changes the architecture conversation more than a hundred milliseconds of median latency.
#!/usr/bin/env python3
"""residency_probe.py - reference implementation, not a benchmark suite.Records first-body-byte latency, payload size, secret-pattern hits and
forced-offline behaviour for up to two endpoints. Every number it prints
is yours to collect; no vendor performance is asserted here.
"""
from __future__ import annotationsimport argparse
import json
import os
import re
import socket
import statistics
import time
import urllib.error
import urllib.requestSECRET_PATTERNS = {
"provider_key": re.compile(r"sk-[A-Za-z0-9]{16,}"),
"bearer_value": re.compile(r"(?i)bearer[ ]+[A-Za-z0-9._-]{12,}"),
"aws_secret": re.compile(r"(?i)aws_secret_access_key[ ]*[:=]"),
}def build_body(prompt: str, system: str) -> bytes:
return json.dumps({"system": system, "prompt": prompt}).encode("utf-8")def scan_for_secrets(raw: bytes) -> list[str]:
text = raw.decode("utf-8", errors="replace")
hits = [name for name, pat in SECRET_PATTERNS.items() if pat.search(text)]
for key in ("API_KEY", "ACCESS_TOKEN", "SECRET"):
value = os.environ.get(key, "")
if len(value) >= 12 and value in text:
hits.append("env:" + key)
return hitsdef first_body_byte_ms(url: str, body: bytes, timeout: float) -> float:
req = urllib.request.Request(
url, data=body, headers={"Content-Type": "application/json"}
)
start = time.perf_counter()
with urllib.request.urlopen(req, timeout=timeout) as resp:
resp.read(1) # first body byte, NOT first token
return (time.perf_counter() - start) * 1000.0def probe(url: str, body: bytes, attempts: int, timeout: float) -> dict:
samples, failures = [], 0
for _ in range(attempts):
try:
samples.append(first_body_byte_ms(url, body, timeout))
except (urllib.error.URLError, socket.timeout, TimeoutError, ConnectionError):
failures += 1
ordered = sorted(samples)def pct(p: float) -> float | None:
if not ordered:
return None
idx = min(len(ordered) - 1, int(round(p * (len(ordered) - 1))))
return round(ordered[idx], 1)return {
"url": url,
"attempts": attempts,
"failures": failures,
"p50_ms": pct(0.50),
"p95_ms": pct(0.95),
"mean_ms": round(statistics.fmean(samples), 1) if samples else None,
}def offline_behaviour(fallback) -> dict:
"""Point at the discard port, then check the fallback still returns work."""
dead = "http://127.0.0.1:9/v1/complete"
started = time.perf_counter()
try:
first_body_byte_ms(dead, b"{}", timeout=2.0)
reached = True
except (urllib.error.URLError, socket.timeout, TimeoutError, ConnectionError):
reached = False
result = fallback()
return {
"endpoint_reachable": reached,
"fallback_returned": result is not None,
"fallback_seconds": round(time.perf_counter() - started, 3),
}def main() -> None:
ap = argparse.ArgumentParser()
ap.add_argument("--prompt", default="prompts/short.txt")
ap.add_argument("--attempts", type=int, default=7)
ap.add_argument("--timeout", type=float, default=20.0)
ap.add_argument("--out", default="residency_report.json")
args = ap.parse_args()prompt = open(args.prompt, encoding="utf-8").read().strip()
body = build_body(prompt, system="residency-probe")
report = {
"payload_bytes": len(body),
"payload_secret_hits": scan_for_secrets(body),
"endpoints": [],
"offline": offline_behaviour(lambda: {"queued": True}),
}for name in ("LOCAL_BASE_URL", "REMOTE_BASE_URL"):
url = os.environ.get(name)
if not url:
continue
row = probe(url, body, args.attempts, args.timeout)
row["name"] = name
report["endpoints"].append(row)with open(args.out, "w", encoding="utf-8") as fh:
json.dump(report, fh, indent=2)
print(json.dumps(report, indent=2))if __name__ == "__main__":
main()Run it twice: once with the local runtime freshly started, and once after it has served a few requests. Those two runs are the cheapest way to see cold-start cost without building a load generator.
Step 3: Audit what actually leaves the device
The payload audit is deliberately blunt, and it is not a data-loss-prevention product. It flags obvious credential shapes and any long environment value that leaked into the serialised body, which catches the common accident of pasting a token into a system prompt. A hit is a stop sign for a remote seat and a warning for a local one, because local runtimes log too.The byte count matters as much as the hits. A prompt carrying an entire diff can be orders of magnitude larger than a chat message, and upload time on a home connection scales with it. Record the byte count next to the latency figures, or you will attribute a bandwidth problem to model speed.
Step 4: Force the offline path on purpose
The probe points at a dead port and then calls the same fallback your agent would call. If the fallback raises instead of returning queued work, the agent needs a fallback contract before any residency change ships. If it returns queued work in a few seconds, the offline story is already credible.This check is cheap and it prevents the most expensive migration surprise. A remote seat that disappears during a demo is survivable when work queues locally and can be resumed. It is fatal when the whole run lives in a request handler that has already returned.
A decision table you can argue with
SignalWhat local-first tends to giveWhat a free server tends to giveRead it asWarm p95 first body byteLow and stable once the runtime is pinnedDepends on queueing at the shared endpointLocal wins on steady interactive loopsCold startLong first request after sleep or restartEndpoint is already warmRemote wins on sporadic usePayload bytes off deviceZero for the model callFull prompt, including contextSensitive context argues for localSecret-pattern hitsStill a bug, still loggedBlocks the send until redactedAny hit stops the remote optionOffline behaviourUsable if you persist stateFails closed without a queueQueue design is the real workConcurrency shapeBounded by one machineBursts absorbed elsewhereSpiky workloads favour remote
The thresholds below are operator-tunable starting points rather than published guidance. Fill the middle columns with your own probe output and use the last two as the interpretive lens.
The table is a discussion device, not a verdict. Two teams with identical numbers can land on different rows because their data classification and support burden differ.Where a free server genuinely wins
A recurring discussion in developer circles concerns how many intermediaries sit between a developer and a model, and residency is the concrete version of that question. The honest answer is that self-hosting is sometimes the wrong trade, especially when the local machine cold-starts constantly or has no accelerator at all. Spiky workloads, shared team artifacts and short-lived experiments all favour a remote seat that is already warm.MonkeyCode, an open-source coding agent project, offers free model access and a free server option, which makes it a reasonable second column for the probe above. Disclosure: This article was prepared as part of MonkeyCode's product outreach. Token allowances and server terms change, so read the project page for the current limits before you design around them, and never assume a free tier is permanent.
The useful pattern is to run the probe against a free remote seat and against your laptop on the same day with the same prompt file. That produces a defensible comparison instead of an intuition, and it costs one environment variable.
Limitations and who should not use this
The probe measures first body byte, not time to first token, and the two diverge when a server streams headers early. It is a single-machine instrument, so it is not a load test and it will not reveal behaviour under ten concurrent runs. The secret scan is a regex tripwire, not a compliance control, and it will miss bespoke credential formats.Teams with hard data-residency obligations should keep the model call local and treat the remote column as unavailable rather than slow. Interactive products with tight latency budgets should not adopt a shared endpoint without a warm-up strategy and a measured tail. Anyone expecting deterministic throughput from a free tier should build the queue first and treat the server as an accelerator, not a guarantee.
If you want a second column without provisioning anything, point the probe at a free remote seat first and keep the local runtime as the fallback. The numbers you collect will tell you more than any migration plan written before them.#ai #localfirst #python #architecture #software #coding #development #engineering #inclusive #community
Measuring Before Migrating: A Residency Smoke Test for Local-First Agents and Free Servers -
I Didn’t See That Coming (9 Photos)
Stone handbags, a tire gorilla, seated lamps and other artworks that give familiar objects an unexpected role.https://streetartutopia.com/2026/10/27/everyday-objects-street-art-and-sculptures/
-
-
A generative path that's too confident produces hallucinations — it fills in gaps with plausible-sounding words that have nothing to do with what was said. That's the failure mode I'm most worried about in the whole system, because it's the failure that's invisible to the speaker. They said something real. The machine substituted something invented. And the listener has no idea.
The safeguard is that the generative path has to be consistent with the phoneme evidence.
-
Many developers believe that secure code is enough to protect a website. Unfortunately, that is not always true.
Your application also depends on its runtime, packages, plugins, server configuration, and third-party services. A vulnerability in one of these components can put the entire application at risk.
- The hidden risk behind dependencies
Imagine building a website with PHP. Your own code validates user input, checks permissions, and protects database queries.
But what happens if the PHP runtime or one of your dependencies contains a security vulnerability?
Your application may still be exposed, even if you wrote your code carefully.
Security is not just about the code you write. It is also about the software you trust.
- Why updating software matters
Outdated software can contain publicly known vulnerabilities that attackers may try to exploit.
Developers should regularly:
Update supported PHP versions and security patches.
Review Composer dependencies for known vulnerabilities.
Remove unused packages and plugins.
Monitor security advisories for their technology stack.
Test updates before deploying them to production.
Do not assume that installing a package once means it will remain secure forever.
- Three practical security checks for PHP developers
Check your PHP version
Run:
php -v
Check whether your version is still supported and whether your hosting environment has installed the latest applicable security patches.
Audit Composer dependencies
If your project uses Composer, run:
composer audit
This helps identify known security advisories affecting installed dependencies.
Protect production configuration
Never commit database passwords, API keys, or other secrets to a public repository. Use environment variables or an appropriate secrets-management system.
Also, keep detailed error messages and debugging tools disabled in production.
- Security requires continuous attention
A secure application is not something you build once and forget.
New vulnerabilities are discovered, dependencies change, and software becomes outdated. Regular maintenance is part of responsible development.
The best approach is simple: monitor, update, test, and verify.
Final thoughts
You do not need to be a cybersecurity expert to improve your application's security. Start by understanding the components your application depends on, checking them regularly, and fixing known issues promptly.
One question for developers: How often do you audit the dependencies and runtime versions used by your production applications?
Share your approach in the comments. I would love to learn what works for other developers.#webdev #security #php #programming #software #coding #development #engineering #inclusive #community
Your Website Can Be Vulnerable Even When Your Code Looks Perfect -
#Eleicoes2026 : "The fact that #Brazil can elect a #transwoman and their president [ #Lula ] can embrace [and #kiss ] her just highlights how backwards and #reactionary the UK [and the US] is."
#trans #TransRightsAreHumanRights
@woke_66 -
Elon Musk confirmed that SpaceX closed $40 billion in debt financing for graphics processing units expected in the first half of 2027.
-
Discover five SOC bottlenecks that limit MSSP growth and how ANY.RUN helps reduce investigation time, streamline handoffs, and improve threat triage.
https://hackernoon.com/your-mssp-added-10-new-clients-what-breaks-first #msspsecurityoperations
-
The lingering problem is that if I’m not stealing little moments of work time to noodle on that desktop, I don’t know when I’ll get to use it. The time between work and bed is full of annoying chores and dog-walking and heating up half-assed meals for myself and family and fetching shit—endlessly fetching shit.
-
Large study shows that people who use AI to solve simple problems become less motivated to solve problems on their own if the AI tool is removed from them.
-
Gas prices give me that "carownervirus" feeling.
-
are u glad that it ended?
#pastagang
https://www.youtube.com/watch?v=RK6hAprqitY -
⚡️A Future Russia that changes its flag and its leader, yet keeps its Historical Russia doctrine, is just a reboot of the old system.
🎧 Podcast: https://open.spotify.com/show/033ZXAMDMZot3LGqUdqJc4
-
Broligarchy would argue that it is good for open source because there are so many "contributions" but in the end it sucks the air from the system by not fostering collaboration and sucking the attention away from the projects which deserve it preventing human interaction to advance commons.
-
I don't believe that pet ownership is inherently moral. Animal consumption is a demand-based economic relationship.
https://brywillis634737.substack.com/p/the-greater-good-and-the-benevolent?r=pvxh5
What do you think? Should we be able to take home arbitrary kids if we could raise them better? 🤔
#writing #speculativefiction #fiction #economics #moralphilosophy #moralpsychology #greatergood #utilitarianism #benefits #blog #substack #philosophy #ethics #animalwelfare #veganism #thoughexperiments #pets #progress #domestication #moralauthority #property
-
A small kindly reminder that the so called "PHP exploit" was not exploited, wasn't an exploit, but was a planned release of a well known memory leak issue, which was leaked by two security companies because they wanted to make headlines and scream about how chatbots were gonna kill us all. No chatbot found a way to exploit the issue, one human did with extraordinary effort and knowledge of the target. Grow up, internet.
-
Build Systems That Make Excellence Repeatable
Excellence doesn’t scale through individual heroics. It scales when sound decisions become repeatable processes—reducing variation, protecting quality, and making performance less dependent on who’s in the room.
Where does your organization still rely on exceptions? -
Good to see that Randa is invited and has accepted appearing at next year's Adelaide Writers Festival ... will Malignowskas & the anti-Palestinian Zionists interfer again?
https://www.abc.net.au/news/2026-10-27/randa-abdel-fattah-adelaide-writers-week-program/107311612 #Palestine #IsraelFascism #auspol
-
"He once argued that being a wheelchair user helped him understand trans kids."
🏳️🌈 Democratic Senate candidate releases last minute attack on trans rights: “As a Paralympian…”
https://www.lgbtqnation.com/2026/10/democratic-candidate-releases-last-minute-on-trans-rights-as-a-paralympian/ -
A little disappointing at that price. https://www.macrumors.com/2026/10/26/new-ipad-mini-still-no-promotion/