The Warren-Washington Industrial Development Agency seeks public input on a Creative Economy Impact Study in a workshop held on Nov. 17.
Source: Post Star
Initially i found it difficult to understand how loops execute,variables changes during each iteration and when loop starts. So i started solving these problems one by one 1. Frog in a well: A Frog falls into a 60-foot-deep well. During the day it climbs 2 feet. During the night it slips down 0.5 feet. It escapes immediately when it reaches the top. Python code: well_depth = 60 frog_position = 0 day = 0 while frog_position < well_depth: day = day + 1 frog_position = frog_position + 2 if frog_position >= well_depth: print("Frog escapes on day:",day) break frog_position = frog_position - 0.5 print("Total_days:",day) Output: Frog escapes on day:40 Total days:40 2. The Saint's Flower Basket A saint visits 7 temples. At each temples,he offer half of the flowers in his basket. After visiting all 7 temples,he has exactly one flower remaining. We need to calcuate how many flowers he had initially. flowers = 1 temples = 7 while temples>0: flowers = flowers*2 temples = temples - 1 print("Initial Flowers:",,flowers) Initial flowers:128 3. TenaliRaman and the Palace Guards *Tenali Raman receives 1024 lashes from the King. At each gate,he gives half of his remaining lashes to the guard. We need to find how many guards receive a share when he has one hash remaining. * lashes = 1024 guards = 0 while lashes>1: share = lashes/2 print("Guard receives:",share) lashes = lashes - share guards = guards + 1 print("Remaining lashes:",lashes) print("Total guards",guards) Total guards:10 remaining lashes:1 4. Police and Thief Problem: The police and thief start at different positions. police starts at 0 feet thief starts at 30 feet police moves 5 feet in each round. Thief moves 2 feet in each round. Both move simulatenously until they meet. police = 0 thief = 30 while police != thief: police = police + 5 thief = thief + 2 print("Police:",police,"Thief:",thief) print("They meet at:" police) Police: 5 Thief: 32 Police: 10 Thief: 34 Police: 15 Thief: 36 Police: 20 Thief: 38 Police: 25 Thief: 40 Police: 30 Thief: 42 Police: 35 Thief: 44 Police: 40 Thief: 46 Police: 45 Thief: 48 Police: 50 Thief: 50 They meet at: 50 5. Two Trains: Two trains stop at regular intervals. train 1 stops at every 3rd station. train 2 stops at every 5th station. We need to find: 1. All common stations. 2. The first common station. 3. The last common station. since total number of stations is not specified. i asked the user to enter it. total_stations = int(input("Enter total number of stations: ")) station = 1 last_station = 0 print("Common stations:") while station <= total_stations: if station % 3 == 0 and station % 5 == 0: print(station) if first_station == 0: first_station = station last_station = station station = station + 1 print("First common station:", first_station) print("Last common station:", last_station) Output(for 100 stations): Common stations: 15 30 45 60 75 90 First common station: 15 Last common station: 90 My key takeaways: _ first we need to understand the problem,identify the variables ,decides the loop condition and how the values change during each iteration. iteration mean one complete execution of code inside a loop.
Source: Dev Community
The result was MUFG’s highest for a first half; net operating profit reached ¥1.6174 trillion, 56% of its initial fiscal 2026 target.
Source: Econotimes
From 30 December 2026, any large or medium company that places coffee, cocoa, timber, soy, rubber, palm oil or cattle (and their derived products) on the EU market needs a due diligence statement (DDS) under the EU Deforestation Regulation (EUDR, Regulation 2023/1115). Small and micro companies follow on 30 June 2027, except for timber. The statement goes into TRACES, the European Commission's system, and the goods don't clear customs without its reference number. You can type a DDS into the TRACES web form. But if you import a container of timber every week, you want your ERP to do it. TRACES has a machine-to-machine API for exactly that, and I spent the last few weeks building against it for Sourevo. Here is what the documentation didn't make obvious. It's SOAP, with a WS-Security digest The operator API is SOAP 1.1 with a WS-Security UsernameToken and a password digest. The digest itself is the classic one: PasswordDigest = Base64( SHA-1( nonce + created + authenticationKey ) ) The trap is the word "nonce". In the digest you concatenate the raw nonce bytes, not the Base64 string you put in the element. If you hash the Base64 text, every call fails authentication and the error doesn't tell you why. import { createHash, randomBytes } from 'node:crypto'; .update(Buffer.concat([nonce, Buffer.from(created), Buffer.from(authKey)])) .digest('base64'); Two more details: created goes without milliseconds, and every request also carries a WebServiceClientId header. Its value is different in the test environment (eudr-test) and in production (eudr-repository), so it belongs in configuration, not in code. Test against the right environment There are two "acceptance" systems and it's easy to pick the wrong one. The general TRACES NT acceptance environment is not where EUDR lives. EUDR has its own, at acceptance.eudr.webcloud.ec.europa.eu, with its own operator registration and its own "Web Services Access" request. We registered in the general one first and lost a few days before the helpdesk pointed us to the right host. The WSDL is not identical either. The EUDR acceptance contract has structured addresses (street, postalCode, city) where older material shows a single free-text field. Download the WSDL and XSD from the environment you will actually call and generate or validate against those. Old API versions are switched off Our first real submission came back with This API version has been discontinued. After the 2025 amendment to the regulation (Regulation 2025/2650), versions 1 and 2 of the submission service are gone. Version 4 is one service, EUDRDueDiligenceStatementServiceV4, that submits, amends, withdraws and retrieves. Things that changed along the way and break code written against older examples: retractDds is now withdrawDds. The operator role only accepts OPERATOR or REPRESENTATIVE_OPERATOR. Traders no longer submit statements. Referenced statements go in groupedDeclarations, by reference number. Error codes moved. Version 1 put EUDR_SNAKE_CASE codes in . Version 4 puts EUDR-KEBAB-CASE codes in . Parse both if you ever had a V1 client. A lookup with no results is not an empty list. It's a NotFoundException fault, which you have to catch and turn into "nothing found". Rules the XSD doesn't tell you The schema validates the shape of the message. The business rules live on the server, and a few of them surprised us: percentageEstimationOrDeviation is required for a DOMESTIC activity and rejected for IMPORT. Same field, same schema, opposite rules depending on another field. For IMPORT and EXPORT, the operator needs an EORI number on its TRACES profile. Without it you get EUDR-OPERATOR-EORI-FOR-ACTIVITY-MISSING, even though the EORI isn't in your message at all. It's account setup, not payload. A representative submitting for a client must send the client's street and country, or you get EUDR-BEHALF-OPERATOR-STREET-EMPTY and friends. You can only amend or withdraw a statement while it's AVAILABLE. Right after submission it's SUBMITTED, and you have to wait. That last one matters for the design. Submission is asynchronous: you get an identifier back, TRACES analyses the statement, and the reference number and verification number show up later. Your integration has to poll (or be told) before it can hand the reference number to customs. Geolocation is GeoJSON inside XML, in Base64 Each statement carries the geolocation of the plots where the commodity was produced, as GeoJSON. Inside the SOAP message, that GeoJSON goes Base64-encoded in geometryGeojson. A plot can be a point or a polygon, but plots over four hectares need a polygon (cattle establishments are the exception). Once the SOAP side works, the files are the next source of trouble, and they come from suppliers you don't control: rings that don't close, latitude and longitude swapped, self-intersecting polygons, a point where a polygon is required. We ended up building a free GeoJSON validator for TRACES that checks for those (and reads KML and CSV too) before the file goes into a statement. It doesn't store the file. What we put in front of it Nobody should have to write WS-Security headers to import coffee. So Sourevo exposes a REST API over all of this (suppliers, plots, batches, statements) with a few properties that I'd want from any API that talks to a slow, asynchronous government system: Idempotency on every POST. Send an Idempotency-Key header and a retried request within 24 hours returns the original response with Idempotent-Replayed: true, instead of creating a second statement. ERPs retry; customs paperwork shouldn't double. Your own IDs. Suppliers, products and batches take an externalRef (the ID in your ERP). Creating the same externalRef twice returns the existing record with duplicate: true, so a sync job can be rerun safely. Webhooks instead of polling. When TRACES assigns the reference number, you get a dds.status_changed event. Each delivery is signed: X-Sourevo-Signature: t=<unix>,v1=<hex HMAC-SHA256(secret, ".")> Check the timestamp tolerance and compare the HMAC in constant time. Failed deliveries are retried after 1 minute, 5 minutes, 30 minutes, 2, 6, 12 and 24 hours, then marked as failed. A test mode that hits the real test system. During a trial, the API submits to the EUDR acceptance environment, so you get real TRACES validation errors with no legal effect. The response header X-Sourevo-Mode tells you which environment you're in. There's also an n8n community node (@francodesystems-npm/n8n-nodes-sourevo) if you'd rather wire this up without code. Takeaways Hash the raw nonce bytes, not their Base64. Make sure you're in the EUDR acceptance environment, not the general TRACES one, and use its WSDL. Use version 4. Anything older is switched off. Expect business rules the schema can't express, and put account prerequisites (like the EORI) in your onboarding checklist. Treat submission as asynchronous and design for the reference number arriving later. Validate geometry before you send it. That's where most rejections come from. If you're integrating an ERP with EUDR and hit something I didn't cover, tell me in the comments. The full API reference is in the Sourevo developer docs.
Source: Dev Community
If you've wired Ghostscript into a "compress PDF" feature, you've probably reached for -dPDFSETTINGS. I maintain a small open-source file converter (Flask, Ghostscript and LibreOffice; disclosure: it's my project, KuickKonvert). I wanted to know what the three common presets actually do to ordinary files, so I tested them and published the inputs, outputs and script. The command Ghostscript 10.02.1, the same options the converter uses: gs -sDEVICE=pdfwrite -dCompatibilityLevel=1.4 -dPDFSETTINGS=/screen \ -dAutoRotatePages=/None -dNOPAUSE -dQUIET -dBATCH \ -sOutputFile=out.pdf in.pdf /ebook and /printer were swapped in for /screen. The three inputs Input Original /screen /ebook /printer One 3000 × 2000 px photo placed at 300 dpi 1,096.3 KB 495.3 KB (45.2%) 58.3 KB (5.3%) 881.2 KB (80.4%) One-page greyscale scan, A4 at 200 dpi 915.3 KB 138.0 KB (15.1%) 733.7 KB (80.2%) 736.3 KB (80.4%) Five-page text-only PDF (standard Helvetica, not embedded) 5.6 KB 5.5 KB (99.0%) 5.5 KB (98.9%) 11.5 KB (206.5%) Three things I didn't expect 1. /screen was not the smallest for the photo. /screen downsampled the photo to 720 × 480 px (72 dpi) but stored it with lossless Flate compression. /ebook kept 1500 × 1000 px (150 dpi) but used JPEG, and came out at 58 KB against 495 KB. The photo here is synthetic (generated noise with grain), so a real camera photo may behave differently, but it was enough to stop me assuming /screen always wins. 2. The scan barely moved on /ebook and /printer. Only /screen made a real difference (15% of the original). At 200 dpi, the scan was already close to what the other two presets aim for. 3. A text-only PDF can grow. /printer doubled the five-page text file. My guess is that it embedded the font, but I haven't confirmed that from the output file, so treat it as a guess. What I do in the app because of this After Ghostscript runs, the converter checks two things: that the output has the same number of pages as the input (Ghostscript can exit with code 0 and still write a blank one-page PDF for some damaged files), and that it is actually smaller. If it isn't smaller, the user gets their original file back. The size check, simplified: import os, shutil def keep_smaller(src, out): if os.path.getsize(out) >= os.path.getsize(src): shutil.copyfile(src, out) # compression didn't help: return the original Takeaways Look at what is inside the PDF before compressing: images are where the weight is. Don't assume the "lowest" preset gives the smallest file; test /ebook too. Always compare the output with the input, and fall back to the original. Reproduce it Files, results and the script that regenerates everything from fixed seeds (CC BY 4.0): https://doi.org/10.5281/zenodo.24199945 Converter source (AGPL-3.0): https://github.com/khshahid1970/kuickkonvert Limitations: each test uses a few generated files. Other Ghostscript versions and real-world documents will give different numbers.
Source: Dev Community
Most Supabase Auth problems in production come from configuration rather than code: a Site URL still pointing at localhost, a redirect allow list that does not include your domain, a built-in email service that only delivers to your own team, and session settings nobody has opened. Each one takes minutes to fix once you know which is which. This guide is for founders and small teams taking a Supabase app live, including apps generated with Lovable, Bolt or Cursor, where sign-in worked perfectly on a laptop and fails for the first real user. It covers redirects, confirmation emails, OAuth providers and sessions, and names the setting to change in each case. Key takeaways Site URL is the default destination for every auth email. It ships as http://localhost:3000 and has to be changed to your production address. The built-in email service is for testing. It refuses addresses outside your organisation and sends about two messages an hour. "Token has expired or is invalid" is often an email scanner opening the one-time link before your user does. OAuth needs two settings to agree: the provider's authorised redirect URI and your Supabase redirect allow list. Sessions never end by default. Inactivity timeouts, time-boxing and single-session enforcement are opt-in and only on paid plans. Why does Supabase Auth break in production? Because a new project ships with development defaults and nothing warns you they are still in place. The authentication code generated for you is usually fine. The environment around it is not. These are the failures we see most often when a Supabase app meets its first real users, and where each one is fixed. Symptom Usual cause Where to fix it Confirmation link opens localhost Site URL never changed URL configuration Redirect lands on the wrong page redirectTo not on the allow list Only your own team gets emails Built-in email service still in use SMTP settings A scanner opened the link first Email template Google returns a redirect URI error Callback URL missing in the provider Google Cloud console Users signed out at random Two clients refreshing one session Client setup Signing a user in is a separate job from deciding what they can read. Our guide to writing row-level security policies covers the half of this that lives in the database, and it is the half that leaks data when it is missing. How do you fix the Site URL and redirect URLs? Set Site URL to your production address, then add every other legitimate destination to the redirect allow list. Supabase's documentation states that Site URL defaults to http://localhost:3000 and that this setting is critical for email confirmations and password resets (Supabase redirect URL documentation). The two settings do different jobs. Site URL is the fallback destination when your code does not pass a redirectTo value, and it is what email templates fall back to. The allow list is the set of addresses Supabase agrees to send a user to when your code does pass one. When authentication fails, the user is still sent to the redirect URL, with the failure described in the URL fragment. Reading error_code and error_description on that page turns "it bounced me back to the login screen" into a message you can act on. Preview deployments and wildcards Preview URLs change on every deploy, so the allow list accepts wildcard patterns, where . and / count as separators. For a Vercel project, Supabase suggests keeping Site URL on the production domain and adding entries such as http://localhost:3000/** and https://*-your-team.vercel.app/**. Keep the globstar for development and preview environments only. The same documentation recommends an exact path for the production redirect, which also keeps the allow list readable a year from now. Why don't confirmation emails arrive? Because the project is almost certainly still using Supabase's built-in email service. It only delivers to members of your organisation, and Supabase describes it as best-effort, not intended for production, currently limited to two messages per hour; other addresses fail with "Email address not authorized" (Supabase custom SMTP documentation). That is why sign-up works for the founder and nobody else. Your address is on the team, so your own test passes. Built-in email service Custom SMTP Who can receive mail Organisation members only Anyone Throughput About 2 messages per hour 30 per hour, adjustable Delivery guarantee Best effort, no SLA Your provider's Sender address Supabase's Your own domain Intended for Demos and template testing Production Switching to custom SMTP Any provider that speaks SMTP works, and Supabase names Resend, AWS SES, Postmark, Twilio SendGrid, ZeptoMail and Brevo among them. Once it is enabled, delivery opens up to real addresses with a starting limit of 30 messages per hour, which you raise in the rate-limit settings as your sending domain earns a reputation. Sending is not the same as arriving. A password reset from a brand-new domain with no authentication records gets filtered no matter how well the template is written, and the DNS side of that is covered in our walkthrough of SPF, DKIM and DMARC for app email. Why do confirmation links say the token expired? Usually because something opened the link before your user did. Corporate mail security, including Safe Links in Microsoft Defender for Office 365, prefetches URLs in incoming messages, which consumes a single-use confirmation link and leaves the real click with "Token has expired or is invalid" (Supabase email template documentation). Three fixes, in the order we usually try them: Send a code instead of a link. Put {{ .Token }} in the template, ask the user to type the six digits, and verify them with verifyOtp. A scanner has nothing to consume. Add a confirmation page. Link to a page on your own site that carries the confirmation URL as a parameter, and make the user press a button there. Verify on your server. Point the template at your own endpoint with the token hash, exchange it for a session server-side, then redirect the user into the app. The third option is the one to reach for in a server-rendered app, because the default link returns the session in a URL fragment that your server never sees. The template link looks like this: href="{{ .SiteURL }}/auth/confirm?token_hash={{ .TokenHash }}&type=email"> Confirm your email address And the route behind it exchanges the hash for a session: const { data, error } = await supabase.auth.verifyOtp({ token_hash, type: 'email', }) One more setting worth checking in your email provider: click tracking rewrites every link in a message, which breaks auth links in particular. Turn it off for transactional mail. What does OAuth need in production? Two sets of configuration that have to agree with each other. In the provider's console your application's domain goes in the authorised JavaScript origins and your Supabase project's callback URL goes in the authorised redirect URIs; in Supabase, whatever your code passes as redirectTo has to be on the allow list (Supabase guide to Sign in with Google). Two details catch teams out at launch. The consent screen shows your project reference unless you set a custom domain. Supabase suggests something like auth.example.com for an app on example.com, and points out that the default makes a phishing page harder for users to spot. Provider tokens are not stored or refreshed for you. If your product calls Google or Slack APIs on a user's behalf, keeping those tokens alive is your job, on a server you control. Server-rendered apps also need a callback route. The PKCE flow, which is the exchange used when the session has to be created on a server rather than in the browser, returns a code that your route swaps for a session before the user lands on a page. How long do Supabase sessions last? By default, until the user signs out, on as many devices as they like. The access token is a JWT that expires after an hour by default, while the refresh token behind it never expires but can only be used once (Supabase session documentation). That single-use rule has a ten-second reuse window, which exists so a server and a browser can hand the same token around without ending the session. Outside that window, a reused token is treated as a compromised session and every refresh token for it is revoked. This is behind most reports of users being logged out for no reason. The usual cause is two clients refreshing the same session at once, which is easy to do when a server-rendered app also creates a browser client that manages its own refresh. When should you shorten a session? When a customer's security review, an auditor or a shared-device workflow asks for it. Inactivity timeouts, time-boxed sessions and single-session-per-user are configurable on Pro plans and above, and they take effect at the next refresh rather than immediately. If a buyer's security questionnaire started this conversation, our broader guide to sessions, roles and SSO in a SaaS product covers what they usually ask for next. Two numbers matter when you set them. The effective session length is your timeout plus the access token lifetime, because the check happens when the token is refreshed. And Supabase advises against access token lifetimes under five minutes, since clock skew on user devices produces failures that are painful to debug. Common mistakes Updating Site URL but leaving the old preview domain as the only entry on the allow list. Launching on the built-in email service and reading "Email address not authorized" as a bug in the sign-up form. Leaving click tracking on for the provider that sends your auth email. Testing sign-in only in the browser profile where you are already signed in, which hides a broken redirect. Treating a successful login as access control. The database decides what that user can read. Frequently asked questions Why does my magic link still redirect to localhost? Either Site URL is still set to the development address, or the template uses {{ .SiteURL }} while your code passes a redirectTo value. Switching the template to {{ .RedirectTo }} fixes the second case, and both need the destination on the allow list. Do I need custom SMTP if I am on a paid plan? Yes. The restriction belongs to the built-in email service rather than to the plan, so a Pro project still cannot email addresses outside the organisation until SMTP is configured. Treat it as a launch requirement alongside a custom domain. Can I keep users signed in for 30 days? That is already the default behaviour, since sessions last until sign-out unless you configure a timeout. If you want exactly 30 days, set a time-box of 30 days on a Pro plan and leave the access token lifetime at an hour. Why is the browser signed in while my server routes see an anonymous user? Because the session lives in browser storage, where server code cannot read it. Server-rendered apps need the session in cookies, which is what Supabase's server-side helpers do, plus a callback route that completes the code exchange before rendering. Before the first real sign-up Work through the list in order: Site URL and the allow list, custom SMTP, an email template that survives link scanners, provider callback URLs, and a session policy you have chosen on purpose. None of it is difficult, and all of it stays invisible until a stranger tries to sign in. If the app also behaves differently on its live domain than in preview, our list of nine gaps between a preview and a published app covers the rest. If you would rather hand the login, email and session setup to senior engineers, AlgoSmiths works on fixed-price projects with a working demo every week. Our SaaS product engineering work is where auth, billing and onboarding get built together. Originally published on the AlgoSmiths blog. AlgoSmiths builds web, mobile and AI products on fixed-price contracts, and takes apps built with Lovable, Bolt or Cursor to production. See our services.
Source: Dev Community
Hinds County residents opposed to a nearly 6,000-acre solar farm near Bolton lost their fight Tuesday when an appellate court affirmed a lower court ruling allowing it to go forward.
Source: Headtopics
The chartist also sketches a possible move toward $0.60, while projections of $60 and $180 have no stated timeline.
Source: Econotimes
The post Cardano Founder Says He Never Promised ADA Would Rise, as ADA is Down 95% appeared first on Coinpedia Fintech News Cardano founder Charles Hoskinson has a message for ADA holders, he never promised to make the token rise. While ADA has lost nearly 95% from its 2021 peak, leaving investors waiting for a recovery. Hoskinson says his job was never to pump ADA’s price, it was to build and decentralize Cardano, and that’s done. “I …
Source: Coinpedia
Meta's Cloud Foundation team has taken Kubernetes application rollouts out of its Terraform release process, and routine application deployments that took more than four hours now take minutes, according to the CNCF. The foundation named the team winner of its End User Case Study Contest at KubeCon + CloudNativeCon North America 2026 in Salt Lake City. The new platform runs on Argo CD and Kargo across approximately 100 Kubernetes clusters that support AI research and inference. Behind the speedup is a structural change other platform teams can copy. Meta stopped shipping applications and infrastructure through the same pipeline. One pipeline, two jobs The team has more than 15 engineers and runs those clusters across multiple cloud providers and accelerator families, per the announcement. Before the change, Terraform handled both infrastructure provisioning and Kubernetes application deployment. The full case study is titled "GitOps at Meta: How We Went From Terraform on Cron to GitOps for AI Infra", which tells you how the old loop ran. The CNCF lists three consequences of that design. Even a routine application update was tied to a lengthy infrastructure release. A stalled rollout could delay unrelated releases, because everything shared one deployment path. And there were no automated health checks to verify application status after a deploy. The second one is the on-call problem. A shared path means one stuck change holds the queue for every team behind it. A missing health check means the pipeline reports success on a deploy nobody has verified. Where each tool sits now The new split, as the CNCF describes it: Terraform still manages infrastructure. Argo CD reconciles application deployments against configuration stored in Git. Kargo orchestrates release promotion across environments. Some background for readers who haven't run either tool. Argo CD is a pull-based reconciler. A controller compares what Git says a cluster should be running with what it is actually running, and syncs the difference. Kargo works one layer up. It tracks versioned bundles of artifacts and moves them from one environment stage to the next, writing the change to Git so Argo CD can apply it. Per the announcement, this setup gives Meta independent rollouts, automated health checks and versioned release records. The CNCF says those records improve deployment traceability and recovery. For an SRE, recovery is the word that matters. A versioned record of what was promoted where is the starting point for a rollback that doesn't depend on someone's shell history. Meta also hid most of the machinery from application teams. Developers write a short application definition, and the platform generates the Argo CD and Kargo configuration from it. Application teams get independent promotion and health verification without maintaining that configuration themselves. What the announcement doesn't tell you The press release has no detail on how the health checks are defined, what a failed check does to a promotion, or how rollbacks work in practice. It doesn't say how many applications have moved over either. "More than four hours to minutes" is Meta's number for routine deployments, and there is no breakdown behind it. The full case study may answer some of this. The announcement does not. The roadmap hints at where it still hurts. Meta plans to move to a centrally managed Argo CD service to cut maintenance overhead across the fleet. It is also exploring upstream contributions on container registry authentication and on Argo CD performance in large clusters. Running a GitOps controller per cluster at this scale has a cost, and Meta is still paying it. How popular tools handle promotion across clusters Meta's pattern has two parts: a reconciler that keeps clusters matching Git, and a promotion layer that decides when a version moves to the next environment. Tools split that work differently. Argo CD is the reconciler Meta chose. ApplicationSets let one definition fan out across many clusters, and the web UI shows sync and health state per application. Argo CD has no promotion model of its own. Kargo fills that gap for Argo CD users. It models environments as stages and promotes versioned artifacts between them. If you already run Argo CD, it is the shortest path to what Meta built. Flux is the other CNCF-graduated GitOps reconciler. It is built as a set of controllers, and its image automation controllers can write new image tags back to Git. Teams that prefer composing small controllers over running one larger application tend to pick it. Spinnaker takes the push-based pipeline route, with deploy stages, manual judgment gates and automated canary analysis. It handles multi-cloud promotion well. It is also a heavy system to operate. GitHub Actions and GitLab CI/CD both offer environments with protection rules and approval gates, and work well when the deploy logic already lives next to the code. Both push to the cluster from a runner, so they don't correct drift in the cluster between deploys. Buddy is also push-based. It chains Kubernetes and Helm deploy actions with manual approval steps in one pipeline, and you can build and edit that pipeline in a UI or in YAML. The concrete reason to look at it here is team size. A small team with a handful of clusters can get gated, per-environment promotion without installing and upgrading a controller in every cluster. At Meta's scale, a pull-based reconciler is the better fit. With around 100 clusters, in-cluster drift correction and Git as the single record of desired state are worth the operating cost, and Meta's own roadmap shows how large that cost is. A push pipeline only knows what it deployed. It doesn't know what someone changed by hand afterwards. Meta says it will keep expanding adoption of the platform. The open question for anyone copying it is the one Meta is working on now: keeping Argo CD fast and maintainable once the fleet gets large.
Source: Dev Community
Germany coach Jürgen Klopp has explained why Bayern Munich forward Lennart Karl was not selected for Friday evening’s 3-1 Nations League win against Serbia – and stressed that the teenager plays a major role in his plans.
Source: Goal
Every truck that moves goods for hire inside Spain has to carry a control document, the DeCA (documento de control administrativo). It has existed since 2013 (Orden FOM/2861/2012): who hired the transport, who actually drives it, origin, destination, goods and weight. For years it was a sheet of paper in the cab. Since 5 October 2026 it has to be digital. Law 9/2025 made it mandatory, and a resolution of 5 June 2026 says what "digital" means: a native PDF (not a scan, 5 MB at most), with a QR code inside it that points to that document's own HTTPS URL. Opening the URL has to download the PDF directly, with no login, no password and no "download" button, at least until the transport is over. The driver carries a copy with the QR, on the phone or printed. If you want the full list, we wrote it up in what a digital DeCA has to look like. We build DecaFirma, an app that issues the DeCA, gets the delivery note signed on the customer's phone and handles delivery routes. Most transport companies issue from the web or the Android app. The ones with an ERP don't want to type the same shipment twice, and that's what the API, the webhooks and now an n8n node are for. This post is about the decisions that law forced on the API, and about publishing the node. A correction is a new version, not a new document Trucks get loaded, then the plate changes, or the weight, or the consignee. The resolution allows exactly two ways to change an issued DeCA: edit the same PDF (add the new data and the reason, keep the old data marked as no longer valid) or issue a brand new PDF with its own URL and QR. Section seven is blunt about it: those are the only valid ways. The second option sounds simpler and is worse in practice. The driver already has the first QR on their phone, and an inspector scanning it would get the old data. So in our API an update never creates a new document: PATCH /api/v1/shipments/:id It produces a new version of the same document, at the same URL, so the QR the driver is already carrying keeps working and always serves the latest PDF. The old version is kept. That's how we read how to modify a DeCA. Changing the vehicle has its own shortcut, PATCH /shipments/:id/vehicle, so an ERP doesn't have to resend the whole shipment for a new plate. Retries must not issue a second legal document ERPs retry. Webhook senders retry. n8n retries if you tell it to. With most APIs a duplicate is an annoyance. Here a duplicate is a second legal document for the same transport. So creation is idempotent by reference. If you create a shipment (or a route) with a reference that already exists in the company, you get the existing one back with duplicate: true and nothing new is issued. Put the order number in reference and you can retry as much as you like. Save first, issue second The data comes from someone else's system, and it is not always right. The classic one is a tax ID that doesn't validate. Our first instinct was to reject the request. But then the shipment is lost, and the person fixing it has to go back to the ERP and send it again. Now POST /shipments always saves the shipment, and then tries to issue the DeCA, the delivery note or both. If issuing fails, the response carries the error code, a details.reason and the id of the saved shipment. You fix the field with PATCH and call POST /shipments/:id/issue. In the n8n node this shows up as a failed item with all three pieces of information, and with Continue On Fail you can route it to whoever fixes the data. Error codes are stable strings (validation_error, unprocessable, rate_limited, addon_required…), so workflows can branch on them instead of parsing messages. Webhooks: one URL per company, signed Events are what make the integration worth it: document.issued, document.updated, document.voided, delivery_note.signed, cmr.signed, attachment.received (when the driver uploads a paper for the shipment). Every delivery carries X-DecaFirma-Signature: sha256=, an HMAC-SHA256 of the raw body with the webhook secret. The trigger node checks it like this: import { createHmac, timingSafeEqual } from 'crypto'; export Two details matter. You sign and verify the raw bytes, not the parsed JSON, because re-serialising can change the order of keys or the whitespace. And the length check comes before timingSafeEqual, which throws on buffers of different length. The design choice with the most consequences is that a company has one webhook URL. It keeps delivery simple and the history readable, but it means the n8n trigger and our Odoo module compete for it. When you activate a workflow, the trigger registers its URL with POST /api/v1/webhook. If the company already sends webhooks somewhere else, the trigger refuses to take the URL over unless you turn on Replace Existing Webhook. When you deactivate it, it only deletes the webhook if the URL is still its own. Silently stealing the Odoo connection because someone tested a workflow would be the worst possible failure. Failed deliveries are not retried, so the node also has Document → Get Many with since. A scheduled workflow that stores the last changedAt and asks for everything after it catches whatever a webhook missed. Publishing the node The node itself has no runtime dependencies: the HTTP calls go through n8n's own request helper, and the signature check uses crypto. Most of the work was in publishing it the way n8n wants for verified community nodes. Provenance is required. n8n's checker (npx @n8n/scan-community-package ) checks provenance, fetches the source from the commit the package says it was built from, and analyses it. A package published from a laptop has no provenance, so we publish from GitHub Actions with npm publish --provenance on a version tag. lts/* will bite you. Our first workflow used node-version: 'lts/*'. On the day we published, that resolved to Node 26, and isolated-vm, a native module that n8n-workflow (a dev dependency of every node) pulls in through its expression runtime, failed to build. Running the scanner locally on Node 21 fails the same way. Pinning node-version: '22' fixed both. In a release workflow, "whatever is newest today" is not a version. Trusted publishing comes after the first publish. npm only lets you set up a Trusted Publisher (OIDC from GitHub, no token) on a package that already exists. So the first version goes out with a short-lived token stored as a repository secret. After that you switch to OIDC and delete the token. Try it In n8n: Settings → Community Nodes → Install and enter @francodesystems-npm/n8n-nodes-decafirma. The credential is an API key that starts with dfk_; the credential test calls GET /api/v1/series, which changes nothing. The full API reference is on the developers page, and the node is MIT on GitHub. A typical flow is three nodes. A trigger from your shop or ERP, then Shipment → Create with issue: both and the order number as reference, then send the driver the public URL and the customer the signing link. Going the other way, the DecaFirma Trigger on delivery_note.signed plus Document → Download PDF puts the signed delivery note back in your ERP. If you integrate other countries' transport documents (eCMR, e-FTI), I'd like to hear how you handle corrections. The "same URL, new version" rule is the part I'd most like to compare.
Source: Dev Community
Here are your high school football scores and highlights from the first round of the playoffs on November 13 from Action 8’s Lace Up Sports.
Source: Waka
Jake Woodson, one of Business Insider's former rising stars, became a partner at just 34. Here's how he celebrated the milestone.
Source: Business Insider
The Czech Ice Hockey Federation says its national teams will not play Russia after a recent Court of Arbitration for Sport ruling allowed Russian teams to return to international championships.
Source: Econotimes
SOC 2 in 60 seconds SOC 2 is a framework from the AICPA. An independent CPA firm tests your controls against the Trust Services Criteria: security, availability, confidentiality, processing integrity and privacy. Security is the one every report includes. Type I: are your controls designed and in place at one point in time? Often around 4 to 8 weeks. Type II: did those controls keep working over an observation period, typically 3 to 12 months? It is an audit report, not a certificate. For a broader overview of SOC 2 compliance for startups, the business side is covered there. Here we stay in the code. The controls developers own Identity and access Enforce SSO and MFA on your cloud provider, source control, CI/CD and production tooling. Use least privilege. Engineers should not have standing admin access to production. Review access on a regular schedule and remove leavers the same day. Change management Auditors want proof that changes are reviewed and tested before they reach production. The simplest evidence is your pull request history, as long as the rules are enforced rather than optional. Logging and monitoring Centralize application and infrastructure logs. Alert on failed logins, privilege changes and unusual access patterns. Keep logs long enough to answer "what happened and when?" Secrets and encryption Keep secrets in a secrets manager, not in repos or chat. Encrypt data in transit and at rest. Rotate keys and credentials on a defined schedule. Availability and recovery Take automated backups and test restoring from them. Document an incident response process and run a short tabletop exercise. Evidence is the real work Most teams already do the right things. What takes time is proving it. Auditors ask for screenshots, exports and logs showing a control worked on specific dates. Doing this by hand means engineers hunting for evidence every audit cycle. A few habits that help: Prefer enforced controls over written promises. Platform settings beat "we always do this." Keep evidence where it is created. Pull requests, ticket history, SSO logs and cloud configuration are all evidence already. Automate collection. Connecting cloud, identity and code tools to a compliance platform lets evidence gather continuously. That is the approach behind automation-first SOC 2 readiness, though a well-organized set of scripts and exports can work for a small team too. A quick checklist [ ] SSO and MFA on all critical systems [ ] Branch protection and required reviews on production code [ ] CI checks required before merge [ ] Centralized logging and alerting [ ] Secrets in a manager, encryption on [ ] Backups tested, incident process documented [ ] Access reviews scheduled, offboarding fast [ ] Scope defined and written policies approved Common mistakes Over-scoping. Every extra system adds evidence you must produce. Controls that exist only on paper. Type II tests whether they run over time. Starting after the deal is on the line. Preparing early removes the rush. Wrapping up SOC 2 for a startup does not mean slowing down development. It means making good practices consistent, enforced and provable. Start with a small scope, lock in the controls above, and collect evidence as you go. If you have been through a SOC 2 audit, what part took your team the longest? I'd love to hear it in the comments.
Source: Dev Community
Disclosed figures for Rhode Island, Massachusetts and South Carolina total 7,870 people; Illinois’ count is pending, and no California total was disclosed.
Source: Econotimes
It features two acting legends at the top of their game
Source: Polygon
Shoppers rave about Avia brand sneakers, and they're on sale now for as low as $13!
Source: Athlon Sports
Singer James Blunt achieves his first chart-topping album in nearly two decades with Airplane Mode, celebrated by wife Sofia Wellesley following his Celebrity Traitors appearance.
Source: Headtopics
Keira Knightley discusses her enduring fashion and beauty routines in her latest Waitrose Christmas advert, showing experts how she maintains her iconic look.
Source: Headtopics
NASA has mandated simplified designs for Axiom Space's Artemis lunar suits, raising concerns about the US ability to return astronauts to the moon by 2028 amidst financial and operational instability.
Source: Headtopics
Adobe Commerce Template Injection Requires More Than a Routine Patch Adobe's APSB26-153 bulletin, published October 13, 2026, fixes critical vulnerabilities in Adobe Commerce and Magento Open Source. CVE-2026-103849 is an improper neutralization issue in a template engine with arbitrary code execution impact. Adobe assigns it a CVSS 3.1 base score of 10.0 and says no authentication is required. The bulletin also lists CVE-2026-92909, a B2B authorization issue rated 9.8, and stored cross-site scripting issues that can lead to privilege escalation. The common thread is application authority. Commerce deployments combine themes, extensions, integrations, and administrative workflows, so a code-execution flaw can cross from a storefront request into payment and order data. Affected release lines The affected Adobe Commerce, Adobe Commerce B2B, and Magento Open Source versions were those at the September 2026 patch level or earlier, depending on the release line. Adobe lists October 2026 isolated patches for the supported 2.4.x lines and B2B 1.x lines. The bulletin also says the hotfix for CVE-2026-75650 must be applied separately. That is an important operational detail. Installing the October security patch does not automatically close every item mentioned in the broader bulletin. Why template trust is sensitive Template engines are designed to evaluate expressions and render output. If untrusted input reaches a template evaluation path with the wrong context, the application may treat data as code. Commerce installations often add themes and extensions that are not maintained by the core product team. Review custom themes, modules, email templates, CMS blocks, and page-builder content. Identify which components accept administrator-controlled templates and which accept merchant or third-party input. Do not assume that a WAF rule against obvious template syntax covers encoded or context-dependent payloads. Patch sequence Start with a verified backup and a staging deployment. Apply the correct October isolated patch for each Commerce and B2B version, then apply the separate CVE-2026-75650 hotfix if the deployment is in scope. Run the storefront, checkout, payment, search, and admin workflows before production rollout. After deployment, clear generated code and caches according to the vendor's instructions. Confirm the production build uses the patched files and not an old opcode cache or container image. Record the patch identifiers and the verification evidence in the change ticket. Reduce template and integration authority Limit who can edit themes, email templates, CMS content, and extension configuration. Separate content editors from users who can deploy code. Review integrations and service accounts for permissions beyond their business function. Rotate credentials that could be exposed through the admin application, including payment, ERP, shipping, and search integrations. A code-execution flaw can reach environment variables and local configuration files, so credential rotation may be necessary even when there is no obvious suspicious order. Monitoring Review web server and Commerce logs for template-like expressions in unexpected parameters, new administrator accounts, module changes, and outbound connections to unfamiliar hosts. Correlate admin logins with deployment events and file changes. The patch is necessary. It is more effective when the storefront has a short list of trusted template authors and a tested process for future isolated patches. References Adobe Commerce security bulletin APSB26-153
Source: Dev Community
The New York Giants’ 24-21 loss to the Washington Commanders on Thursday night left a bad taste in the mouth, but Malik Nabers’ comments the following day only added to the drama. The wide receiver questioned the team’s late-game decisions, leading some fans to believe he was blaming quarterback J.
Source: Yahoo! News
Read Georgia Tech Yellow Jackets vs Clemson Tigers predictions, picks and odds in our college football betting preview for Saturday, November 14.
Source: Action Network
Harrison, the son of Marvin Sr. and younger brother of the Texans' Marvin Jr., recently broke the Catholic League receiving touchdown record and is one of the top high school juniors nationally.
Source: Headtopics
Including a new documentary about very old people and Wesley Stace's show in Wayne.
Source: Headtopics
The divisive Godzilla 1998 is streaming free on Pluto TV as Godzilla Minus Zero enters its second weekend in theaters.
Source: Collider
Wasabi and Rufus aren't the real Butkus, but they have plenty of experience representing the famous dog.
Source: Headtopics
Discover the top-rated science fiction series with under 20 episodes, from Loki to Utopia, proving concision defines genre greatness.
Source: Headtopics
Leaving a phone-light trip requires careful preparation. Maps, tickets, and reservations must be available even when the signal fades or the battery runs low. A […] The post A Pre-Departure Checklist for Offline Maps and Printed Bookings appeared first on Capitol Hill Times.
Source: Capitol Hill Times
From Left to Right, Walter Veintemilla, Haitian-American pastor Christian Emmanuel Sanon, Arcángel Pretel Ortiz, Antonio 'Tony' Intriago with sunglasses in front of an airplane they chartered to fly to Haiti in May 2021, nearly two months before the July 7, 2021 assassination of Haiti's president.
Source: Miami Herald