A hands-on audit framework for verifying that an LLM gateway's model routing and prompt caching actually cut token spend before you trust the vendor's cost chart.
A Node.js implementation pattern for tamper-evident audit logging that maps EU AI Act transparency and record-keeping obligations to concrete design choices for agentic AI systems.
A hands-on audit of GitHub-to-PyPI publishing paths, tracing how LiteLLM's long-exposed GitHub master key enabled a package compromise and what controls — secret scanning, token revocation, trusted publishing, pinning, and attestations — actually close the gap.
A deep technical walkthrough of Pylance's newly published Type Server Protocol spec, covering its request/response contracts, the split between indexing and type evaluation, and cache semantics, plus how it diverges from LSP's hover-only model and what editor and tooling authors can build on top.
The Cyber Resilience Act turns your release pipeline into a regulated control: SBOMs from tooling you already run, signed provenance attached to the artifact, a 24-hour early warning path, and a multi-year rebuild obligation. This short walks the dates that matter, runs the CycloneDX and Syft SBOM passes side by side, and shows where the lockfile and filesystem views diverge. It also covers why an attestation proves how something was built but not what it is for, what the reporting clock demands of an on-call rota, and why a five-year support period is a build infrastructure cost rather than a documentation task. Full post with the commands, the workflow snippets and the annex mapping: https://hackyjs.com/posts/what-the-cyber-resilience-act-actually-requires-from-a-release-pipeline
An 80% LLM price cut doesn’t translate directly into an 80% smaller bill. Provider routing, prompt caching, batching, and retries all affect what you actually pay. This Short breaks down the gap between list prices and inference costs—and what to measure before revisiting build-versus-buy decisions. Examples use constructed, normalized prices rather than measured production results. Full write-up: https://hackyjs.com/posts/where-provider-routing-caching-and-batching-absorb-the-80-llm-price-cut
Removing a malicious package from PyPI doesn’t remove copies already downloaded into caches or environments. This Short examines the reported LiteLLM supply-chain incident, the limits of the available evidence, and defensive controls including hash-pinned dependencies, pip --require-hashes, and dependency cooldowns. Full reconstruction and practical checks: https://hackyjs.com/posts/reconstructing-the-litellm-pypi-incident-seven-malicious-wheels-and-the-two-hour-quarantine-window