Custom agents in GitHub Copilot CLI turn repeated terminal tasks into reusable, consistent workflows. Defined as Markdown profiles in a repository, they encode team-specific expertise, tools, standards, and safety rules instead of relying on one-off prompts. This makes workflows easier to review, version, share, and reuse across the CLI, IDE, and GitHub.
## What Custom Agents Are
- A custom agent is a specialized Copilot agent configured through a Markdown file.
- Its profile specifies:
- Role and area of expertise
- Available tools
- Required standards and procedures
- Guardrails and expected output formats
- Teams can tailor agents to requirements such as:
- WCAG accessibility standards
- Formatting and testing conventions
- Security and privacy policies
- Review and ownership requirements
- Because profiles live in the repository, they can be versioned, reviewed, and shared like code.
## Creating and Using Agents in Copilot CLI
- Invoke Copilot CLI from the terminal and use the `/agent` command to select an agent.
- Store the profile in the repository’s `.github/agents` directory.
- Agent files use YAML frontmatter and typically end in `.agent.md`, such as `accessibility.agent.md`.
- The profile defines the agent’s name, description, model, tools, instructions, scope, and guardrails.
- Copilot CLI is especially suitable for these agents because it can execute scripts, call APIs, inspect repositories, and work directly with command-line tooling.
## Automating Repeated Workflows
Custom agents are most useful for recurring tasks that span the terminal, IDE, and pull requests.
- A security audit agent can:
- Run standard checks across repositories
- Group findings by Critical, High, Medium, and Low severity
- Produce a pull-request-ready checklist with owners and next steps
- It can use tools such as `gitleaks`, `trivy`, `semgrep`, `gh`, `git`, and `jq`.
- Agents should prefer existing repository configuration files, including `.semgrep.yml`, `.trivyignore`, and `.gitleaks.toml`.
- Missing security tools should be reported as coverage gaps rather than replaced with invented results.
- Instructions can require secrets to be redacted, inclusive terminology, and consistent date formats.
- Ownership mappings can assign findings to teams based on affected paths, using `CODEOWNERS` when available or defined defaults otherwise.
Custom agents provide a practical way to capture team expertise once and apply it consistently. Start by converting a repetitive, execution-heavy task into a narrowly scoped `.github/agents` profile with explicit tools, outputs, and safety rules.
Frontier cyber models primarily change the speed and scale of attacks, not the fundamental stages of intrusion. They can rapidly discover vulnerabilities, generate exploit variations, and adapt around defenses, making architectural resilience more important than patch speed alone. Cloudflare’s approach is to use layered controls, limit the reach of compromised identities, and turn broad network visibility into faster defensive action.
## What Frontier Cyber Models Change
- Models such as Mythos can accelerate:
- Vulnerability discovery across large codebases and open-source dependencies
- Exploit-chain reasoning
- Proof-of-concept generation
- Reconnaissance and attack variation
- Traditional intrusion stages—reconnaissance, initial access, lateral movement, persistence, and exfiltration—remain, but attackers can execute them faster and at greater scale.
- Attackers need only one exploitable opening, while defenders must identify and secure all of them.
- AI-generated fixes can introduce regressions, meaning faster patch creation does not eliminate testing and review constraints.
## Three Threats Driving the Architecture
### Faster Vulnerability Discovery
- Frontier models can search widely used open-source libraries and frameworks at scale.
- A library flaw is only exploitable when attacker-controlled input can reach the vulnerable code and surrounding protections are insufficient.
- The most concerning risk is the gap between attacker discovery and defender awareness.
- Organizations should assume attackers are already using these models against their code if they are not doing so themselves.
### Higher Exploit Volume and Adaptation
- Models can generate thousands of exploit variants and conduct reconnaissance at comparable scale.
- Signature-based defenses may still block many variants sharing the same underlying pattern.
- The greater danger is adaptive behavior: a model can probe a WAF, learn which payloads are blocked, and rewrite attacks until they evade the rule.
### Limiting Impact After Exploitation
- No security architecture prevents every compromise.
- The critical question is how far an attacker can move using a single identity, route, or credential.
- If one compromise provides unrestricted access, the surrounding architecture—not just the original vulnerability—is the fundamental weakness.
## Visibility as a Defensive Advantage
- Cloudflare observes roughly one-fifth of global web traffic, providing real-time insight into:
- Mutating attack payloads
- Emerging patterns
- New attacker tooling and campaigns
- Cloudforce One converts this network visibility into threat intelligence, tracked adversaries, campaigns, and indicators of compromise.
- The key challenge is reducing the delay between discovering a threat and applying an effective mitigation across defensive systems.
## Practical Recommendation
Organizations should run frontier models against their own code, strengthen layered detection, and design systems so that a single compromised identity or credential cannot provide unrestricted access. Architecture, containment, and rapid use of threat intelligence are essential complements to patching.
Face recognition has evolved from manually recorded facial measurements to deep-learning systems capable of identifying people with near-perfect accuracy. The technology’s progression depended on automated feature extraction, robust local descriptors, neural networks, and increasingly large datasets. Face payment represents its next major application, combining convenience with layered security designed to address biometric privacy risks.
## From Manual Measurements to Automated Recognition
- In the 1960s, Woodrow Wilson Bledsoe pioneered face recognition through a classified government project.
- Researchers manually recorded coordinates for features such as eye spacing, nose-to-mouth distance, and ear positions.
- Computers performed calculations, but humans still identified the facial landmarks.
- In 1973, Takeo Kanade developed a system that automatically detected the eyes, nose, and mouth.
- His work demonstrated that computers could extract meaningful facial information without manually supplied coordinates.
## Eigenfaces and Statistical Representation
- In 1991, Matthew Turk and Alex Pentland introduced Eigenfaces using Principal Components Analysis (PCA).
- The system created an average face and represented individual faces by how they differed from that average.
- These differences formed “Eigenfaces,” mathematical components that worked like an alphabet for describing faces.
- Recognition became a matter of comparing the combination weights assigned to two facial images.
## Coping with Lighting and Real-World Conditions
- Early systems struggled when the same face appeared under different lighting, angles, or shadows.
- Researchers shifted from analyzing the entire face to examining local regions and textures.
- Local Binary Patterns (LBP) compared each pixel with its neighbors, making facial descriptions less dependent on absolute brightness.
- Hand-crafted features were combined with classifiers such as:
- **SVM**, which finds separating boundaries between identities.
- **AdaBoost**, which combines weak classifiers into a stronger recognition system.
- These methods improved robustness even though they could not learn features automatically like modern deep-learning models.
## Deep Learning Surpasses Human-Level Benchmarks
- Facebook’s 2014 DeepFace system used deep neural networks trained on approximately four million face images.
- It achieved 97.35% accuracy on the LFW benchmark, approaching the reported human score of 97.53%.
- Google FaceNet later introduced Triplet Loss and reached 99.63% on LFW.
- SphereFace, CosFace, and ArcFace continued improving discriminative facial representations.
- The field shifted from proving that recognition was possible to optimizing accuracy and reliability.
## The Role of Large-Scale Datasets
- **FERET:** Established an early standardized benchmark with 1,199 people and 14,126 grayscale images.
- **LFW:** Contained 13,233 images of 5,749 people collected from natural, uncontrolled environments.
- **VGGFace:** Provided 2.7 million images of 2,600 people, reinforcing the relationship between data scale and deep-learning performance.
- **MS-Celeb-1M:** Pursued celebrity recognition at massive scale but was later withdrawn over privacy concerns.
- **WebFace260M:** Started with 260 million images and refined them into roughly 42 million images covering two million people.
- These datasets improved recognition while also highlighting the tension between technical progress, data quality, and privacy.
## Face Recognition as a Payment Method
- Face recognition had already reached smartphones, airports, and office access systems, but payments required stricter standards.
- Unlike device unlocking, payment errors can directly cause financial loss.
- Toss FacePay launched in South Korea in September 2025, aiming to combine strong security with a frictionless experience.
- Face payment offers:
- Availability without carrying a wallet or charged phone.
- Hands-free checkout.
- Faster payment without searching for cards or opening an app.
## How FacePay Works
- A terminal camera identifies the customer among registered users.
- The system must also reject unregistered users and apply additional authentication in ambiguous cases, such as similar-looking individuals or twins.
- Once identified, the system connects the customer to a registered credit card, debit card, or another selected payment method.
- Face payment adds customer identification and payment-method lookup to the conventional POS, VAN, and card-issuer approval flow.
## Edge and Cloud Processing
- **Edge processing** offers low latency and better privacy because images need not leave the terminal.
- Its limitations include restricted hardware, smaller models, lower potential accuracy, and difficult device-by-device updates.
- **Cloud processing** enables stronger models, centralized logging, and simpler model updates.
- It introduces transmission delays and increases the importance of network and server security.
- FacePay combines both approaches: the terminal performs initial processing, while the server handles facial-feature extraction, recognition, and payment operations.
## Layered Biometric Security
- Communications between terminals and servers are protected with TLS, while images receive additional AES-256 encryption.
- Matrix Projection creates cancellable biometric vectors: changing the key produces a different representation of the same face.
- If a biometric vector were compromised, it could theoretically be reissued with a new key, similar to changing a password.
- The stored biometric representation is designed not to correspond one-to-one with the original face image or allow easy reconstruction.
- Access to biometric data is restricted, logged, and limited to operational needs.
- FacePay also underwent review by South Korea’s Personal Information Protection Commission and offers full compensation for fraudulent payments through its protection program.
The development of face payment reflects six decades of progress in computer vision, machine learning, data infrastructure, and security engineering. Its practical success depends not only on recognition accuracy, but also on cancellable biometric protection, strict access controls, privacy oversight, and effective defenses against spoofing.
GitLab researchers uncovered a coordinated PyPI supply-chain campaign distributing a copy of the Shai-Hulud worm. Five packages—four typosquats and one compromised legitimate project—execute malware during Python startup, steal credentials from CI/CD and cloud environments, and propagate through developers’ repositories and package registries. The campaign demonstrates that Python packages can be weaponized without imports or explicit function calls.
## Malicious PyPI Packages
- All packages were published by the `elitexp` account:
- `rlask` and `tlask`, typosquats of Flask
- `rsquests`, a typosquat of Requests
- `nhmpy`, a typosquat of NumPy
- `mflux-streamlit`, a legitimate project later weaponized in versions `0.0.3` and `0.0.4`
- The attacker first uploaded clean probe versions matching current upstream version numbers, then replaced them with payload-bearing releases.
- The activity followed the public release of Shai-Hulud’s source code, suggesting an independent copycat operation targeting Python users.
## Python Startup-Based Infection
- The malware uses Python `.pth` files, which Python processes automatically at startup.
- The dropper:
- Checks for a `.bun_ran` marker in the temporary directory.
- Downloads the Bun JavaScript runtime from GitHub.
- Executes a roughly 5 MB obfuscated JavaScript payload.
- Early `rlask` versions also included `sitecustomize.py`, which searched `sys.path` for and executed a hidden `_index.js` file.
- This approach requires no explicit package import or function invocation.
## Payload Obfuscation
- The JavaScript is protected by multiple layers:
- Package-specific ROT-N encoding
- AES-128-GCM encryption
- Variable-name mangling using `_0x` identifiers
- Researchers identified:
- A small encrypted Bun downloader
- A 772 KB Shai-Hulud credential stealer
- Approximately 2,538 hardcoded strings
## Credential Theft
The worm targets credentials and secrets from:
- GitHub Actions tokens, repository secrets, OIDC tokens, artifacts, and runner memory
- AWS IAM credentials, instance metadata, Secrets Manager, SSM, and STS tokens
- Azure managed identities, Key Vault, and Microsoft Graph tokens
- GCP service-account keys and application credentials
- HashiCorp Vault tokens and Kubernetes authentication
- npm, JFrog, PyPI, and RubyGems publishing credentials
- SSH private keys and Kubernetes service-account tokens
- Sigstore credentials and Fulcio signing certificates
- MongoDB, MySQL, PostgreSQL, and Redis connection strings
## Self-Propagation
Using stolen credentials, the worm can:
- Add `.github/setup.js` and workflow files to repositories so it runs in other CI pipelines.
- Insert `.github/copilot-instructions.md` to influence AI coding assistants.
- Publish poisoned packages to PyPI, npm, and RubyGems.
- Attempt privilege escalation on self-hosted runners through `sudoers` modifications.
- Detect StepSecurity’s harden-runner and alter its behavior.
## Attacker Infrastructure and Weaponized Project
- The PyPI account was created in 2024 and was associated with the legitimate `mflux-streamlit` project.
- Package uploads used `Bun/1.3.14`, matching the runtime downloaded by the malware.
- Unlike a pure typosquatting campaign, the compromise of a real project could affect existing users through normal dependency updates.
Developers should audit environments for the affected packages, review CI/CD and cloud credentials, rotate exposed secrets, and enforce dependency pinning and package provenance checks. CI runners and publishing tokens should be treated as potentially compromised if any affected version was installed.
Discord migrated its voice and video infrastructure from roughly 30 hyperscaler regions to Cloudflare’s edge network, which spans more than 300 cities. The move brought measurable gains—over 80% of traffic now runs on Cloudflare, with Frankfurt seeing 34% lower ping and 42% lower packet loss—but the rollout exposed important limitations. Local server proximity alone is not enough; call placement and network peering are equally critical.
## Why Discord Moved Voice to the Edge
- Traditional cloud regions left users in places such as Reykjavik, Auckland, Hawaii, and Lagos relatively far from voice servers.
- Cloudflare’s 300-plus points of presence offered the possibility of hosting Discord’s software much closer to users.
- Unlike typical CDN workloads, Discord needed to route live UDP packets for voice and video calls rather than cache static content.
- More than 80% of Discord voice and video traffic now uses Cloudflare, and 70% of regions have improved year over year.
## Iceland: Local Servers Can Hurt Mixed Calls
- Discord’s first test took place in Reykjavik, where users previously connected to servers in Rotterdam.
- Iceland-only calls improved:
- Ping decreased 9%.
- Packet loss decreased 11%.
- Mixed-region calls became worse:
- Ping for non-Iceland participants increased 2.7 times.
- Packet loss rose 9%.
- Discord assigns one SFU to host an entire call, so all participants send traffic to that server.
- A call started by one Icelandic user could therefore force German participants to route packets to Iceland and back.
- Discord concluded that new edge locations help only when calls hosted there are primarily local; mixed calls require smarter host-placement logic.
## Rotterdam: Network Peering Was the Bottleneck
- Discord next moved Rotterdam traffic to Cloudflare’s Amsterdam PoP.
- Most regional ISPs performed normally, but Orange users experienced:
- More than one second of latency during peak periods.
- A 30% regression in voice freeze ratio.
- The issue was not Cloudflare’s Amsterdam infrastructure itself, but the path between Orange and Cloudflare.
- Traffic traveled through Telia’s transit backbone, where the Telia–Orange connection was already saturated.
- Adding more traffic made the congestion worse.
- Discord reverted the migration after about ten days.
- Cloudflare pursued direct peering with Orange and added SFUs in Paris and London to provide shorter paths.
## A More Careful Migration Strategy
- Discord changed its rollout process from capacity-based scheduling to peering-based analysis.
- Before shifting meaningful traffic to a region, the team now checks whether Cloudflare has sufficient peering capacity with major local ISPs.
- The migration slowed from a planned large-scale rollout to a region-by-region deployment.
- The experience demonstrated that:
- A geographically closer PoP does not always produce the best call experience.
- SFU host placement matters for calls spanning multiple regions.
- Transit routes and ISP peering can be more important than physical distance.
Discord’s edge migration is succeeding, but only through incremental deployment, detailed traffic analysis, and improved call-placement decisions. The practical lesson is that low-latency infrastructure depends on the complete network path—not simply on adding servers closer to users.
Claude Fable 5, Anthropic’s Mythos-class model, is now available through GitLab Duo Agent Platform across all tiers and deployment models. The post presents it as a major step beyond incremental model improvements, emphasizing stronger first-attempt accuracy, sustained autonomous workflows, and better code review and incident analysis. Its main conclusion is that teams should apply it to complex, previously difficult engineering problems rather than routine tasks.
## More Accurate First-Pass Results
- Produces more correct implementations for complex, well-defined problems with fewer iterations.
- Reduces back-and-forth in Duo Agentic Chat.
- Performs especially well on:
- Multi-file refactoring
- Incident investigation
- Infrastructure-as-code definitions
- Interprets technical images, web applications, and detailed screenshots more accurately while often using fewer output tokens.
## Longer and More Reliable Agent Workflows
- Sustains goal-directed work across extended, multi-day runs and millions of tokens.
- Maintains instructions and task focus without frequent manual checkpoints or re-prompting.
- Uses verification loops to identify and correct its own mistakes.
- Handles parallel sub-agents more reliably across multiple repositories or services.
- Reduces the amount of human oversight required per agent run, allowing teams to review results asynchronously.
## Improved Bug Detection and Incident Response
- Provides higher bug-finding recall than previous models.
- Improves outage triage, root-cause analysis, and repository-history investigation.
- Finds deeper code-path issues and edge cases during merge request reviews.
- Produces more actionable review comments instead of generic feedback.
- Helps reduce production defects and improve mean time to resolution.
## Recommended Use Cases
- The post recommends testing the model on difficult, unsolved engineering problems rather than routine work.
- Suggested applications include:
- Complex multi-file refactors
- Production incident investigations
- Implementations developers would normally write manually
- Teams should allow agents to scope work, ask clarifying questions, and execute multi-step solutions.
Claude Fable 5 became available on GitLab Duo Agent Platform on June 9, 2026. Teams can access it through a free trial, the GitLab free tier, or included GitLab Credits for Premium and Ultimate subscribers.
TAM CONNECT 2025 brought together Technical Account Managers from Toss and Kakao Pay to compare how they connect technology, business, customers, and internal teams. Although their organizations differ, they face similar challenges: operational complexity, cross-team coordination, recurring incidents, and the need to improve customer experience. The event framed TAMs not as basic support staff, but as technology-driven problem solvers whose role is expanding through automation and AI.
## The Scope of a TAM’s Role
- TAMs resolve partner integration issues and advise on API adoption.
- They coordinate multiple teams during incidents and improve operational processes.
- Their work includes automating recurring problems and influencing product and platform design.
- Depending on the situation, a TAM may act like a developer, product manager, or incident leader.
- At Toss, their responsibilities span authentication, Face Connect, financial platforms, online and offline payments, and partner APIs.
## Reducing Alert Noise and Preventing Recurring Problems
- Toss’s Dayoung Park presented a problem-solving framework that began by redefining which alerts truly require attention.
- Excessive notifications can obscure serious incidents, so the team focused on identifying meaningful operational signals.
- They structured incident patterns, detected recurring issues automatically, and analyzed the root causes of settlement discrepancies.
- The goal was not merely to resolve incidents faster, but to build systems that prevent them from recurring.
## Making Operations Independent of Individual Owners
- PayToss’s Gimun Lee discussed reducing dependency on specific people’s knowledge.
- Response histories and operational information were shared transparently so anyone could handle an issue.
- Their Discord developer community used n8n workflows, LLM-based log analysis, and automatically generated incident-cause and resolution suggestions.
- These tools helped the team maintain an average response time of under ten minutes.
## Using Customer Experience to Improve TAM Work
- Toss’s Seongmin Chun drew on previous experience working for a customer organization.
- Understanding customer frustrations and the information needed during incidents influenced his communication and support practices.
- The team used the PDCA cycle to continually improve integration guides, standardize repeated communications, and structure operational processes.
- Effective TAM work means not only solving current problems but also ensuring the same problems do not happen again.
## Shared Challenges Across Companies
- TAMs must balance customer expectations with internal development teams.
- They operate in rapidly changing services with increasingly complex systems.
- The role requires simultaneous understanding of technology, business priorities, and customer needs.
- TAMs often appear to sit ambiguously between support, operations, development, and business, but their actual work involves structuring complex problems and mobilizing multiple teams.
- The event characterized TAMs as technology-based problem solvers rather than simple support personnel.
## AI and the Future of TAM Work
- AI is already being applied to:
- Log analysis
- Incident-cause recommendations
- Operations guide generation
- Automated responses to recurring inquiries
- Anomaly detection
- Document search and summarization
- As AI handles repetitive responses, TAMs are likely to focus more on complex problem-solving, structural improvements, cross-team coordination, customer-experience design, and operational strategy.
TAM CONNECT demonstrated that TAM organizations can learn significantly from one another. As technology and services become more complex, TAMs will likely become increasingly strategic, combining automation and AI with the judgment needed to improve systems, processes, and customer experiences.
The AWS roundup highlights the general availability of the AWS IoT Device SDK for Swift, bringing MQTT 5, Device Shadow, Jobs, and fleet provisioning to Apple platforms and Linux. It also covers major AWS releases involving SQL Server licensing, Cognito resilience, OpenAI models on Bedrock, Kubernetes, AI agents, cost reporting, and location services. Together, the announcements show AWS expanding support for Swift edge computing, enterprise AI, multi-Region architectures, and specialized infrastructure.
## AWS IoT Device SDK for Swift
- Now generally available for macOS, iOS, tvOS, and Linux.
- Provides production-ready support for:
- MQTT 5 connectivity
- Device Shadow
- IoT Jobs
- Fleet provisioning
- Reflects Swift’s growing use across server-side development, IoT, and edge computing.
- Projects such as WendyOS are also bringing Swift to NVIDIA Jetson and Raspberry Pi hardware.
## Major AWS Headlines
### Amazon RDS for SQL Server BYOM
- Amazon RDS for SQL Server now supports Bring Your Own Media.
- Customers migrating from on-premises SQL Server can reuse existing licenses, including Software Assurance.
- Support is provided through Microsoft’s License Mobility program.
- AWS License Manager tracks license usage and compliance.
### Multi-Region Amazon Cognito
- Cognito can replicate user and machine identity data to a standby Region in near real time.
- Replicated data includes credentials, user pool settings, and federation configurations.
- Users can continue using applications without re-authentication after a primary-Region disruption.
- Available as an add-on for Essentials and Plus user pools across 16 Regions.
### OpenAI Models on Amazon Bedrock
- GPT-5.5, GPT-5.4, and Codex are generally available for production use.
- GPT-5.5 targets agentic coding, data analysis, and complex autonomous tasks.
- Codex supports the Codex App, CLI, and integrations with VS Code, JetBrains, and Xcode.
- AWS governance and security controls remain available, pricing follows OpenAI rates, and usage counts toward existing AWS commitments.
## Recent AWS Launches
- **Amazon Bedrock observability:** CloudWatch metrics now cover inference counts, token usage, and client errors for OpenAI- and Anthropic-compatible APIs.
- **Redesigned Bedrock console:** Adds model catalogs, side-by-side comparisons, project organization, and pre-filled code examples.
- **AgentCore Identity secrets:** Credential providers can reference existing AWS Secrets Manager secret ARNs, supporting custom KMS keys, tagging, and rotation.
- **Step Functions agentic reasoning:** Workflows can invoke AgentCore-powered agents sequentially or in parallel, include human approval, and trace decisions.
- **Kubernetes 1.36 on EKS:** Adds User Namespaces GA, Mutating Admission Policies, in-place pod resource scaling, and resource health reporting.
- **ECS Managed Instances accelerators:** Supports Trainium1, Trainium2, and Inferentia2 instances with automatic accelerator allocation.
- **Amazon Quick VPC connectivity:** Enables private connections to MCP servers without exposing internal tools to the public internet.
- **Cost and Usage Report 2.0:** Adds Athena and Redshift integrations with generated infrastructure templates, table definitions, and loading guidance.
- **Amazon Location Service:** Routes API now supports transit and intermodal journeys across 13 Regions.
AWS also directs readers to its What’s New page, Builder Center, and upcoming events for further announcements and community resources.
The post is a beginner-friendly guide to common GitHub questions, focusing on SSH authentication and Personal Access Tokens (PATs). It explains how to securely connect a computer to GitHub, create credentials for command-line and API access, and limit those credentials appropriately. The provided excerpt ends just as it introduces merging versus rebasing.
## SSH Keys and GitHub Authentication
- An SSH key consists of:
- A private key that stays on the computer and must never be shared.
- A public key uploaded to GitHub.
- Git uses the matching key pair to verify identity when pushing and pulling code.
- To create an Ed25519 key pair, run `ssh-keygen` with the email associated with the GitHub account.
- Users can accept the default file location and protect the key with a passphrase.
- `ssh-agent` securely stores the key so the passphrase does not need to be entered repeatedly.
- The public key can be copied with `cat ~/.ssh/id_ed25519.pub` and added through **Settings → SSH and GPG keys → New SSH key**.
- A descriptive title, such as “work-laptop,” helps identify the device later.
## Personal Access Tokens
- A PAT is a GitHub-managed credential for authenticating command-line tools and API requests.
- Tokens can be revoked and configured with limited permissions.
- GitHub offers:
- **Fine-grained tokens**, which can be restricted to specific repositories and individual read or write permissions.
- **Classic tokens**, which use broader predefined scopes.
- When creating a fine-grained token, users choose:
- A name and description.
- An expiration date.
- Repository access.
- Specific permissions and whether each is read-only or read/write.
- Classic tokens are created through **Developer settings → Personal access tokens → Tokens (classic)** and use scopes to define access.
- GitHub displays a token only once, so it should be copied immediately and stored securely, such as in a password manager.
- A PAT can be supplied instead of a password when Git prompts for credentials in a terminal.
## Merging and Rebasing
- The excerpt begins introducing the difference between merging and rebasing and how to resolve merge-related problems.
- The supplied content ends before that explanation is provided.
Use SSH keys for secure Git operations from a trusted device, and use narrowly scoped, expiring PATs when tools or APIs require token-based authentication. Never share private keys or tokens, and store credentials securely.
Kakao’s first MCP Player 10 competition showcased how developers are using Model Context Protocol (MCP) to build practical agentic AI services. More than 150 teams participated, and ten finalists were selected for solutions addressing childcare, startup support, culture, gaming, legal research, and safety. Kakao plans to expand this ecosystem through the upcoming Agentic Player 10 competition and deeper integration with Kakao Tools.
## The MCP Player 10 Competition
- The competition ran from December 19, 2025, to January 18, 2026, on Kakao’s PlayMCP open platform.
- It emphasized:
- Creativity
- Everyday usefulness
- Technical stability
- The goal was to encourage developers to create MCP servers that solve real-world problems with AI.
- Ten teams were selected after internal evaluation and received a share of 21 million won in support funding, along with opportunities to collaborate with Kakao.
## Award-Winning MCP Services
### 어린이ZIP: AI Assistant for Childcare Teachers
- Automates administrative work for daycare and kindergarten teachers.
- Analyzes uploaded activity photos to generate drafts of parent notices and childcare journals.
- Remembers child-specific details such as allergies and pickup arrangements.
- Produces personalized responses in a warm, professional tone.
### SeedUp: Startup Support-Program Research
- Collects and analyzes fragmented government startup-support announcements.
- Summarizes eligibility requirements and relevant opportunities.
- Helps founders develop application strategies.
- Supports natural-language requests such as finding weekly deadlines or analyzing an uploaded announcement.
### Other Selected Services
- **공유 비밀의 방:** An anonymous platform for sharing and empathizing with personal stories and AI conversations.
- **바우만 16 안티에이징솔루션:** Recommends skincare routines using the Baumann 16 skin-type classification, cosmetic ingredient data, and skin pH analysis.
- **아라드도우미:** A Dungeon & Fighter assistant using RAG and Vision AI to analyze patch notes, item trends, and optimized character builds.
- **키즈허브:** Aggregates public data such as emergency-room availability, childcare waiting lists, and child-development information.
- **택배추적기:** Combines package tracking with AI-based detection of smishing URLs in delivery-related messages.
- **ArtBridge:** Recommends performances and exhibitions from approximately 200,000 records across nine cultural categories, using location, budget, and preferences.
- **KidSafe:** Detects harmful language and emotional-crisis signals in children’s chatbot conversations, escalating serious cases to guardians or professional resources.
- **LexiLink_ko:** Searches and organizes statutes, court precedents, and administrative interpretations through natural-language queries.
All ten MCP servers are now officially available through the PlayMCP platform.
## PlayMCP’s Future Direction
- PlayMCP will remain a developer-focused environment for building and distributing MCP servers.
- Kakao Tools, available through ChatGPT for Kakao, will focus on helping general users experience MCP-based services.
- Kakao plans to connect the two platforms more closely.
- Kakao is considering managed infrastructure, including:
- Kakao Cloud-based server support
- Automated deployment
- Greater operational responsibility for MCP service stability
- PlayMCP may also support richer in-app interfaces through JSON-based widgets, similar to those already available in ChatGPT for Kakao.
## The Next Competition: Agentic Player 10
Kakao announced a second competition, Agentic Player 10, designed to connect developer-created agents with Kakao Tools and expose them to a broader audience. The program is positioned as an opportunity for startups and aspiring founders to test their services with real users and potentially bring their agents into KakaoTalk.
Developers interested in building practical AI agents are encouraged to use PlayMCP and participate in Agentic Player 10 as the next step in Kakao’s expanding agentic AI ecosystem.
Cloudflare now lets security teams turn live Threat Events intelligence into proactive WAF rules. Instead of manually blocking known malicious IPs, organizations can filter traffic by threat actor, targeted industry or country, attack type, and recency. The integration separates always-on detection from mitigation, allowing teams to validate intelligence before enforcing blocks without sacrificing visibility.
## Always-on Threat Detection
- The system builds on Cloudflare’s always-on Attack Signature Detection framework.
- Threat intelligence runs continuously in the background and enriches HTTP requests with metadata before a WAF action is taken.
- This removes the traditional “log versus block” trade-off: teams can observe detections in analytics and later create blocking rules.
- Cloudforce One subscribers can review threat actors, targeted industries, and traffic patterns before enabling mitigation.
- Detection is designed to add negligible latency.
- The initial release supports IP-based matching, with planned support for JA3 fingerprints and domain-based indicators to identify attackers who rotate IP addresses.
## New WAF Intelligence Fields
Cloudflare exposes threat context through fields that can be used in WAF custom rules and rate-limiting policies:
- `cf.intel.ip.attacker_names`: Known threat groups, such as `CRAVENFLEA`.
- `cf.intel.ip.target_industries`: Industries previously targeted by the IP.
- `cf.intel.ip.attacker_countries`: Countries associated with the threat event.
- `cf.intel.ip.target_countries`: Countries targeted by the event.
- `cf.intel.ip.datasets`: Intelligence sources or attack categories, such as `ddos` and `waf`.
Because an IP may have multiple associated actors, industries, or datasets, these values are arrays. Rules use `any()` with the `[*]` wildcard to match individual values.
## Example WAF Rules
- Block IPs involved in DDoS activity against France:
```text
any(cf.intel.ip.target_countries[*] == "FR") and
any(cf.intel.ip.datasets[*] == "ddos")
```
- Block BLACKBASTA-associated traffic targeting banking and financial services:
```text
any(cf.intel.ip.target_industries[*] == "Banking & Financial Services") and
any(cf.intel.ip.attacker_names[*] == "BLACKBASTA")
```
- Apply broad protection against traffic originating from Iran:
```text
any(cf.intel.ip.attacker_countries[*] == "IR")
```
## Deployment Through Existing Workflows
- The fields are available in the WAF rule builder for custom rules and rate limiting.
- Teams can configure them through the Cloudflare API or Terraform.
- Rules can be automated across individual domains or an entire account.
- Security Analytics records matches, including the triggered rule and the specific intelligence indicator involved.
- Threat Events users can create Saved Views—such as IPs targeting the financial sector within the last seven days—and convert them into WAF rules with one click.
## Global Distribution and Performance
- Cloudflare compresses threat intelligence datasets into a high-performance format.
- The data is distributed to Cloudflare data centers worldwide.
- The WAF can therefore evaluate threat indicators at the edge without requiring local IP lists or introducing significant request latency.
- The post begins to describe this lookup process as O(1), but the provided content ends before explaining the implementation in detail.
Cloudflare’s integration gives teams a practical path from threat intelligence to enforcement: investigate indicators, validate them in analytics, and deploy precise WAF or rate-limiting rules through the UI, API, or Terraform. Teams should use the always-on visibility to tune criteria before blocking, while preparing for future indicators such as JA3 fingerprints and malicious domains.
Mastery is not just learning tools or techniques; it is developing a distinctive point of view through repeated practice and intentional choices. Figma’s Loredana Crisan argues that “taste” is cultivated continuously through care for one’s craft, empathy for users, and disciplined attention to detail. AI can expand creative exploration, but it cannot replace the judgment that makes work personal and meaningful.
## Taste Is Built Through Practice
- Expertise requires understanding both the material and the tools of a craft.
- Crisan compares design to piano and music composition: technical correctness matters less than knowing why choices create emotion and impact.
- Taste develops through:
- Consistent practice
- Mentorship and critique
- Feedback and collaboration
- Sustained creative attention
- Developing a point of view is the most time-consuming part of mastery—and it never truly ends.
## Taste Is a Form of Care
- Taste is visible when work feels intentional, refined, and thoughtfully executed.
- Dieter Rams’ Braun products demonstrate this principle by considering not only an object’s function but also its surroundings, physical interactions, and overall experience.
- Taste is not universal popularity; different designers can have different sensibilities while showing equal intentionality.
- In product design, taste appears in trade-offs such as:
- Form versus function
- Expressiveness versus legibility
- What to include versus what to omit
- Which compromises to accept or reject
- Taste comes from both love of the craft and care for the people using the result.
- Designers should test details across varied contexts, including screen sizes, color profiles, languages, devices, transitions, and uncommon user states.
## What Designers With Taste Demonstrate
When hiring for taste, Crisan looks for three qualities:
- **Discernment:** The ability to identify what is not working and explain why with nuance.
- **Empathy:** Attention to the person experiencing the interface, including needs that may not be obvious.
- **Creative energy:** A persistent drive to make, experiment, and pursue side projects or unresolved problems.
## AI Expands Exploration but Cannot Replace Judgment
- AI may reduce the labor involved in producing work, but accepting its first output would undermine the iterative process required for quality.
- Examples such as James Dyson’s 5,127 prototypes illustrate how refinement and rejection are central to creative mastery.
- Better tools increase the distance a creator can travel between an idea and its execution, but the vision still comes from the creator.
- AI can help generate more possibilities, while taste determines which possibilities are worth developing.
- A creator’s distinctive voice emerges from accumulated, intentional decisions repeated over time.
The practical recommendation is to use AI and other tools to explore broadly, while continuing to practice, critique, refine, and care deeply about both the craft and the people who experience the final result.
Discord’s new You Bar is a mobile navigation redesign intended to simplify movement through the app, emphasize users’ identities, and bring mobile and desktop experiences closer together. Inspired by open-world games, it treats servers as the world users explore and the You Bar as their personal interface for moving through it. Discord says the redesign is rolling out to mobile users, with further customization and voice features planned.
## Simplifying Mobile Navigation
- Discord previously used separate navigation systems for servers and non-server destinations, which became increasingly complex.
- Because most mobile activity centers on servers and channels, the You Bar organizes navigation around that primary behavior.
- Tapping the You Bar opens the profile, including profile editing, Settings, Quests, and the Shop.
- Notifications have a dedicated bell icon.
- Shortcuts include:
- Long-pressing the You Bar to open the account menu and change online status.
- Long-pressing the avatar to open Settings.
- Swiping across the You Bar to switch between DMs and the current server.
- The redesign also provides modest memory and CPU savings.
## Highlighting User Identity
- The You Bar creates a dedicated space for users’ visual identities.
- It features a larger avatar, more polished display name and status treatments, and greater prominence for Avatar Decorations and Nameplates.
- Discord designed the area to make personal customization more expressive and visible.
## Unifying Mobile and Desktop
- Discord’s desktop and mobile apps have developed different visual styles and interaction patterns over time.
- The You Bar is part of a broader effort to make Discord feel familiar across devices without simply copying the desktop interface onto mobile.
- The company says future mobile improvements will continue to be guided by user feedback.
## Planned Improvements
- **Per-server You Bar:** The bar will reflect a user’s unique profile for the active server.
- **Server Tags:** Favorite or relevant server tags will appear on the bar.
- **Activity indicators:** Users will be able to see activities such as gaming or listening to music.
- **Animation controls:** Users will control when animated Avatar Decorations and Nameplates play.
- Discord is also reconsidering the profile page as a more dynamic, personalized space rather than a static screen.
- The You Bar may support a more familiar desktop-like mobile voice experience for joining and leaving voice channels.
Discord recommends viewing the You Bar as the foundation for a simpler, more personalized mobile experience. Its current redesign is only the first step toward deeper profile customization, server-aware identity features, and improved mobile voice interactions.
