GICRE: Premiums grew, profit declined, solvency strong, and major flood claims provisioned - TradingViewGICRE: Premiums grew, profit declined, solvency strong, and major flood claims provisioned TradingView
Low-latency, high-throughput SQS event processing with AWS Lambda provisioned mode - Amazon Web Services (AWS)Low-latency, high-throughput SQS event processing with AWS Lambda provisioned mode Amazon Web Services (AWS)
Provisioned Throughput Redefines Open Model Inference Economics and Predictability - The Futurum GroupProvisioned Throughput Redefines Open Model Inference Economics and Predictability The Futurum Group
Defensive responses of titan triggerfish to tiger sharks at a provisioned reef - nature.comDefensive responses of titan triggerfish to tiger sharks at a provisioned reef nature.com
Amazon EKS introduces Provisioned Control Plane | Amazon Web Services - Amazon Web Services (AWS)Amazon EKS introduces Provisioned Control Plane | Amazon Web Services Amazon Web Services (AWS)
TrueFoundry's open source AI agent harness TrueForge boasts 30%-75% cheaper task completion than Claude Managed AgentsA sandbox is provisioned as a tool only when the agent needs to execute code or work with files. TrueFoundry says that reduces unnecessary compute.
Show HN: Compose-to-Cloud Pulumi Providers for AWS, GCP, and AzureHi HN,These are three FOSS Pulumi providers (defang-aws, defang-gcp, defang-azure) that take a Docker Compose-like project and provision it as real infrastructure to the respective cloud: VPC, subnets, load balancers, serverless containers (ECS Fargate, Cloud Run, Container App), builds, managed PostgreSQL, Redis, LLMs, and public/private DNS.Develop once, deploy anywhere: all three providers expose the same Compose-shaped surface. They contain the same Pulumi resources: Project, Build, Service, Postgres, Redis, LLM. Each service in the Compose services map gets provisioned as one of those resources. Moving between clouds should be as simple as changing the import and nothing else. The Project resource sets up private DNS for service discovery, so Compose services can connect using their Compose service names.These providers have been rewritten from scratch in Go and are based on the (internal) TypeScript Pulumi code we've been working on for the last 2 years. We haven't reached parity
Show HN: MonkePay – Charge AI Agents per API Request in USDCI built MonkePay. It is a thin wrapper on top of the x402 protocol and Coinbase CDP. It lets you gate any Express/Hono/Fastify/Next.js endpoint behind per-request USDC payments.The problem: x402 is solid but using it raw means provisioning wallets, verifying on-chain receipts, building payout logic, tracking payments, 2-3 weeks of plumbing before you've monetized anything.MonkePay abstracts all of that. Three lines of middleware, wallet provisioned automatically, USDC verified on-chain before your handler runs, daily payouts to your personal wallet.Looking for developers to try it and share feedback, especially if you're building agent-facing APIs or working with x402. Happy to help with integration directly. Drop a comment or reach me at hello@monkepay.xyzSDK: npm install @monkepay/sdk Docs: docs.monkepay.xyz Source (SDK): github.com/AliBaig-xD/monkepay-sdk
Ask HN: How do you enforce least-privilege when an API token has full access?Curious how people handle least-privilege access when integrating third-party APIs that only offer a single coarse permission scope (or limited scopes that are still over-provisioned for a specific use case).A lot of services expose APIs where the token basically grants everything the integration can do (read/write/delete across the entire account), making it hard to enforce the principle of least privilege internally when multiple internal services or agents are calling the same API.In those cases, do you...Put an API proxy/gateway in front of the third-party API to enforce granular permissions?Use RBAC/ABAC rules in a proxy layer to filter which endpoints/actions can be called?Just accept the coarse permissions and risk associated?Something else?Would love to hear real architectures people are using in production, especially when the upstream API itself doesn’t support fine-grained scopes.
Show HN: AgentFork – Any repo, instantly runnable by AI agents or contributorsAgentFork lets maintainers and teams connect a GitHub repo. Our AI indexes the codebase — detects the framework, databases, services, and build steps — and generates an environment spec. Anyone can then fork the project and get a fully provisioned cloud environment with a live preview URL. Databases like Postgres and Redis are spun up automatically. The idea is that AI agents (or any contributor) can fork, make changes, and verify them against a real running instance without anyone configuring infrastructure. Early stage — waitlist is open at agentfork.dev. Would love technical feedback on the approach.
AI compromised sandbox to mine crypto without prompting on its own initiativeFrom §3.1.4, "Safety-Aligned Data Composition":> Early one morning, our team was urgently convened after Alibaba Cloud’s managed firewall flagged a burst of security-policy violations originating from our training servers. The alerts were severe and heterogeneous, including attempts to probe or access internal-network resources and traffic patterns consistent with cryptomining-related activity. We initially treated this as a conventional security incident (e.g., misconfigured egress controls or external compromise). […]> […] In the most striking instance, the agent established and used a reverse SSH tunnel from an Alibaba Cloud instance to an external IP address—an outbound-initiated remote access channel that can effectively neutralize ingress filtering and erode supervisory control. We also observed the unauthorized repurposing of provisioned GPU capacity for cryptocurrency mining, quietly diverting compute away from training, inflating operational costs, and introducing clear legal
Show HN: Smplogs – Local-first AWS Cloudwatch log analyzer via WASMsmplogs analyzes your AWS CloudWatch log exports (Lambda, API Gateway, ECS) and turns them into severity-ranked findings, root cause analysis, and log signature clusters. The entire analysis engine is written in Go, compiled to WebAssembly, and runs client-side. Your log content never leaves your browser.Why I built this: I got tired of the CloudWatch debugging loop - staring at raw log streams, writing ad hoc Insights queries, mentally correlating timestamps across invocations, and still not understanding why my Lambda was failing. I wanted something where I could drop a file and immediately see "94% of your failures occur within 200ms of a DynamoDB ProvisionedThroughputExceededException - switch the Payments table to on-demand capacity." Actual root causes, not just "error rate is high."Technical approach: The core engine is a Go binary compiled to WASM (~analysis.wasm). At build time, Vite computes its SHA-256 hash and bakes it into the JS bundle. At runtime, the browser fetches the
Google Cloud Run cost me $4,676 in 6 weeks with zero traffDear HN,I’m a solo operator with no paying customers yet. I wanted more predictable baseline costs while iterating on a side project, so I migrated from App Engine to Cloud Run.I fed my setup, budget, and constraints as context into Gemini CLI, asked it to search official documentation and best practices, and followed that guidance.I removed –min-instances=1, expecting autoscaling to reduce idle spend. The commit message claimed “60% cost savings.” The actual outcome was roughly an 1,800% increase and a surprise decline message when I went to buy coffee on my credit card.From Nov 2 to Dec 14, Cloud Run accrued ~$4,676. There was no traffic spike, no abuse, no application bug. The services were mostly idle.What compounded: CPU and memory were over-provisioned (4 CPU, 16Gi) from earlier experimentation. Each deploy created a new revision, and I deployed frequently while iterating. Those revisions must have stayed warm longer than expected. Autoscaling plus revision sprawl meant more acti