今日已更新 302 条资讯 | 累计 37551 条内容
关于我们

标签:#app

找到 1028 篇相关文章

AI 资讯

You could be taking way better photos on your phone

Your smartphone photos can look way better. If you're willing to put in a little extra work, use third party apps and spend a bit of time editing, it's possible to take photos that - under the right circumstances - can rival dedicated digital cameras. I post a lot of smartphone photos online, and "How […]

2026-08-01 原文 →
AI 资讯

Apple’s new AirTags are back down to their best price

We spotted a great deal on Tile trackers earlier this week that’s still live, but if you’re an iPhone owner, we ultimately recommend Apple’s latest AirTag. Right now, you can pick up a four-pack for $89 ($10 off) at Amazon and Target, matching the bundle’s all-time low price. If you’re a member, Costco also has […]

2026-08-01 原文 →
AI 资讯

Google Earth’s AI deepfake tool only lasted one day

Google has shut down Google Earth feature it launched Thursday that allowed users to edit satellite images with text prompts using AI. The tool essentially let users create AI deepfakes of the real world using text prompts; Digital Digging's Henk van Ess, for example, intentionally generated images adding things like refugees near the Mexican border […]

2026-08-01 原文 →
AI 资讯

Dropbox Integrates MCP and Dash to Close the Gap Between Security Design and Code Review

Dropbox has integrated Model Context Protocol (MCP) with its internal knowledge platform, Dash, to surface security design context during AI assisted code reviews. The system retrieves threat models and security requirements for pull requests, helping reviewers validate implementation against design intent. An InfoQ Q&A explores the architecture and key lessons learned. By Leela Kumili

2026-07-31 原文 →
AI 资讯

AI Harnesses Are Just Middleware, and Middleware Trust Bugs Are Older Than Your Career

Here's the thing nobody wants to hear: we already know how to break systems where components blindly trust each other's output. We've known for twenty-five years. We just gave it a new name and forgot the lesson. Context An "AI harness" is orchestration glue. Take an LLM, wrap it with a bunch of connectors, plugins, and tool-calling scaffolding so it can actually do things (query a database, hit an API, write a file), and you've got a harness. The Dark Reading piece points out something structurally obvious once you say it out loud: these components form a chain of trust boundaries, and a lot of them don't verify what the component next to them is handing over. If that sentence gives you deja vu, it should. Deserialization bugs, SSRF via internal service calls, XML entity injection through a "trusted" upstream parser — the entire history of appsec is a history of Component A assuming Component B already did the validation. We keep rediscovering this pattern every time a new architecture pattern gets hot enough to attract production traffic before anyone's threat-modeled it. The new part isn't the trust boundary problem. The new part is that the thing sitting in the middle of the chain is a probabilistic text generator that can be talked into doing weird stuff by its own inputs, and it's now wired directly into tool execution. Hype check What's overstated: the framing that this is some novel AI-specific exploit class requiring AI-specific defenses. It's not. It's an integration security problem wearing an LLM costume. The moment you have plugins and connectors passing data between components without verification, you have the same problem you'd have gluing together any set of microservices with implicit trust. The attack surface is old news; the payload delivery mechanism (prompt-driven tool invocation) is what's new. What's understated: how fast harnesses are being shipped without anyone doing basic component-boundary threat modeling, because everyone's racing to sh

2026-07-31 原文 →