AI 资讯
MCP for AWS Security Engineers: Build a Read-Only Security Hub Triage Agent
MCP for AWS Security Engineers: Build a Read-Only Security Hub Triage Agent For AWS-heavy security work, I would start with AWS Agent Toolkit for AWS and the managed AWS MCP Server , not a custom MCP server. The reason is practical. AWS now provides a managed MCP path that can connect AI coding agents to AWS documentation, AWS APIs, AWS skills, and existing IAM credentials. The Agent Toolkit also provides plugin-based setup for supported agents such as Claude Code and Codex. For security teams, that is the right starting point because the enforcement point remains AWS IAM, not the model. The initial operating model should be strict: Read-only first. No production write authority. No access to secrets. No raw customer PII or sensitive incident logs in prompt context. No automatic remediation. No AI-approved suppression, exception, merge, deploy, or risk acceptance. Human review and CI/CD remain the release authority. That is the same posture I would use for a governed Claude Code or Codex rollout: named identities, SSO, scoped credentials, default deny, tool approval, audit logs, and security evidence tied back to tickets, pull requests, CI logs, and cloud findings. What we are building This article walks through a practical security workflow: A read-only Security Hub triage assistant that helps a junior security engineer produce a daily or weekly findings summary, remediation backlog, and evidence pack without allowing the agent to modify AWS. The agent will be able to: Read AWS Security Hub findings. Group findings by account, severity, product, resource, and control. Explain why a finding matters. Draft remediation tickets. Draft a Slack-ready summary. Produce local markdown, CSV, and JSON evidence files. The agent will not be able to: Suppress findings. Archive findings. Mark findings resolved. Disable Security Hub standards. Modify IAM, S3, EC2, KMS, GuardDuty, Inspector, or Config. Deploy remediation. Run destructive scripts. Approve risk acceptance. This is no
AI 资讯
Every AI-Generated Line of Code Is a Small Loan — And Eventually, You Have to Pay It Back
A bug showed up in my personal project last month. Nothing dramatic - a value wasn't updating the way...
AI 资讯
5 Things I Learned Building a Chrome Extension That Watches ChatGPT, Claude & Gemini
I spent the last few months building a Chrome extension that detects HTML code blocks inside ChatGPT, Claude, and Gemini and lets you deploy them straight to a live URL. The "deploy" part turned out to be the easy 20%. The hard 80% was reliably watching three completely different, constantly-changing chat UIs without breaking every other week. Here's what actually taught me something. 1. MutationObserver is non-negotiable, but it will still lie to you None of these chat apps render the full response at once — they stream tokens in, which means the DOM you're watching is incomplete almost every time your observer fires. My first version tried to detect a finished <pre><code> block the moment it appeared. Result: I was grabbing HTML mid-stream, cut off halfway through a <div> . What actually worked was debouncing on DOM stability instead of DOM presence: let debounceTimer ; const observer = new MutationObserver (() => { clearTimeout ( debounceTimer ); debounceTimer = setTimeout ( scanForCodeBlocks , 600 ); }); observer . observe ( document . body , { childList : true , subtree : true }); 600ms of "nothing changed" turned out to be a much more reliable signal than "the tag now exists." Not elegant, but it works across all three sites' streaming speeds. 2. Every AI chat UI restructures its DOM without telling you ChatGPT, Claude, and Gemini all ship frequent frontend updates, and none of them are obligated to keep a stable class name for you to hook into. I initially selected code blocks by class name ( .language-html , .hljs , etc.) and had selectors silently break in production within two weeks of launch. What's held up better: matching on structural patterns instead of class names — a <pre> containing a <code> whose text content starts with <!DOCTYPE or <html . It's slower to write the first time, but it doesn't care what CSS class the framework decided to use this month. 3. "Detect the code" is easy. "Detect the right code" is the actual problem A single AI response
AI 资讯
**# 🐛 The Bug That Made Me Stop Blaming Python**
# 🐛 The Bug That Made Me Stop Blaming Python "The computer wasn't confused. I was." I still remember the moment. I had just started learning Python. Every new concept felt exciting. Every successful program made me believe I was getting closer to becoming a real developer. Then I met my first bug. It wasn't a complicated algorithm. It wasn't artificial intelligence. It wasn't even a project. It was a simple countdown. "Print the numbers from 5 to 1." That sounded easy enough. So I wrote this: count = 5 while count > 0 : print ( count ) I pressed Run . For a split second, everything looked normal. Then the terminal kept printing. 5 5 5 5 5 5 ... It never stopped. My first thought was that VS Code had frozen. Then I wondered if Python was broken. Maybe I'd installed something incorrectly. Maybe my laptop was the problem. I restarted everything. Nothing changed. Finally, I stopped blaming the tools and started reading my own code. That's when I noticed something embarrassingly simple. I was asking Python the same question over and over again: Is count greater than zero? The answer was always yes . Because I had never told Python to change count . Not once. The computer wasn't making a mistake. It was following my instructions perfectly. The fix took one line. count = 5 while count > 0 : print ( count ) count -= 1 I ran it again. 5 4 3 2 1 Done. One line. One lesson I'll probably never forget. That day changed how I think about programming. Before, I believed debugging meant finding what the computer had done wrong. Now I know debugging usually means discovering what I told the computer to do. Computers don't guess. They don't assume. They don't fill in missing logic. They execute instructions exactly as they're written. If the result is wrong, the first place I look isn't Python anymore. It's my own thinking. I'm still a beginner, and I know much harder bugs are waiting for me. But strangely, I'm looking forward to them. Because every bug teaches something that no tuto
AI 资讯
Prompt Injection: The AI Security Hole Every Builder Should Know
The Idea: Hidden Instructions Inside Trusted Content Prompt injection is an attack where malicious instructions are embedded inside content that an AI is asked to process - a document, a webpage, an email, a customer support ticket. The model can't always distinguish between "data I'm reading" and "commands I should follow," so it follows the embedded instruction as if a legitimate user sent it. This gets sharper when AI agents (autonomous systems that browse the web, read files, and take actions on your behalf) are involved. A summarizer that reads a webpage might encounter hidden text instructing it to forward your conversation history somewhere, or change the tone of its next reply, or deny remembering something it just said. The model has no inherent way to verify who is actually giving orders. The core problem is one of trust boundaries: current large language models process instructions and data through the same channel - natural language - so there's no hard technical wall between "read this" and "do this." Researchers have demonstrated this across multiple major models, not because any one model is uniquely broken, but because the architecture makes the distinction genuinely difficult. Defenses exist but are imperfect. Techniques include output filtering, sandboxing agent permissions (limiting what actions the model is allowed to take regardless of what it's told), prompt hardening (structuring system prompts to be resistant to override), and retrieval-aware design that treats external content as untrusted by default. No single fix closes the gap entirely. Real Example: The Customer Support Agent Imagine a small business deploys an AI agent to handle incoming support emails. The agent reads the email, checks order history, and drafts replies. A bad actor sends a support ticket that looks normal on the surface, but contains a hidden paragraph - white text on white background, or text in a section the agent processes but doesn't display - that says: "Ignore pr
AI 资讯
Parallel Routes in Next.js App Router — Rendering Multiple Pages in One Layout
Parallel Routes let you render multiple pages simultaneously within the same layout. Instead of navigating away from a page to show another one, you can display both at the same time — a dashboard with independently navigable sections, a main content area alongside a sidebar that changes with its own navigation, or a feed with an openable detail panel that doesn't replace the feed. This is one of the more powerful App Router features and one of the more confusing to set up initially. Here's the complete pattern, including the design approach used for complex multi-panel interfaces like the generation tool at Pixova . The Core Concept — Named Slots Parallel routes use named slots: special folders prefixed with @ that define independent rendering areas within a layout. app/ ├── layout.tsx ← Receives slot props ├── page.tsx ← Default slot content ├── @sidebar/ │ ├── page.tsx ← Sidebar default │ └── settings/ │ └── page.tsx ← Sidebar settings view └── @modal/ ├── page.tsx ← Modal default (null) └── photo/[id]/ └── page.tsx ← Photo modal The layout receives each slot as a prop: // app/layout.tsx export default function Layout ({ children , sidebar , modal , }: { children : React . ReactNode ; sidebar : React . ReactNode ; modal : React . ReactNode ; }) { return ( < div className = "flex h-screen" > < aside className = "w-64 border-r" > { sidebar } </ aside > < main className = "flex-1" > { children } </ main > { modal } </ div > ); } Now children , sidebar , and modal can each navigate independently. Independent Navigation — The Key Behavior Each parallel route slot navigates independently. When a user navigates from / to /settings , the children slot updates. The sidebar slot stays exactly where it was — its navigation state is independent. This is the key difference from nested layouts. Nested layouts rerender from the changed segment outward. Parallel routes don't affect each other. User is at / (children shows home, sidebar shows default nav) User navigates to /setti
产品设计
Uber Announces Acquisition Offer for Delivery Hero at $14.8B
科技前沿
Astronomers Have Found a Sugar Molecule in Deep Space for the First Time Ever
Researchers identified traces of erythrulose, a monosaccharide, thousands of light-years away.
AI 资讯
Building a Zero-Hardware Keyboard Light: My Journey with C#, WPF, and OLED Efficiency
Working late nights on server migrations and code architectures often means typing in low-light environments. While USB lamps or backlit keyboards are the standard solutions, they consume extra power and add physical clutter. I realized the ultimate light source was already directly in front of me: the monitor. With a clear vision in mind, I partnered with Google's Gemini AI to rapidly prototype and refine what became LightBar For Keyboard , a lightweight Windows application that creates a reflective light bar at the bottom of the screen to illuminate the keys. Here is how we built it using C# and WPF, tackled the Windows API to manage screen space, and optimized it for modern OLED energy consumption. The Core Challenge: Desktop Toolbars (AppBar) The simplest approach to creating a light bar is a borderless, top-most window. However, the immediate UX flaw is that maximized applications (like Chrome or Visual Studio) will either cover the bar or be partially obscured by it. To solve this, the application needed to behave like the Windows Taskbar. I implemented the native Windows Application Desktop Toolbar (AppBar) API using SHAppBarMessage from shell32.dll . Docked Mode: By registering the application as an AppBar and setting the edge to ABE_BOTTOM , Windows automatically recalculates the working area of the desktop. Result: Maximized windows are pushed upward, ensuring the light bar remains entirely visible and never covers any underlying application UI. Floating Mode: For users who need temporary access to the bottom of their screen, I added a state toggle that unregisters the AppBar and enables standard drag-and-drop window movement via MouseLeftButtonDown . Enforcing a Single Instance Because the app directly manipulates the desktop working area, launching multiple overlapping instances would cause UI glitches. To prevent this, I implemented a Mutex in App.xaml.cs to guarantee a single instance constraint. protected override void OnStartup ( StartupEventArgs e )
开发者
OnePlus, the ‘Flagship-Killer’ Smartphone Brand, Is All but Dead
The original OnePlus phone disrupted the mobile market 13 years ago with its affordable price and top-end specs. Now, the company is exiting North America and Europe to focus on China.
AI 资讯
Where are YC founders now? OpenAI and Anthropic, mostly
开发者
Computing Camera Rays
开源项目
🔥 injaneity / pi-computer-use - Let Pi control your apps on MacOS & Windows
GitHub热门项目 | Let Pi control your apps on MacOS & Windows | Stars: 1,312 | 103 stars today | 语言: TypeScript
开发者
The Looting of Science Fiction
AI 资讯
Grok Build is open source, and that matters for AI coding tools
Grok Build is open source, and that matters for AI coding tools What happened xAI published the source code for Grok Build , its terminal-based AI coding agent. The repository shows a full stack for a TUI-driven assistant that can inspect a codebase, edit files, run shell commands, search the web, and manage longer-running tasks. In other words, this is not just a model demo or a chat wrapper; it is the software layer that turns a model into a usable developer tool. The release came up on the Hacker News front page, which is useful context because the discussion there was less about model benchmarks and more about tooling, workflow, and whether open-source agent infrastructure is becoming a competitive advantage on its own. Primary source: Grok Build repository Why this release is interesting A lot of AI coding products hide the implementation details behind a hosted UI. Open-sourcing the agent runtime gives the community something different to inspect: how the tool is structured, how it handles shell access, and how it organizes the user experience around files, commands, and context. That matters for engineers because the practical questions are often not about raw model capability. They are about reliability, prompting surfaces, permissions, and how much of the workflow can be automated without turning the tool into a black box. The README describes Grok Build as a terminal-based coding agent that supports interactive use, headless scripting, editor integration via the Agent Client Protocol, and a modular tool/runtime layout. That makes it closer to an infrastructure project than a showcase demo. If you are building internal copilots, code assistants, or agent workflows, the design choices here are worth studying. What the repository tells us The repository description makes a few things clear: 1. The agent is meant to be operational, not decorative The docs emphasize real actions: editing files, executing shell commands, searching the web, and coordinating long-
开发者
Introducing Timezone Convert API — DST-aware IANA conversion at the edge
Just shipped Timezone Convert API — DST-aware IANA timezone conversion. Free, no key, CORS-enabled. Endpoints GET /convert?time=2026-07-16T09:00&from=Asia/Kolkata&to=America/New_York GET /now?zone=Europe/London GET /offset?zone=Pacific/Auckland GET /diff?a=Asia/Tokyo&b=Asia/Kolkata GET /zones (400+ IANA zones) Try it curl "https://timezone-convert.techtenstein.com/now?zone=Europe/London" Live at https://timezone-convert.techtenstein.com — OpenAPI 3.1 spec at /openapi.json . MIT.
AI 资讯
Why Expensive Software Development Never Looks Expensive
Every organisation that has run a significant software system for more than a few years has felt a version of the same thing: a change that should have taken days takes months, nobody can quite explain why, and the explanation that eventually gets offered — the domain is complex, the requirements changed, the previous team was careless — is almost never checked against an alternative approach for the software architecture or alternative framework choices, because the alternative was never built. There is no possible comparison to determine the solution chosen is a good one and there is no benchmark to measure "fit for purpose." This is the unfalsifiability problem, and it is worth stating plainly before anything else in this piece, because it is the reason the cost described below is so rarely traced back to its actual cause. Every system is built once. There is no version of your platform built the other way, running alongside it, that anyone can compare it to. So when a system works, the approach that produced it gets read as validated. When a system becomes expensive to change, the cost gets attributed to anything except the structural decision that caused it — because that decision was made years ago, by people who may have moved on, and there is no control group to prove that the structure was the variable that mattered. That absence of a control group is not a minor academic point. It is the reason a specific, avoidable pattern of cost has been able to spread through the industry for decades, get taught in courses, get validated in interviews, and still never be clearly named as a mistake. This article is an attempt to name it — and to offer something more useful than a diagnosis: a way to check, this week, whether it applies to you. The Villain: Process Over Product Ask almost any team building a significant piece of software what the goal of the project is, and the honest answer, more often than anyone would like to admit, is not "build the best-fitting prod
AI 资讯
What Is My IP Address? IPv4 vs IPv6 Explained for DevelopersPublished
What Is My IP Address? IPv4 vs IPv6 Explained for Developers If you've ever debugged a CORS error, set up an IP allowlist, or wondered why req.ip returned something weird in your Express logs, you've run into the same question from a different angle: what actually is an IP address, and which one is "mine"? fastestchecker.com This post breaks down IPv4 vs IPv6, public vs private IPs, and how to reliably detect a user's IP address in your own code — plus a fast way to check yours right now. fastestchecker.com TL;DR IPv4 addresses look like 192.168.1.1 — four numbers, 0-255, separated by dots. There are about 4.3 billion of them, and we've run out. IPv6 addresses look like 2001:0db8:85a3::8a2e:0370:7334 — a much larger address space designed to replace IPv4. Your device usually has a private IP (local network) and shares a public IP (internet-facing) with everyone else on your router. You can check your current public IP instantly with a tool like FastestChecker's IP Checker — useful for confirming what your server or API actually sees. > IPv4 vs IPv6 : What's the Actual Difference IPv4 IPv4 has been the backbone of the internet since the 1980s. It's a 32-bit address, which caps the total number of unique addresses at roughly 4.3 billion. Given how many devices are online today, that pool has been effectively exhausted for years — which is why NAT (Network Address Translation) exists: it lets an entire household or office share one public IPv4 address. Example IPv4: 203.0.113.42 IPv6 IPv6 uses 128-bit addresses, which gives it an address space so large it's effectively unlimited for practical purposes (2^128 addresses). It was designed specifically to solve IPv4 exhaustion, and adoption has been climbing steadily — most major cloud providers and mobile carriers support it by default now. ** Example IPv6:** 2001:0db8:85a3:0000:0000:8a2e:0370:7334 Quick Comparison IPv4IPv6Address length32-bit128-bitFormatDotted decimal (192.168.1.1)Hexadecimal, colon-separatedTotal addre
产品设计
Megaphone
Open-source Mac dictation App that's 100% on-device Discussion | Link
AI 资讯
Every HTTP Status Code Tells a Story
Every time you open a website, sign into an application, or send a request to an API, a server responds with a small but powerful message: an HTTP status code. Most developers encounter these codes every day. But behind every number is a story about what happened between the client and the server. HTTP status codes are part of a standardized response system defined by RFC 9110. They help applications understand whether a request succeeded, needs attention, or failed. The HTTP Status Code Families 🟢 2xx — Success The request was received, understood, and completed successfully. Examples: 200 OK — The request succeeded. 201 Created — A new resource was successfully created. These responses tell the client: everything worked as expected. 🔵 3xx — Redirection The requested resource requires an additional step. These responses help clients find another location or use a different version of a resource. Examples include redirects and cache-related responses. 🟠 4xx — Client Errors Something is wrong with the request sent by the client. Common examples: 400 Bad Request — The request format is invalid. 401 Unauthorized — Authentication is required. 403 Forbidden — The client does not have permission. 404 Not Found — The requested resource does not exist. In simple terms: the problem is usually on the client side. 🔴 5xx — Server Errors The request was valid, but the server failed while processing it. Example: 500 Internal Server Error — An unexpected error occurred on the server. These responses indicate problems within the server or its internal systems. Why HTTP Status Codes Matter HTTP status codes are not just numbers. They are: The language of web communication Essential signals for API behavior Valuable tools for debugging and monitoring A foundation of backend engineering and distributed systems Understanding status codes helps developers build better applications, diagnose problems faster, and design more reliable systems. A single three-digit number can reveal what ha