今日已更新 133 条资讯 | 累计 37382 条内容
关于我们

标签：#rce

找到 2402 篇相关文章

AI 资讯

I Built a System to Run My Job Search Like a Pipeline

Most job searches look the same from the inside: a dozen open browser tabs, a spreadsheet that was accurate for about four days, and a nagging feeling that something is slipping. Applications leak out the bottom. Follow-ups get forgotten. And after a few weeks of it, you have done a lot of work and learned almost nothing about what is actually working. I ran mine that way for a while. Then I stopped treating it as a to-do list and started treating it as a pipeline: named stages, a scoring step at the front, and a follow-up cadence that did not depend on my memory. That one shift changed how the whole search felt. Here is the system. Why a list fails you A to-do list is good at exactly one thing: telling you what to do next. That is also its limit. A list cannot tell you what is working. It has no stages, so you cannot see where things stall. Are you not getting responses because your applications are weak, or because you are aiming at the wrong roles, or because you never follow up? A list shrugs. It just shows you the next unchecked box. And because a list rewards volume, it quietly pushes you to apply more without ever asking whether applying more is the problem. You end up repeating the same misses faster. The reframe is simple. A job search is not a list of chores. It has stages, the same way a sales pipeline does. Naming those stages is the first thing that changes, because you cannot improve a step you cannot see. The stages Here is the pipeline I settled on, in plain terms: Sourced. A role you found and might go after, but have not evaluated yet. Evaluated. You have looked at it seriously and decided it is worth pursuing. Applied. You are in. Follow-up. You have applied and the clock is running on a nudge. Interview. A human is talking to you. Offer. The point of the whole thing. And then the ways a role ends, which matter more than people think: No response. You applied and heard nothing back. Ghosted. Closed. The posting closed before you got a real shot at

2026-08-30 原文 →
开发者

While VCs pour billions into humanoids, Hugging Face's tiny open-source robot quietly passed $1M in sales

I just wrote about the billion-dollar rounds flooding into humanoid robotics. Here is the story from the other end of the scale, and I find it more encouraging. Hugging Face's open-source robot, a 25-centimeter bipedal machine with fifteen actuators and a sensor kit that includes a camera, speaker, LiDAR, NFC, Bluetooth, and WiFi, just passed a million dollars in sales. Fully open hardware, openly documented, quietly making real money. One of these robotics stories is funded like an industrial giant. The other is a small, open, shippable thing that people are actually buying. They are both true, and the small one is the one most builders can learn from. Open hardware turned out to be a business The reflexive assumption about open-source hardware is that you cannot make money on it, because anyone can copy the design. Hugging Face's robot is a live counterexample. The plans are open, the software stack is open through their LeRobot ecosystem, and it crossed a million in sales anyway. That is worth sitting with, because it means openness and revenue are not the opposites people assume. The reason it works is the same reason open-source software companies work. Most buyers do not want to source fifteen actuators, fabricate a chassis, and debug a sensor stack to save money on a robot that already exists and is affordable. They want the finished thing, they want it to work out of the box, and they are happy to pay the people who designed it. Openness is not the giveaway that kills the business. It is the trust and the ecosystem that make the business, because you can see exactly what you are buying, modify it, and build on a platform other people are also building on. Why this is the better story for builders The mega-funded humanoid companies are placing a bet only a handful of players can place: billions of dollars, years of runway, factories. That is a real path, and it is not your path or mine. The Hugging Face robot is the other path, and it is copyable. Small, open

2026-08-29 原文 →
AI 资讯

Why I separated live discovery from the AI chat box

Most AI workspaces start with the same useful primitive: a chat box. I kept one in AI Workstation because it is still the fastest interface for many research and writing tasks. But while using the product for day-to-day work, I found two questions that did not belong in a general chat flow: What current topic is worth researching today? Which open-source AI project is worth evaluating now? Both questions depend on live evidence. They also have different failure modes from ordinary drafting. A model can produce a fluent answer while using stale memory, mixing project identities, overlooking a license, or treating popularity as proof of quality. That led me to split AI Workstation into three layers: a general workspace, public discovery Radars, and installable Agent Skills. Layer 1: the workspace The main AI Workstation handles everyday knowledge work: questions, links, documents, images, drafting, proofreading, reusable templates, and exports. The point is not to hide every operation behind one large prompt. It is to keep routine work accessible while letting tasks that need current data move into a more explicit flow. Layer 2: public Radars for live discovery The first Radar is Global Topic Radar . It is designed for creators and editors who need current candidates rather than generic content ideas. It keeps the topic lane, freshness, market context, evidence state, and original sources visible. The second is Open-Source AI Radar . It is designed for developers and researchers comparing active AI projects. It presents dated rankings, categories, collections, and project cards with direct links to upstream repositories. Stars, forks, licenses, languages, and practical summaries are treated as research inputs. The important design choice is what the Radars do not claim: A topic score is not a prediction that a post will go viral. Project popularity is not a security audit or a quality guarantee. A generated summary does not replace the upstream repository or license t

2026-08-29 原文 →
AI 资讯

I built managed hosting for Hermes Agent so I could stop babysitting a VPS

The problem I run Hermes, an open-source agent with tools, memory, and cron built in. Before running my own managed service SaaS, I used various competitors to deploy on VPS. This method has a lot of downsides because you are often SSH'ing in and managing secrets directly in a .env file, which can leave you exposed if your box is compromised. It is also very cumbersome, especially for agencies to manage these "alway-on agents" for clients on VPS. Luckily, these are just hosting problems, so I built SEAOTTER to fix it for myself, and then realized other people probably have the same problem. * What it does * SEAOTTER is a managed control plane for Hermes Agent: Per-agent isolation - each agent runs in its own namespace with a gVisor sandbox, so one client's agent can't see or touch another's. Operate without SSH — pause, restart, restore, and read logs through an API instead of a terminal. MCP-native — talk to a hosted agent from Claude, Cursor, or Codex. Secrets handled for you — backed by Google Secret Manager instead of a .env file you have to remember exists. The rough idea POST /api/v1/agents or on "Create Agent", and it provisions a namespace, installs Hermes via Helm, brings up the sandbox, wires DNS/TLS, and gives you a reachable dashboard, typically in under five minutes. Who it's actually for Agencies running one isolated agent per client without spinning up a VPS per client Hermes power users who want lifecycle control (pause/restart/restore) without maintaining SSH access Hobbyists who want a standing assistant without becoming an ops person Try it There's a 14-day free trial on the Hobby plan. Worth being upfront: it currently asks for a card at checkout, which I know is friction — I'm working on a no-card way to try it. In the meantime, the docs walk through the API and dashboard in detail if you want to look before you sign up. What I'd love feedback on If you're currently self-hosting Hermes on a VPS: what would actually get you to switch, or keep you

2026-08-29 原文 →
AI 资讯

Debugging a Network Problem From Another Machine

One of the most useful questions in network troubleshooting is also one of the simplest: Does it fail from another machine too? If a website will not load on my laptop, trying it from another computer can immediately change the investigation. If it works there, the service probably is not down. Something about my machine, DNS configuration, VPN, firewall, route, or network path is different. If it fails there too, the problem may be farther upstream. I wanted Network Doctor to be able to ask that question directly. So I added remote diagnosis over SSH. netdoc --via ideapad github.com Instead of running the diagnosis locally, Network Doctor connects to ideapad , runs the checks there, and reports the result back on my machine. Why another vantage point matters A network failure is always observed from somewhere. Suppose github.com is unreachable from my workstation. I can test DNS: dig github.com Then TCP: nc -vz github.com 443 Then TLS: openssl s_client -connect github.com:443 Maybe I inspect my routes, VPN, proxy settings, or firewall. Those tests are useful, but they all share one property: they are observing the network from the same machine. Trying the same destination from another machine gives me a new piece of evidence. Imagine this: Thelio: DNS PASS TCP 443 FAIL Ideapad: DNS PASS TCP 443 PASS TLS PASS HTTPS PASS That difference is interesting. GitHub clearly is not universally unreachable. The second machine just reached it. Now I have a much smaller problem to investigate: what is different about the path from Thelio? That is often more useful than running another five commands on Thelio. Turning that into a command Network Doctor already runs network checks as a dependency graph. For an HTTPS target, for example, it can test things such as the local interface, DNS resolution, TCP connectivity, TLS, HTTP, routing, and path MTU. Normally: netdoc github.com means: Diagnose github.com from this machine. With --via : netdoc --via ideapad github.com it becomes:

2026-08-29 原文 →
AI 资讯

Stop Just Learning. Start Shipping: Welcome to SHEinnov8

If you are a woman in tech who is stuck in "tutorial hell," constantly taking courses but never actually deploying real software, this is for you. I am Mary Macharia, a Software Engineer specializing in Backend Development, AI/ML, and QA. I founded SHEinnov8 because I noticed a massive gap in our community: plenty of brilliant women have the drive to build something real, but they lack the space, the collaborative structure, or the network to actually push it across the finish line. We are changing that. What is SHEinnov8? SHEinnov8 is a decentralized digital guild built specifically for female developers, product designers, and tech creators. We operate on a simple framework: We learn by doing, we build together, and we do not stop until we ship a finished product. What We Are Currently Hacking On Right now, our guild is building an intensive AI Multilingual Project . We are engineering scalable backend infrastructures, orchestrating multi-language AI pipelines, and building deep automated QA suites to break the code and make it smarter. Why You Should Join the Guild Real Production Experience: Skip the basic todo-list apps. Work on raw, complex, collaborative codebases that you can proudly put on your resume. Founder Ecosystem: Meet fellow technical founders, bounce ideas off each other, and turn raw concepts into real tools. End-to-End Ownership: Learn what it actually takes to push code through CI/CD pipelines, configure metadata, handle security/QA audits, and go live. Let's Build Something Together! We are actively looking for software engineers, QA professionals, AI/ML enthusiasts, and designers who are ready to build, learn, and ship. Drop a comment below with your core tech stack, what you're passionate about building, or simply ask a question. Let's connect and get you plugged into the guild! Or check out our workspace directly at [sheinnov8.vercel.app]

2026-08-29 原文 →
AI 资讯

Product-Judgment Layer for AI Coding Agents

AI coding agents are getting very good at writing code. They can build components, create APIs, fix bugs, and implement features from short prompts. But I kept noticing one issue: Working code does not always mean a good product. For example, if you ask an agent: “Add a delete button to every project.” It may technically do exactly that. But will it also think about: confirmation before deletion error handling undo options accessibility clear feedback to the user Those are not just coding problems. They are product judgment problems. That led me to experiment with a reusable instruction layer for AI coding agents at AudranLab. The idea is simple: Instead of only asking an agent, “Can you build this?”, also encourage it to ask, “Is this a good way to build it?” I want agents to consider things like accessibility, failure states, destructive actions, usability, and sensible defaults while they work. This does not magically turn an AI into a product designer. But I think it raises an interesting question: Can explicit product principles consistently improve the quality of software generated by coding agents? That is what I’m currently exploring. My next step is to test the approach across different coding tasks and compare the results with and without the additional product-judgment layer. If you’re interested in AI agents, LLM reliability, developer tools, or applied AI, I’ll be sharing more experiments here. AudranLab: https://www.audrantechlab.online/

2026-08-29 原文 →
AI 资讯

How to run internal phishing simulations for your organization (free & self-hosted)

How to run internal phishing simulations for your organization (free & self-hosted) Phishing is still how most breaches start. The single most effective defence isn't another mail filter — it's people who can spot a lure and report it. The way you build that instinct is internal phishing simulations : controlled, authorized fake-phishing tests of your own employees, paired with training the moment someone slips. This is a practical guide to doing that well — and doing it for free, on your own infrastructure, with an open-source tool. First rule: authorization, always Internal phishing simulation means testing people who have agreed to be tested — your own organization, or a client with a signed engagement scope. Point a phishing tool at anyone outside that and you're very likely breaking the law. Keep a record of your authorization, tell leadership and (per your policy/works-council rules) employees that a program exists, and never use captured data for anything but the training exercise. Good tools are built as trainers , not credential-harvesters — for example, they don't store the passwords people type into a fake login page by default. With that ground rule set, here's what a real program looks like. A good program is a loop, not a single test "Who clicked?" is where most free tools stop. A program that actually reduces risk runs four stages: Attack — send a believable lure and track engagement per person. Report — make it one click for employees to report suspicious mail, and give them credit when they do. Train — the moment someone clicks or submits, teach them what they missed. Measure — roll it all up into a human-risk score you can trend over time. You can assemble this from separate tools, or use one platform. Below I'll use VoltPhish , an open-source, self-hosted platform that does the whole loop from one Docker container. (If you only need email click-tracking, GoPhish is the classic minimal option; commercial suites like KnowBe4 or Proofpoint do all of

2026-08-29 原文 →
下一页 →