今日已更新 249 条资讯 | 累计 37498 条内容
关于我们

标签:#rce

找到 2409 篇相关文章

AI 资讯

Sandboxes That Cost Nothing

If you work with external APIs, you know the problem. There is no dev.github.com , no staging.api.companieshouse.gov.uk , no test endpoint for the thing you actually depend on. Production is the only source. So how do you get a development environment without re-fetching everything you already have? The usual answer is to copy: duplicate the warehouse, or keep a separate dev database and sync it periodically. Both are slow, both drift, and both cost storage in proportion to the number of people on the team. Interlace does something else. An environment is not a copy of your data, it is a set of views over it. Fingerprints first Every model gets a fingerprint: a hash of its canonical SQL — or its Python source — together with its strategy configuration and its upstream fingerprints. A build writes an immutable physical table named after that fingerprint. interlace__main.orders__a1b2c3 That table never changes. If the model's definition changes, the new version gets a new fingerprint and a new table, and the old one stays exactly where it is. An environment is then just a set of views pointing at fingerprinted tables. Production is the unprefixed namespace; every other environment prefixes its schema. Environment View for main.orders prod main.orders dev dev__main.orders pr-142 pr-142__main.orders Consumers and BI tools connect to main.orders and never learn that a fingerprint exists. There is no environment list to configure, either — an environment exists once something has been promoted to it. Why the sandbox is free Here is where the re-fetching problem disappears. Applying to a sandbox does not rebuild models whose fingerprint already exists. It points the sandbox's views at the tables production already built. interlace apply --env dev Change one model out of forty and the sandbox builds one model. The other thirty-nine are reused — not copied, reused, the same physical tables production is reading. The expensive source extract that ran this morning is the table

2026-08-15 原文 →
AI 资讯

You added an MCP server to your AI assistant. Did you check what it can touch?

You added an MCP server to your AI assistant. Did you check what it can touch? MCP servers give your AI assistant new abilities: read your filesystem, query your database, call an API, run a shell command. That is the whole point of them. It is also the whole point of the risk. The permission question nobody asks When you install a normal browser extension, you at least see a permission prompt. When you add an MCP server to your AI coding assistant, you usually do not. You add a config entry, restart, and the assistant now has whatever access that server exposes. Most people never read the server's source to see what that actually is. This matters more with AI-built or AI-suggested MCP servers specifically. If the assistant wrote the server for you, or you copied one from a repo you have not read closely, you have no independent confirmation of what it does versus what its description says it does. What tends to go wrong Three patterns show up repeatedly: A server meant to read files ends up with write access too, because the broader permission was easier to implement and nobody scoped it down. A server that talks to an external API embeds a credential directly in its config or source, so anyone who can read the server's files can read the key. A server built for local development gets pointed at a production database or production credentials once it "works," without a second look at what commands it now accepts. None of this requires anyone to be careless in an obvious way. It is the same gap as any fast-shipped code: the server works, so it ships, and the access-scoping step that would normally happen in review gets skipped because there was no review. A practical check before you trust an MCP server Before you add an MCP server to a live setup, or before you point an existing one at anything real: Read what the server can actually do, not just its stated purpose. Check the tool definitions it exposes, not the README. Check where its credentials live. A server th

2026-08-15 原文 →
AI 资讯

Magento 2 Inventory Reservation Performance: Fixing the Silent Checkout Killer

If you're running Magento 2 with MSI (Multi-Source Inventory) enabled — and since Magento 2.4 it's the default — you have a silent performance killer lurking in your database. The inventory_reservation table grows without bound, and every single cart operation hits it. This post walks through why this table becomes a bottleneck, how to measure the impact, and concrete steps to fix it. How Inventory Reservations Work When a customer adds a product to their cart, Magento doesn't immediately decrement stock. Instead, it creates a reservation — a record in inventory_reservation that says "this quantity is tentatively reserved for this order." The actual stock deduction happens later, when the order is placed and the shipment is processed. The flow looks like this: Add to cart → placeReservation writes a negative reservation record Place order → reservation is linked to the order Ship order → inventory_source_item is decremented, reservation should be compensated Compensation reservation → a positive record that cancels out the original negative one In theory, reservations are transient. They exist to bridge the gap between cart and shipment. In practice, they accumulate forever. The Problem: Unbounded Growth Here's what happens in production: Orders that are canceled leave orphaned negative reservations Orders that fail during checkout leave reservations that are never compensated Partial shipments create partial compensation records Quote conversions that error out mid-process leave dangling reservations Re-indexing, re-stocking, and admin edits can create duplicate records After 6–12 months of moderate traffic, the inventory_reservation table routinely hits several million rows . I've seen tables with 10M+ rows on stores doing 200 orders/day. SELECT COUNT ( * ) FROM inventory_reservation ; -- 4,872,341 rows on a store running 8 months SELECT COUNT ( * ) FROM inventory_reservation WHERE created_at < DATE_SUB ( NOW (), INTERVAL 30 DAY ); -- 4,710,882 — 96.7% of rows are

2026-08-15 原文 →
AI 资讯

Why We Parse Industrial Code Instead of Embedding It

Most of the industrial AI you have seen is a retrieval pipeline with a chat box on it. Chunk the manuals, embed them, stuff the top matches into a context window, let the model talk. It demos well. It falls apart the first time somebody asks a question where the answer depends on what a machine is doing right now. We are an applied research lab called Nodeblue, and the system we build is called Nexus. This is a writeup of the architectural decision at the center of it, which is that the language model is the smallest and least interesting part. The failure that set the design Here is the test that made the decision for us. Industrial control programs live in two places. There is the project archive, which is the file in source control, and there is the program actually running in the processor. Those drift, constantly, because engineers go online to fix a timer during a downtime event and do not always upload the change back. Anyone who has worked on a plant floor knows this. It is Tuesday. We took a real production controller with exactly that situation, a live edit present in the processor and absent from the archive, and asked eleven frontier models which version of the routine was executing. We gave them the export, the docs, the context, everything a careful human would get. All eleven answered confidently. All eleven were wrong. Not garbled, not obviously broken. They read the export correctly, described the rung correctly, and then told us the archived version was running, because the archived version was the only version they had ever seen. Then we put the same eleven models on top of our engine and asked again. All eleven got it right, cited to the rung. The models did not improve. They got access to a fact that lives in a processor rather than in a corpus. That is the entire lesson, and it generalizes past our domain: when a model is asked something it structurally cannot know, it does not abstain, it produces the most probable sentence. In a domain where

2026-08-15 原文 →
AI 资讯

Every WhatsApp chatbot framework is broken. Here's what I built instead.

I've evaluated every open-source WhatsApp bot framework on GitHub. They all share the same fatal flaw. The Problem Nobody Talks About Most WhatsApp bot frameworks are glorified API wrappers. They handle message transport — receiving a text, routing it somewhere, sending a reply — and that's it. The "intelligence" layer is left entirely to you. You get a pipe. You get a webhook. You get some session management. And then you're on your own. The frameworks that do add AI make a different mistake: they duct-tape GPT onto the messaging pipe and call it "AI-powered." The pattern is always the same: receive message → append to conversation history → call openai.chat.completions.create() → send reply. It's generic. It's stateless in any meaningful business sense. It doesn't know what industry it's serving, what data it has access to, or what actions it's actually allowed to take. Here's the part that breaks me: none of these frameworks understand that a restaurant needs different tools than a law firm . A restaurant needs to check table availability, query allergens, create reservations, and handle cancellations. A law firm needs to schedule consultations, check document status, route inquiries by practice area. These are not the same problem. Treating them as "just chat" is the core architectural failure of every framework I've seen. And then there's the "enterprise" tier: Twilio Flex, Intercom, Freshchat. These charge $500–$2,000/month for what is fundamentally a prompt and a webhook wrapped in a dashboard. They're selling you infrastructure and calling it intelligence. The underlying model doesn't know your business. It can't execute actions in your systems. It's an expensive illusion. What's Actually Needed The shift that matters isn't from "no AI" to "has AI." It's from generic chat to domain-specific function calling . This is not a subtle distinction. Here's what a properly architected tool dispatcher looks like versus what everyone else ships: // Each vertical gets

2026-08-15 原文 →
AI 资讯

Run Qwen 3.8 27B Locally: Real GGUF Sizes, the KV Cache Trick, and the Template Trap

Qwen 3.8 arrived as two different releases with two different licences, and only one of them is something you can put on a card you own. The 2.4 trillion parameter A95B opened up on 12 August under Alibaba's own qwen3.8-max terms. The one that matters for local work is Qwen 3.8 27B , whose safetensors went up on 13 August at 08:23 UTC with an Apache 2.0 LICENSE file following the next morning. Both dates are off the Hugging Face commit log, not a launch post. Here is the practical picture: what it needs, why its long context is unusually cheap, and the one setting that makes people think they downloaded a broken quant. The shape of the model decides everything 27B dense parameters across 64 layers, hidden size 5120. The interesting part is in config.json , where layer_types reads 48 linear attention layers and 16 full attention layers , alternating three to one ( full_attention_interval: 4 ). Only those 16 layers keep a KV cache. The rest of the shape: 24 attention heads with head_dim 256 and 4 KV heads , a 248,320 token vocabulary, and max_position_embeddings of 262,144 . It is a native vision language model, so images and video go in without a wrapper, and the ggml-org pack also ships a multi token prediction head as a separate file. The numbers Sizes below are the file sizes Hugging Face reports for unsloth/Qwen3.8-27B-GGUF , read on 14 August 2026. Packs differ by a few hundred megabytes, so check the repo you actually pull from. lmstudio-community has Q4_K_M at 16.8 GB and ggml-org at 19.0 GB for the same nominal quant. Quant Size on disk Realistic home UD-IQ2_XXS 9.0 GB 12 GB cards, visible quality cost UD-Q2_K_XL 10.7 GB 12 GB cards, almost no context left UD-Q3_K_XL 13.4 GB 16 GB cards Q3_K_M 13.8 GB 16 GB cards IQ4_XS 15.7 GB largest quant that stays whole on 16 GB Q4_K_M (sweet spot) 17.1 GB 24 GB cards Q5_K_M 19.8 GB 24 GB, less context headroom Q6_K 22.9 GB 24 GB barely, or 32 GB Q8_0 29.0 GB 32 GB or a two card split BF16 (from ggml-org ) 53.8 GB server

2026-08-15 原文 →
AI 资讯

Local LLM on a 16GB Mac Mini: Replacing GitHub Copilot with Ollama + Qwen

I kept paying a monthly subscription for a cloud coding assistant while a 16GB M4 Mac mini sat on my desk idling most of the day. So I ran the obvious experiment: can a 16GB Mac mini run a coding assistant entirely offline — no code leaving the machine, no subscription — and is it actually usable for real work? Short answer: yes, with one hard constraint (RAM) and one soft one (context length). This article is the written version of the video above, with every command, config file, and benchmark number so you can reproduce it. Table of contents Why bother running locally The hardware constraint nobody mentions Step 1: Install Ollama Step 2: Pick a model that fits in 16GB Step 3: Run and verify Step 4: Wire it into VS Code Step 5: Tune Ollama for a 16GB box Benchmarks What it does well, what it doesn't Should you cancel Copilot? Why bother running locally Three reasons, in the order that actually mattered to me: Privacy. Client code, internal repos, anything under NDA — none of it leaves the machine. This is the one thing a hosted assistant cannot offer you at any price tier. Cost. A coding assistant subscription is roughly $100–240/yr depending on tier. The Mac mini was already bought. Offline. Flights, bad hotel wifi, coffee shop dead zones. The assistant just works. The reason not to: raw capability. The frontier hosted models are better at large multi-file reasoning, and it isn't close. More on that below. The hardware constraint nobody mentions On Apple Silicon, the GPU and CPU share one pool of unified memory. A model has to fit in that pool alongside macOS, your browser, VS Code, and whatever containers you're running . On a 16GB machine, macOS + a normal dev environment eats 6–8GB before you've loaded anything. That leaves you roughly 7–9GB of realistic headroom for the model. This single number determines everything else, and it's why "just run the 30B model" advice from people on 64GB machines doesn't transfer. By default macOS allows the GPU to use about 7

2026-08-15 原文 →
AI 资讯

We wrote 25 Matrix bridges in 7 languages, and we did not get to choose

What happens when you stop picking a stack and let each protocol pick one for you. Every engineering team has a stack. Ours has seven, and we did not decide on any of them. Nevai is a self-hosted, end-to-end encrypted workspace built on Matrix. Part of it is a set of bridges — 25 of them — connecting Discord, Telegram, WhatsApp, Signal, iMessage, Messenger, Instagram, Slack, Google Chat, LINE, WeChat, KakaoTalk, Skype, GroupMe, SMS, email, IRC, XMPP, Zulip, Mattermost, Revolt, Mumble, QQ, X and LinkedIn into one place. We started out intending to standardise. We ended up with this: Language Bridges Go 12 TypeScript 5 Python 4 JavaScript 1 Kotlin 1 PLpgSQL 1 Slice 1 Nobody sat in a room and chose that distribution. It is what you get when the protocol decides. Go wins where the protocol was reverse-engineered WhatsApp, Signal, iMessage, Messenger, Instagram, Telegram, X, WeChat, QQ, Skype, LinkedIn, email. Twelve bridges, and the reason is the same every time: the mature libraries for those protocols are written in Go. That is not a claim about Go being a better language. It is a claim about where a decade of reverse-engineering effort happens to live. If you want to speak WhatsApp's protocol without running a browser session, you use what exists, and what exists is Go. Look at what leaks in around the edges and the picture gets sharper: Signal is 86% Go and 13% C — the C is libsignal, and you do not reimplement libsignal. iMessage is 96% Go and 3% Objective-C — because iMessage runs on macOS, and at some point you have to talk to the operating system in its own language. Those percentages are the honest part. A bridge is mostly your code and a small amount of somebody else's, and the small amount is usually the part that matters most. Python wins where the API is boring Google Chat, Zulip, KakaoTalk, LINE. Documented HTTP APIs, JSON in and JSON out, no protocol archaeology required. There is no performance argument here. These bridges are not throughput-bound; they

2026-08-15 原文 →
AI 资讯

Voice In. Words Out: The Free, 100% Offline Voice Typing App for Windows

Imagine this: You’re drafting a long email, writing a report, or responding to a wave of Slack messages. Instead of hunching over your keyboard and typing at 40 words per minute, you simply hold down Ctrl + Space , speak your thoughts at 150+ words per minute, and release the keys. Instantly, clean, perfectly punctuated, polished text appears right where your cursor is. Meet Vacanam — a free, 100% private, offline voice typing tool built for Windows 10 & 11. 😫 Why Most Voice Typing Tools Are Frustrating If you’ve ever tried built-in dictation tools or commercial transcription services, you’ve likely run into the same annoyances: They Send Your Voice to the Cloud : Many tools stream your microphone audio to remote servers. If you work with sensitive emails, client data, or private thoughts, that’s an immediate dealbreaker. They Require an Internet Connection : Try dictating on an airplane, during spotty Wi-Fi, or in a secure offline room — they simply refuse to work. Punctuation is a Headache : You have to awkwardly say things like "Hello comma how are you question mark" just to get a basic sentence right. Subscription Fatigue : Most good dictation apps charge $10 to $30 every single month. We built Vacanam (वचनम् — Sanskrit for Voice & Speech ) to fix all of this once and for all. 🌟 The Superpowers: What Makes Vacanam Different? 1. 🎙️ Works in Every Single Windows App Vacanam doesn’t trap you inside a special recording window. It works universally: Productivity & Docs : Microsoft Word, Google Docs, Notion, Obsidian, OneNote Communication : Slack, Microsoft Teams, WhatsApp Desktop, Discord, Outlook, Gmail Browsers & Editors : Chrome, Edge, Firefox, Notepad, VS Code, Terminals Just click into any text box, hold Ctrl + Space, speak, and let go. 2. 🪄 Automatic AI Polish (No More "Ums" or Missing Commas) When we talk, we hesitate, say "um" , repeat words, and forget punctuation. Vacanam features an optional Built-in AI Assistant that runs silently on your computer: Remov

2026-08-14 原文 →