今日已更新 302 条资讯 | 累计 37551 条内容
关于我们

标签：#rce

找到 2424 篇相关文章

开发者

gomarc: MARC21 for Go, 4x–11x faster than pymarc

If you work with library data, you work with MARC21 — the length-prefixed binary record format catalogues have run on since the 1960s, complete with a directory of field offsets, subfield delimiters, and a pre-Unicode character encoding called MARC-8 that needs a lookup table with thousands of entries to decode. In Python that problem is solved: pymarc is mature, complete, and pleasant to use. In Go it wasn't. gomarc is a port of pymarc to Go. It covers the binary MARC21 transmission format, MARC-8 to Unicode conversion, MARCXML, and MARC-in-JSON — and on real catalogue exports it runs 4x to 11x faster than the library it was ported from. go get github.com/beyto1974/gomarc@v0.1.0 It reads like pymarc If you know pymarc, you already know this API. Iterate records, pull the fields you want: reader := marc . NewReader ( f ) for { record , err := reader . Next () if errors . Is ( err , io . EOF ) { break } if err != nil { log . Println ( err ) // permissive: bad records are skipped, not fatal continue } title , _ := record . Title () fmt . Println ( title ) } Title , Author , ISBN , ISSN , Subjects , Publisher , PubYear and more are there as methods. For anything else, go at the tag and subfield directly: value , ok := record . Get ( "245" ) . Subfield ( "a" ) for _ , f := range record . GetFields ( "650" ) { fmt . Println ( f ) } Build records, modify them, write them back: record . Get ( "245" ) . SetSubfield ( "a" , "The Zombie Programmer : " ) writer := marc . NewWriter ( out ) writer . Write ( record ) And convert to the formats the rest of your stack can actually read — both use UTF-8 throughout instead of MARC-8, so standard tooling works: s , err := record . AsJSON () // MARC-in-JSON records , err := marc . ParseXML ( r ) // MARCXML Large MARCXML files stream one record at a time via marc.NewXMLReader rather than loading into memory. The numbers Two real catalogue exports — 138,076 records, 166 MB. AMD Ryzen 5 3600, Go 1.25.12, CPython 3.13.5, gomarc v0.1.0, pym

2026-08-12 原文 →
AI 资讯

992 Findings in SadCloud: What Compound Analysis Sees That Scanners Don't

✓ Human-authored analysis; AI used for formatting and proofreading. SadCloud is an open-source Terraform project by NCC Group that deploys misconfigured AWS resources. Security teams use it to test their tooling: if your scanner can't find the misconfigurations in SadCloud, it can't find them in production. We pointed Stave at SadCloud. Then at BishopFox's IAM Vulnerable. A lab focused on IAM privilege escalation paths. The numbers tell a story about what happens when you move from per-resource scanning to compound attack path analysis. The raw numbers Metric SadCloud (NCC Group) IAM Vulnerable (BishopFox) Assets evaluated 36 31 Atomic violations 992 837 Compound chains firing 84 instances (13 unique) 70 instances (6 unique) Near-miss chains 785 instances (40 unique) — A per-resource scanner (Prowler, ScoutSuite, Checkov) would show 992 findings for SadCloud. Each finding stands alone: this bucket is public, this role is overpermissioned, this trail isn't logging. The operator opens a dashboard with 992 items sorted by severity and starts scrolling. Stave's compound-only default output shows 84 findings across 13 named attack paths. Same underlying data. Different composition. The 992 atomic violations still evaluated. They're the detection infrastructure. The 84 compound chains are the findings that reach the operator. That's a 12x reduction by composition. Compound chains Each compound chain fires when multiple controls fail simultaneously on related assets, matching a named attack pattern: Chain Severity Instances What it means iam_escalation_undetected critical 36 IAM roles can escalate privileges and no detective control monitors the escalation path iam_boundary_governance_failure critical 36 No permission boundary constrains IAM principals in the account — any role can reach any resource iam_session_opacity high 2 IAM session activity isn't logged at the detail level needed to detect credential abuse s3_ssec_ransomware_path critical 1 S3 bucket is vulnerable t

2026-08-12 原文 →
AI 资讯

I built a local-first image checker for marketplace sellers

Marketplace sellers often discover image problems too late. A product photo may look fine in an editor, but after uploading it to a marketplace it can become: cropped in search thumbnails too small for zoom previews the wrong aspect ratio for a sales channel risky for Amazon-style main image requirements awkward when reused across Etsy, Amazon, TikTok Shop, Shopify, eBay, or Walmart I wanted a simple preflight step before publishing product images, so I built ListingPic : 👉 https://listingpic.com/ What it does ListingPic is a browser-based marketplace image checker and resizer. You upload a product photo, choose the marketplaces you care about, and get a readiness report covering things like: image dimensions aspect ratio file type file size thumbnail crop risk safe-area positioning marketplace-specific warnings The goal is not to replace manual review. It is to catch obvious image risks before sellers waste time uploading, previewing, deleting, resizing, and re-uploading. Why local-first? A lot of product photos are sensitive: unreleased SKUs private product photography branded assets client images images sellers do not want copied or stored elsewhere So ListingPic processes images locally in the browser. Your images are not uploaded to our server for analysis. That also makes the tool fast for quick checks: drop in an image, review the warnings, adjust before publishing. Current checkers The MVP includes marketplace-focused checks for: general marketplace readiness Etsy image checks Amazon product image checks TikTok Shop image checks There are also entry points for Shopify, eBay, and Walmart workflows. Example use case Imagine you have one product photo and want to reuse it across multiple channels. ListingPic can help answer: Is the image large enough? Will the product be cut off in thumbnails? Is the image close enough to square for a channel that prefers square previews? Is the product too close to the edge? Do I need a separate crop for Etsy or TikTok Shop? D

2026-08-12 原文 →
AI 资讯

Crystal in 2026: a 7 MB binary, zero dependencies, and five traps

I spent a few days writing a satellite ground station daemon in Crystal, with an empty dependency list and a hard rule against third-party code. It works, it ships as one file, and it sits at 1.9 MB of memory at rest. This is what the language was like to use, and what it cost. The project is kozai : it reads orbital elements, propagates them with SGP4/SDP4, predicts passes over a ground station, serves a JSON API and an offline web interface, and drives a rotator and a radio through hamlib. About 9,000 lines of source and 6,400 lines of specs, on Crystal 1.21.0. None of that matters here except as the load under which the language was tested — this is a report on the tool, not on the satellites. What the language actually delivers The headline claim of a compiled language with a garbage collector is that you get Ruby's ergonomics and a binary at the end. In 2026 that claim holds, and the numbers are the part worth quoting: Docker image, FROM scratch 7.41 MB Static binary, musl, arm64 6.9 MB Dynamic binary, release 1.9 MB Memory at rest, 2 satellites 1.9 MB Memory at rest, 97 satellites 4.3 MB Memory after a day of serving, 97 satellites 19.3 MB, flat Build steps before crystal build none Runtime files outside the binary none The last two rows are the ones that changed how the project was built. There is no Node in this repository, no bundler, no asset pipeline, and no postinstall . The web interface — HTML, CSS, JavaScript, and a 66 KB SVG of the world's coastlines — is read at compile time by {{ read_file(...) }} and lives inside the executable ( src/assets.cr ). Deploying is scp . The standard library covered the whole surface of a network daemon with six imports: http/server , http/client , json , log , socket , option_parser . That list is not an aspiration; CI fails if a seventh appears. The type system earned its keep in the numerical core. Predicting a week of passes for a hundred satellites is on the order of ten million propagator calls, and the hot loop a

2026-08-12 原文 →
AI 资讯

Writing Takes 40 Minutes, Publishing Takes 30 — How I Automated Multi-Platform Content Distribution

Writing Takes 40 Minutes, Publishing Takes 30 — How I Solved It Last Wednesday, 22:00. I just finished writing a tutorial on Python async programming — 2200 words, clean Markdown, syntax-highlighted code blocks. 22:03, open Juejin. Paste title. Paste content. Code highlighting gone. Fix manually. Pick tags. Publish. 22:08, open Zhihu. Paste title. Paste content. The Draft.js editor merged async def into asyncdef . Fix line by line. Publish. 22:15, open CSDN. Paste title. Content looks fine. But the category dropdown has 50 options and "Python" is buried. Publish. 22:20, open Cnblogs. Must add [Markdown] tag to categories or the whole article renders as garbled HTML. Publish. 22:25, open SegmentFault. Search tags for "Python async" — zero results. Type manually. Publish. 22:30, open Dev.to. Translate title. Translate content. Publish. Forty minutes to write. Thirty minutes to publish. 22:35, all done. But the next morning, I wanted to check stats — another round of logging into each platform's dashboard one by one. I'm Not Alone Searching forums and social platforms, I found many developers share this pain: "Every time I publish an article, I open 7-8 tabs, copy-paste 7-8 times, fix formatting 7-8 times. The joy of writing gets killed by the drudgery of publishing." "I usually only publish on one platform now. It's just too much work to do more. But then search engine exposure suffers." Why "Just Copy-Paste" Doesn't Work Each platform has a different editor: Platform Editor Markdown Handling Juejin Custom Markdown Good, but code highlighting sometimes breaks Zhihu Draft.js rich text No Markdown support, eats line breaks CSDN Dual-mode Mode switching corrupts formatting Cnblogs TinyMCE Must add [Markdown] tag or disaster SegmentFault Markdown Okay, but tag system is painful Dev.to Markdown Best experience, but English-only audience The same Markdown renders differently everywhere. Copy-paste doesn't solve it. What I Built I spent two weeks of evenings building PolyPos

2026-08-12 原文 →
AI 资讯

AGENTS.md vs CLAUDE.md: Where Agent Context Actually Lives

AGENTS.md vs CLAUDE.md: Where Agent Context Actually Lives If you have opened three different repos this month and found three different context files (AGENTS.md in one, CLAUDE.md in another, both in a third, out of sync), you are not imagining the mess. AGENTS.md is now an open, vendor neutral standard that most major coding agents read, but CLAUDE.md has not gone away, and knowing which file wins where saves you from an agent quietly following stale instructions. What AGENTS.md actually is AGENTS.md started as a proposal from Sourcegraph's Amp team to fix a specific problem: every coding agent invented its own context file, so teams ended up maintaining CLAUDE.md, .cursorrules, .windsurfrules, and whatever else, all describing the same project. OpenAI and Google backed the standard, and it has since moved under the Linux Foundation's Agentic AI Foundation. Guides tracking adoption report 28+ supporting tools and more than 60,000 open source repos containing the file (secondary source, treat the exact counts as approximate, not audited). The pitch is simple: one Markdown file, one format, every agent reads the same source of truth instead of you hand syncing five files that drift within a week. Which tools actually read it This is the part that matters when you are deciding whether to migrate. Tools with native AGENTS.md support include: GitHub Copilot coding agent Cursor Amp Factory RooCode Zed Warp Notice what is not confirmed on that list. Reports that Claude Code reads AGENTS.md natively circulate in comparison guides, but I could not verify this against Anthropic's own changelog, so I am stating it qualitatively here rather than as fact: treat it as unconfirmed until you see it in Anthropic's own docs, and keep CLAUDE.md in place as your safety net if you rely on Claude Code specifically. AGENTS.md vs CLAUDE.md vs the well known directory Three layers get conflated constantly, and they solve different problems. Layer What it is Scope AGENTS.md Vendor neutral p

2026-08-12 原文 →
AI 资讯

I built a free AB-620 hands-on lab for Copilot Studio

Certification prep often stops at notes and multiple-choice questions. Copilot Studio makes more sense once you actually build something. So I added a free AB-620 hands-on lab to Examplar. It covers creating an agent, writing clear instructions, testing in-scope and out-of-scope prompts, publishing it, and cleaning up afterwards. Each step includes something learners can check before moving on. The public Preview also has 25 original practice questions. No exam dumps. Examplar is my independent, open-source side project. The Preview and lab are free, and the page also links to optional paid packs. Try the free lab: https://examplar.app/exams/ab620/#labs-h Blunt feedback is welcome. Which hands-on scenario should I add next?

2026-08-12 原文 →
AI 资讯

The Guy Who Invented the Internet's Front Door and Refused to Charge Rent

Hello, I'm Maneshwar. I'm building git-lrc, a Micro AI code reviewer that runs on every commit. It is free and source-available on Github. Star git-lrc to help devs discover the project. Do give it a try and share your feedback. Okay so here's a fun one for you. Imagine you invent the thing that eventually becomes the substrate for Google, Facebook, Amazon, your bank, your ex's Instagram, and every cursed cookie consent banner known to man. Now imagine you had the legal right to charge a licensing fee for it. Like, a reasonable one. A cent per page load, say. You would never have to work again. Your great-great-grandchildren would never have to work again. You'd be sipping something expensive on a boat named after a HTTP status code. Tim Berners-Lee looked at that exact opportunity in 1993 and said, essentially, "nah, you guys keep it." This has been rattling around in my head for days, so let's talk about it properly, with all the nerdy details. The web almost lost to a gopher (literally) Berners-Lee built the World Wide Web in 1989 at CERN, laid out in a proposal called Information Management: A Proposal , mostly so physicists could stop emailing each other giant papers and just... link to things. Wild concept, I know. But here's the part people forget: the Web wasn't the obvious winner in the early 90s. It had a genuine rival called Gopher , built at the University of Minnesota, and for a while Gopher was winning. It was simpler, it was faster on the slow modems of the era, and it had a head start in adoption among universities and libraries. Then in February 1993, the University of Minnesota did something that, in hindsight, ranks among the great unforced errors in computing history: they announced they'd start charging licensing fees for commercial use of Gopher server software. Reasonable-sounding at the time (they needed to fund development), catastrophic in practice. The developer community, which had spent years contributing code for free on the assumption

2026-08-12 原文 →
AI 资讯

I Benchmarked Two Local LLMs on Real Dev Work — Qwopus 27B vs Muse Glimmer 30B

I Benchmarked Two Local LLMs on Real Dev Work — Qwopus 27B vs Muse Glimmer 30B Two open-weight models, one 20 GB GPU, two real development tasks, and a third model as the referee. Here is what actually happened when I made Qwopus 3.6 27B and Meta's Muse Glimmer 30B implement a bug fix and then a full feature in my own project. The setup Both models ran fully local on an AMD Radeon RX 7900 XT (20 GB VRAM) via a llama.cpp multi-model router (one OpenAI-compatible endpoint, GGUF models, load-mode=dio — more on why below). Each model was driven by the pi CLI in non-interactive mode with --thinking high . A third model — Codex, through a disciplined stdin wrapper — reviewed both outputs and gave the verdict. The fairness method was simple but strict: One task , described in a markdown spec, copied byte-identical into two isolated git clones of my project. Each model worked in its own clone, its own branch , never seeing the other's work. Objective verification by script: existing test suite + new tests + production build. Cross-review by Codex , examining both branches against the same criteria. The test project: Jeu de Cochons (a "Pass the Pigs" dice game, vanilla JS PWA on Vite + Vitest) — real code, real tests, no toy repo. Qwopus 3.6 27B Muse Glimmer 30B Source Community fine-tune of Qwen 3.6 Meta (distilled from Muse Spark) Size 27B 29.6B Quant IQ4_XS (~15 GB) UD-Q4_K_XL (~14.8 GB) Round 1 — fixing a regression (short task) The project had a broken PWA: a commit that added a /jeu-de-cochons/ base path for GitHub Pages had broken 3 service-worker tests (manifest, precache, offline navigation fallback). Task: fix the regression without touching the tests , keep the other 84 green. Qwopus Muse PWA tests (11) 11/11 ✅ 11/11 ✅ Full suite (87) 87/87 ✅ 87/87 ✅ Files touched 2 2 Diff size +4/−4 +4/−4 Wall time ~8.5 min ~21 min Leftover artifacts none one .bak file The remarkable result: both models produced a byte-identical diff. Same diagnosis (a lost capture group in the a

2026-08-11 原文 →
AI 资讯

What it took to move a collaborative browser IDE beyond process memory

The first collaboration model in CodeVerse was convincing in exactly the way a local demo needs to be convincing. Open two tabs. Join the same room. Type in one editor. Watch the other editor update. Then ask one unpleasant question: what happens when those two sockets land on different server instances? The answer was that the room stopped being a room. Each process had its own memory, its own presence list, and its own idea of the current files. A restart erased state. A reconnect could create a second identity. A load balancer could turn a working demo into two isolated conversations. This article is about the work that followed: moving CodeVerse from synchronized tabs to a collaboration path I could test across processes, recover after disconnects, and describe without pretending a local benchmark was a production capacity claim. The real boundary was not Socket.IO Socket.IO made connection handling and room fan-out approachable, but it did not decide where truth lived. That distinction matters. A room name inside one Socket.IO process is a routing convenience, not durable shared state. Once I wanted multiple application instances, I needed separate answers for four kinds of information: Document state — the convergent contents of every file. Room policy — organizer identity, edit permissions, active file, and revision. Presence — which sockets are here now, on which instance, with which effective role. Durability — what survives Redis expiry, application restarts, or a longer period of inactivity. CodeVerse now uses Yjs for convergent document updates, Redis for live distributed room state and pub/sub, and Supabase for durable room snapshots and membership data. Socket.IO remains the transport and fan-out layer. That separation was more important than any individual library choice. Redis does three different jobs It is easy to say “I added Redis” and leave the architecture vague. In CodeVerse, Redis has three explicit responsibilities. 1. Cross-instance fan-out

2026-08-11 原文 →
← 上一页 下一页 →