今日已更新 84 条资讯 | 累计 37635 条内容
关于我们

标签：#rce

找到 2427 篇相关文章

AI 资讯

I made stale coding-agent context fail CI instead of failing silently

A coding agent with no context usually hesitates, searches, or asks a question. A coding agent with stale context can be much more confident. That is the dangerous case. The file still exists. The instructions look deliberate. The generated JSON is valid. The agent follows it exactly — into a package that stopped owning the feature two weeks ago. Nothing looks broken until the edit is already in the wrong place. I wanted repository context to have an expiration signal that CI could verify, not a date someone had to remember to check. The failure is not missing documentation Imagine a monorepo where packages/auth owns token validation. The repository publishes a machine-readable handoff: { "startHere" : "docs/for-agents/packages/auth.md" , "editRoots" : [ "packages/auth" ], "checks" : [ "pnpm --filter @example/auth test" ] } Later, token validation moves to packages/security . A maintainer updates the source documentation but forgets to regenerate the handoff index. There are now two internally consistent answers in the same repository: the source documentation says packages/security ; the generated agent context still says packages/auth . The old answer is not malformed. That is precisely why it is risky. I reproduced the drift with one edit I tested this against the public fixture in Doc Bridge , using version 1.2.6. The first index and freshness check passed: Index is fresh expected: 359355e5... actual: 359355e5... Then I changed one agent-facing source document: - Package: packages/os-core - Layer: L1 + +Token validation now belongs to packages/security. I did not touch the generated index. The next check returned exit code 1: ak-docs gate run index-freshness Index is stale. Run: ak-docs index expected: b099695d... actual: 359355e5... After I ran ak-docs index , reviewed the generated change, and ran the gate again, both hashes matched and the check passed. The hashes are not trying to prove that the documentation is true. No checksum can do that. They prove a na

2026-08-06 原文 →
开发者

Un dev loop tipo Vite para un lenguaje compilado: hot reload + preservación de state + manifest en vivo

Parte 13 de la serie Fitz . Se abre el capítulo del frontend: Fitz compila componentes .fitzv a WebAssembly, y este es el dev loop que hace que editarlos se sienta instantáneo — la misma experiencia "guardar y verlo" que te da Vite, sobre un lenguaje que compila a binario nativo. El setup: un lenguaje compilado con frontend Fitz es un lenguaje compilado — HTTP, async, Postgres, JWT viven en la sintaxis y emite un binario nativo vía Rust. La historia del frontend es un formato de componentes single-file, .fitzv (state + events + <template> , al estilo Vue/Svelte), que compila a WebAssembly : fitz build --bin web --target wasm-client # → target/wasm/web/{web.js, web_bg.wasm} Sin npm install , sin config de bundler, sin framework externo — el componente se vuelve un bundle WASM autocontenido (el demo del contador pesa 11.4 KB gzipped). Acá viene la objeción refleja: compilado = feedback lento . Editás, esperás una compilación entera, refrescás el browser a mano. Es lo opuesto a lo que un loop de frontend debería sentirse. Por eso Fitz tiene fitz dev . El loop Apuntá fitz dev a un bin wasm-client y deja de ser un compilador para ser un dev server: fitz dev # sirve en http://127.0.0.1:1234/ Qué hace: Rebuild incremental con wasm-pack --dev (sin wasm-opt ), reusando un crate estable así la cache de cargo queda caliente — el primer build compila las deps, cada save siguiente es de ~1-2 segundos . Un dev server que sirve el root de tu proyecto como python -m http.server : tu index.html , tu CSS, el bundle en target/wasm/<bin>/ . ¿Sin index.html ? Genera uno mínimo en el punto de mount . Auto-refresh del browser por WebSocket : guardás un .fitzv / .fitz / fitz.toml y la página se recarga sola. Sin F5 a mano. Guardás, y ~2 segundos después el browser muestra el cambio. En un lenguaje compilado. El detalle que importa: el state sobrevive el reload La mayoría de los hot-reload pierden tu estado en un reload completo — ibas tres clicks adentro de un contador, editás el template,

2026-08-06 原文 →
AI 资讯

Your first Fitz LiveViews component, twice: SSR and WASM from one source

TL;DR — A Fitz LiveViews component is a single .fitzv file. The interesting part: the same file compiles to two different targets with no rewrite. Server-rendered (SSR) — the server holds the state, renders HTML, and patches the browser over a WebSocket; best for shared, DB-driven, multi-user state. Client-WASM — the same component compiles to WebAssembly and runs entirely in the browser; best for offline, zero-round-trip widgets. This post builds a counter and ships it both ways. (Part 2 of the FitzLiveViews series — start here if you missed part 1.) In part 1 I made the pitch: real-time UI in one language, no JavaScript build. Now let's build something and ship it two ways from the same source. The component Here's a counter as a single-file component ( .fitzv ) — state, events, template, style: component Counter { state { count: Int = 0 } event increment() { count = count + 1 } event decrement() { count = count - 1 } event reset() { count = 0 } <template> <div id= "counter-app" > <p> Count: {count} </p> <button @ click= "increment" > +1 </button> <button @ click= "decrement" > -1 </button> <button @ click= "reset" > Reset </button> </div> </template> <style scoped > #counter-app { padding : 1.5rem ; font-family : system-ui ; } button { padding : 0.5rem 1rem ; margin : 0 0.25rem ; } </style> } state is the reactive data. Each event handler mutates it directly — no setState , no reducers. <template> is real markup; {count} interpolates and auto-escapes. @click="increment" binds a DOM event to a handler. <style scoped> is CSS namespaced to this component. If you've written Vue or Svelte, this is familiar — the difference is what happens next. Target 1 — server-rendered (over a WebSocket) The SSR target is the default. The component runs on the server; a tiny main.fitz wires it into an HTTP route (first paint) and a WebSocket route (the live layer): from fitz_liveviews import html_response , live_layout , LiveFrame , diff_html , component , dispatch_component_events

2026-08-06 原文 →
AI 资讯

Generate your entire Laravel CRUD stack with one Artisan command

TL;DR — composer require bouda/laravel-make-pattern → php artisan make:pattern Post → 9 consistent files in seconds. DDD-ready, rollback included, every stub is yours to override. The problem I kept running into Every new Laravel project starts the same way. You know the architecture you want: Repository, Service, Controller, some Form Requests, a Resource, a Policy, a test. You've written this stack dozens of times. And every time, you either: Copy-paste from a previous project — and immediately introduce inconsistency between how PostRepository is structured vs CategoryRepository . Write everything from scratch — which is slow and error-prone. Use make:model -a — which gives you the Model, Migration, Factory, Controller, but nothing about repositories, services, or policies wired together. None of these feel like the right answer when you want a clean, layered architecture. So I built laravel-make-pattern . What it does One command: php artisan make:pattern Post Generates 9 files : app/Models/Post.php app/Repositories/Contracts/PostRepositoryInterface.php app/Repositories/PostRepository.php app/Services/PostService.php app/Http/Controllers/PostController.php app/Http/Requests/PostStoreRequest.php app/Http/Requests/PostUpdateRequest.php app/Http/Resources/PostResource.php app/Policies/PostPolicy.php tests/Feature/PostTest.php All consistently named, all using the same conventions, all generated from stubs you own and can override . The generated code Here's what the repository looks like out of the box: <?php namespace App\Repositories ; use App\Models\Post ; use App\Repositories\Contracts\PostRepositoryInterface ; class PostRepository implements PostRepositoryInterface { public function all () { return Post :: all (); } public function find ( string $id ) { return Post :: findOrFail ( $id ); } public function create ( array $data ) { return Post :: create ( $data ); } public function update ( string $id , array $data ) { $model = $this -> find ( $id ); $model -> u

2026-08-06 原文 →
AI 资讯

Sentry Alternatives: When Error Tracking Bills Grow Faster Than Your User Base

If your Sentry bill is climbing faster than your signups, the usual cause isn't more users — it's more events per user . Error trackers meter on event and transaction volume, and a single bad deploy, a noisy third-party SDK, or one uncaught exception in a hot loop can burn a monthly quota in an afternoon. Before you migrate, the honest first move is to fix what you're sending. If you've already done that and the economics still don't work, GlitchTip, self-hosted Sentry, Bugsnag, Rollbar, and an OpenTelemetry-based stack are the realistic exits — each with a different trade. Why does the bill scale with events instead of users? Error tracking is priced on the thing that's expensive to store and index: individual events. Sentry, Rollbar, Bugsnag, and most SaaS competitors bill primarily on captured errors (and, increasingly, performance/tracing spans and session replays as separate meters). A product with 500 daily active users can generate millions of events if one component throws in a render loop or a retry storm hammers a failing endpoint. That decoupling is the whole problem. Your revenue tracks users; your observability bill tracks failures and instrumentation depth . When you add performance monitoring and session replay — both of which emit far more events than plain error capture — the meters multiply independently of how many humans are actually using the app. The takeaway: before you evaluate a single alternative, confirm whether you have a pricing problem or a volume-hygiene problem, because migrating won't fix a firehose. Can you cut the bill without switching tools? Often, yes — and it's worth an afternoon before any migration. The levers that matter most: Sample transactions, not just errors. Performance/tracing volume is usually the bigger line item once enabled. A tracesSampleRate of 0.1 or lower is fine for most apps; you rarely need every transaction. Filter noise at the SDK, before it's billed. ignoreErrors , denyUrls , and beforeSend let you drop

2026-08-06 原文 →
AI 资讯

Kimi K3 is the largest open-weight model ever released — and you probably still can't run it

Originally published in Spanish on El Rack. Browser translation handles the rest of the site fine if you're into homelab/self-hosting content. Moonshot AI released Kimi K3 on July 17, 2026, and made the weights publicly downloadable on July 27. At 2.8 trillion parameters, it's the largest open-weight model ever published — and according to multiple benchmarks, it rivals Claude Opus and GPT on coding, reasoning, and general knowledge work, at a fraction of the training cost. The New York Times ran an in-depth piece on it a few days after release, which tells you this isn't just another model drop. What "open weights" actually gets you here Publicly downloadable weights mean any company or researcher can run this locally and modify it without depending on a third-party API. If you already run Ollama or LM Studio in your homelab, that's the tempting part: a frontier-level model, no monthly quota, running on your own hardware. The practical reality is different. "2.8 trillion parameters isn't a number that runs on homelab hardware — it needs an enterprise-grade GPU cluster. The weight release is real, but "downloadable" and "runnable" are very different things at this scale." The bigger debate this reopened What makes Kimi K3 interesting isn't just the benchmark numbers — it's what it represents in the ongoing dispute over AI's geopolitics. The same fracture that opened up around DeepSeek-R1 in January 2025 is back: some argue US labs need to close up more in response to Chinese competition, others see openness as the only real way to stay relevant against an ecosystem that ships open weights at a pace closed labs can't match on transparency. There's also a real technical concern underneath: the possibility that outside actors use massive querying of closed American models to distill their outputs and train competing open models. Where this actually matters for a homelab Even though K3 itself is unrunnable on consumer hardware, its release pushes down what smaller, actu

2026-08-06 原文 →
AI 资讯

Nylo: Building a Privacy-Minimized Analytics Layer Across Domains You Control

Most organizations do not operate a single website. A typical customer journey might move through: company.com ↓ docs.company.com ↓ company-academy.com ↓ company-checkout.com These properties may belong to the same organization, but browsers and analytics systems can treat each domain as a separate visitor and session. Cross-domain measurement is possible with major analytics platforms, but it normally ties the implementation to a specific vendor, transfers an existing measurement identifier through the destination URL, or depends on users authenticating. I built Nylo to explore another approach: Preserve pseudonymous continuity across domains an organization controls, without browser fingerprinting, third-party cookies, or requiring the visitor to log in. Nylo is not intended to identify a person. It is intended to answer a narrower question: Did the same pseudonymous browser journey continue from one authorized domain to another? What Nylo is Nylo consists of: A zero-dependency JavaScript client SDK A server-side event ingestion interface A pseudonymous identifier called a WaiTag A short-lived cross-domain token exchange DNS-based verification of participating domains Configurable event collection Storage adapters for different backend systems The core analytics SDK is available under the MIT License. Production commercial use of the cross-domain WTX-1 functionality uses a separate commercial license. Nylo is designed to function as an analytics collection and continuity layer. It can eventually send events to an existing warehouse or analytics platform rather than requiring organizations to replace their reporting stack. How continuity works Consider a visitor moving between two independently registered domains: Visitor opens site-a.com | v Nylo creates a pseudonymous WaiTag | v Visitor follows an authorized link | v A short-lived token is transferred | v site-b.com verifies the token | v Both events reference the same pseudonymous journey Before enabling cross-d

2026-08-06 原文 →
AI 资讯

I built an open-source audit trail for AI agents (after mine silently failed for hours)

The problem I was running a multi-agent pipeline and one of my agents silently failed. The only alert I got said "daily loss limit reached" — completely misleading. The real cause was a missing file the agent never reported. I had zero visibility into what any agent had actually done. What I built AgentLens — a Python SDK for AI agent governance. Three modules: Audit trail — every LLM call and tool use logged to SQLite automatically Authorization — policy-based gates so agents can only call what you've approved Anomaly detection — baseline + threshold config, alerts when behavior drifts One-line integration Drop-in for Anthropic: python from agentlens.integrations.anthropic import TracedAnthropic client = TracedAnthropic(agent_id="my-agent") response = client.messages.create(...) # auto-traced

2026-08-06 原文 →
AI 资讯

Add tags and categories to any model with Laraterms

Sometimes you need tags on a model. The usual answer is a tags table, a pivot, a slug and a belongsToMany , and you write it again in the next project with slightly different columns. Laraterms replaces that with a config entry and a trait, and it comes with the parts you normally bolt on later: hierarchy, per-tenant isolation and translations. This is the simple path first, then the two features you reach for next. How to install One package, its config and two migrations. composer require edulazaro/laraterms php artisan vendor:publish --tag = laraterms-config php artisan vendor:publish --tag = laraterms-migrations php artisan migrate Step 1: define a taxonomy A taxonomy is a kind of label, declared in config/laraterms.php . Start with a flat tags taxonomy; the file already ships one you can keep. 'taxonomies' => [ 'tags' => [ 'hierarchical' => false , 'max_terms_per_model' => null , 'scope' => 'tenant' , ], ], Step 2: tag a model Add the HasTerms trait and the model can hold terms. Attaching is find-or-create: pass a label, and the term is created the first time and reused afterwards. use EduLazaro\Laraterms\Concerns\HasTerms ; class Post extends Model { use HasTerms ; } $post -> attachTerm ( 'Laravel' , 'tags' ); $post -> attachTerms ([ 'Laravel' , 'PHP' ], 'tags' ); $post -> syncTerms ([ 'Laravel' , 'Vue' ], 'tags' ); // replace the tag set $post -> termsIn ( 'tags' ); // read them back Filtering by tag is a query scope, so it composes with the rest of your query. Post :: whereHasTerm ( 'laravel' , 'tags' ) -> get (); Post :: whereHasAllTerms ([ 'laravel' , 'tutorial' ], 'tags' ) -> get (); Hierarchical categories Set hierarchical => true on a taxonomy and its terms form a tree. Read the whole tree in one query, and walk a term's ancestry. 'categories' => [ 'hierarchical' => true , 'max_terms_per_model' => 1 , 'scope' => 'tenant' , ], use EduLazaro\Laraterms\Support\TermTree ; $tree = TermTree :: for ( 'categories' ); // roots with children, one query $term -> b

2026-08-06 原文 →
← 上一页 下一页 →