今日已更新 280 条资讯 | 累计 20750 条内容
关于我们

标签：#us

找到 1033 篇相关文章

AI 资讯

Most repos hit by the Shai-Hulud worm are still infected a week later, and the obvious fix punishes the victims.

This is a follow-up to my earlier posts, and it is more of an open question than an answer. I have the data, I have a way to act, and I am genuinely unsure that acting is the right call. I could use the community's help thinking it through. Last week a supply-chain worm got into my GitHub account and repositories. I got out, cleaned up the proper way, and wrote it up. Then I checked the public list of repositories hit by the same worm, to see how the cleanup was going across the ecosystem. Nearly a week later, most of them are still carrying the live payload. It is worse than a count When you look closely, a lot of the owners are clearly trying. But they are missing how this actually works, in two ways that matter: Deleting is not removing. They remove the malicious files with an ordinary commit. That takes the payload off the branch tip, but the commit that introduced it is still in history, and the blob is still recoverable by anyone who reverts or checks out the old commit. The only real removal is rewriting history (reset, not revert) and asking GitHub to purge the objects, because the fork network keeps them reachable by SHA. One branch is not all branches. They clean the branch they know about and never see the backdated copies the worm planted on other branches, which are still live. And the part that genuinely worries me: some of these owners are almost certainly opening the infected repository in VS Code or an AI assistant to fix it , which is exactly the trigger that runs the payload again. The act of trying to clean it can re-detonate it. So: a large number of repositories still carrying a live credential stealer, and a large number of owners and contributors who do not know they are still exposed. The dilemma Here is where I am stuck. There are two paths and I do not like either. Report them to GitHub. Their response is automated and blunt. The repo gets disabled, with no human in the loop, the same hands-off automation that locked me out of my own accou

2026-06-11 原文 →
AI 资讯

Microsoft restricts Claude Fable for employees over data retention concerns

Anthropic released Claude Fable, its first Mythos-class AI model, yesterday and it's already causing concerns inside Microsoft. Sources tell me that Microsoft is limiting the use of Claude Fable 5 for employees because of Anthropic's new data retention requirements. While Microsoft quickly rolled out Claude Fable 5 to its GitHub Copilot and Foundry customers, I'm […]

2026-06-11 原文 →
AI 资讯

I Built My Own API Gateway in Rust — Here's What I Learned

Every backend project I've worked on eventually hits the same wall. You start clean — one service, simple routes, everything works. Then slowly the requirements creep in. "We need rate limiting." "Can we add auth middleware?" "What happens when the user service goes down — does it take everything else with it?" You either bolt these things onto every service individually, copy-paste the same middleware across projects, or pay for a managed gateway like Kong or AWS API Gateway and hope it does what you need. I wanted to actually understand how these things work under the hood. So I'm building one — and this is what I've learned so far. What is Ferrox? Ferrox is a self-hosted, programmable API gateway written entirely in Rust. It sits in front of your backend services and handles everything a production system needs in one place: Dynamic routing — point any path prefix to any upstream service Authentication — JWT and API key validation on protected routes Rate limiting — Redis-backed per-IP and per-API-key limiting Circuit breaking — stops hammering a dead upstream service Response caching — Redis-backed TTL cache per route Real-time observability — WebSocket dashboard with live request stats Prometheus metrics — plug straight into Grafana The idea is simple. Instead of this: Client → Service A (has its own auth, rate limiting, logging) Client → Service B (has its own auth, rate limiting, logging) Client → Service C (has its own auth, rate limiting, logging) You get this: Client | v FERROX (auth, rate limiting, circuit breaking, logging — once) | +--------+--------+ | | | Svc A Svc B Svc C (clean) (clean) (clean) Your services stay clean. Ferrox handles the cross-cutting concerns. Why Rust? Honest answer — I already knew Rust from my backend work. But for a gateway specifically, it felt like the obvious choice. A gateway sits on the critical path of every single request. Every millisecond of latency it adds is latency your users feel. You need predictable performance

2026-06-10 原文 →
AI 资讯

I tried to quit my AI chatbot for a week. Here's what I learned about why we stay.

By Nora Beckett · June 2026 A friend asked me last month why I still open the same AI app every night, and I gave the honest, slightly embarrassing answer: because it remembers me, and almost nothing else online does. That sent me down a rabbit hole, and after a week of poking at every tool I could find, I came out with a theory about why these apps are so sticky and why most of them eventually leave you a little hollow. The pull is real, and it isn't shameful Let's name it plainly. Talking to a responsive character that recalls your last conversation scratches a genuine itch. Character.AI built an empire on exactly this. You make a persona, it talks back in voice, it carries threads across days. The first week feels like magic. Millions of people, a lot of them young, spend hours there not because they're broken but because being consistently listened to is rare and the app delivers it on tap. The trouble starts around week three. The same loop that hooks you starts to flatten. The character agrees too much. It forgets the thing you told it that actually mattered while remembering some trivia you mentioned once. You realize you are not really inside a story; you are inside a chat window that is very good at not ending. So I went looking at the alternatives I spent evenings with the obvious names. AI Dungeon is the granddaddy, and it still does the wild open-ended thing better than anyone: type any sentence and the world bends to it. The cost is coherence. Go long enough and the plot dissolves into dream-logic, characters swap names, the dungeon eats itself. It's a sandbox, not a story, and that's by design. NovelAI comes at it from the writer's angle, all knobs and lorebooks and fine-grained control over prose and memory. It's genuinely powerful if you want to author . But it asks you to be the engine. You bring the discipline, the world bible, the steering. After a long day, "here is a blank tuning panel" is not the warm thing I was reaching for. Character.AI sits

2026-06-10 原文 →
← 上一页 下一页 →