标签：#war

Why “it encrypts” doesn't equate to “it’s secure” If you want to find a tutorial for encrypting files in code, your search results will provide dozens of tutorials. Most of these tutorials will produce code that, on the surface, performs encryption. Users can provide plaintext, receive ciphertext, and the code also performs decryption. Unfortunately, the phrase “the output looks scrambled” is an unsecure way to test a program for security. These tutorials fail to incorporate security practices, which will result in these tools being rejected in real life security assessments. By identifying these mistakes, we can reason about the validity of these encryption schemes. This article covers the correct way to build a file encryption tool and the mistakes that beginner encryption tools include. These mistakes will help you learn the correct way to build an encryption tool. SecureVault (Node.js, packaged with no dependencies) is a command-line tool that is referenced throughout to help provide context to the design decisions that were made for this tool. Prerequisite mindset: When designing secure systems, always assume that the attacker knows more than you. Do you really think that your adversary will only submit the inputs you assumed they would submit? They will submit corrupted inputs, they will submit old ciphertexts, and they will do anything you thought was impossible. You need to have a secure design. You must think "what malicious inputs can I handle here?" . The goal: three guarantees, not one Before you even think about writing code, you need to know exactly what you mean by that something is secure. A good file encryption tool must provide three guarantees. Most of the tutorials that I have seen think only about the first one. Confidentiality - the attacker that steals the file should not be able to read the file. Integrity - If the attacker alters the encrypted file, you will know. Authenticity - The file can only be generated by a user that knows the passwor

A new software update builds on WhatsApp’s group chat chops by adding anonymous polls and introducing an easier way to start a smaller private chat away from the larger group.

GitHub consolidated the npm and Actions changes it shipped from March to July 2026 against supply chain attacks, several of which alter defaults rather than add options. Hacker News discussion focused less on the individual controls than on whether waiting periods are the right instrument, or a substitute for author-side package signing. By Steef-Jan Wiggers

Klikk her: LLM Price Watch started as a simple problem: comparing per-token pricing across Claude, GPT, Gemini, DeepSeek, and Grok meant opening five pricing pages and doing the math by hand every time a new model dropped. So I built a calculator. Then I built an API behind it. Then I noticed something about who was actually going to call that API. The obvious version The first version of the API was exactly what you'd expect: GET /v1/models — every tracked model with current pricing GET /v1/models/:id — a single model GET /v1/calculate?model=X&input_tokens=N&output_tokens=N — cost for a specific call Straightforward. A human developer hits /calculate , gets a number, builds their cost estimate into a dashboard somewhere. Done. The part that changed the design The actual differentiator turned out to be a fourth endpoint: GET /v1/recommend?use_case=X . Instead of just returning prices, it returns a recommendation — which model fits a given use case (long-document summarization, high-volume classification, coding assistance, customer support) based on both price and the editorial analysis already written for the comparison pages on the site. Once that endpoint existed, the actual audience for this API stopped being "a developer building a cost dashboard" and started including something else: AI agents doing their own tool selection at runtime. An agent framework deciding which model to route a task to doesn't want to read a blog post — it wants a structured answer to "given this use case, what should I use, and what will it cost me." That's a tool call, not a page view. That reframing changed a few concrete decisions: CORS is wide open on purpose. This isn't an API with a dashboard in front of it — it's meant to be called directly from wherever the calling code lives, including client-side agent code. No API key required (for now). Every bit of friction between "an agent wants this data" and "an agent gets this data" is friction against the actual use case. A paid tie

So far in this mini-series, we've answered the biggest questions that confuse developers when they first encounter Design Patterns. We've learned: why SOLID isn't the final destination, why recurring design problems exist, why copying code doesn't create good design, what Design Patterns really are, how experienced engineers recognize them, and how every pattern can be understood through its Problem, Intent, Solution, and Consequences . Now it's time to answer one final question before we begin exploring the individual patterns. How should we learn Design Patterns so that we can actually use them in real-world software instead of just recognizing their names? The answer may surprise you. We're not going to learn Design Patterns the way they're usually taught. The Traditional Way of Learning Design Patterns Open almost any Design Patterns book or tutorial, and you'll often see something like this. Pattern Name ↓ Definition ↓ UML Diagram ↓ Code Example ↓ Advantages ↓ Disadvantages Technically, there's nothing wrong with this approach. But many developers finish reading the chapter and still wonder: "When would I ever use this?" That's because they learned the solution before understanding the problem. It's like learning how to use a fire extinguisher before understanding what kinds of fires it can safely put out. Knowledge without context is difficult to apply. The Way Experienced Engineers Learn Experienced engineers don't begin with the pattern. They begin with the software. They observe where the current design starts struggling. Only then do they search for a better design approach. Their thinking looks more like this. Business Requirement ↓ Design Challenge ↓ Current Design Starts Breaking ↓ Understand Why ↓ Explore Better Design ↓ Recognize a Design Pattern The pattern is never the starting point. It's the result of understanding the problem. The Learning Framework We'll Use Every pattern in this series will follow exactly the same structure. Business Problem ↓

Building a personalization engine for a multi-format content feed, without machine learning, and the testing process that forced us to rebuild it. TL;DR We run a collaborative cultural curation platform (think: user-submitted recommendations for movies, books, games, music, and long-form posts, all mixed into one feed) on a fairly ordinary PHP + MySQL stack. Over about a year we went through two full generations of the feed ranking algorithm. The first version solved the obvious problem (stop being purely chronological) but quietly failed at real personalization. The second version fixed that by rethinking what "user taste" even means, moving scoring out of SQL and into application code, and adding a layer of post-ranking business rules. This post walks through both generations, why the second one had to happen, and how we actually tested and calibrated a feed ranking system without a data science team or an ML pipeline. No exact weights, table names, or formulas below — just the engineering story. The starting problem: one feed, five content shapes Before personalization is even on the table, a multi-format feed has a normalization problem. Movies, books, games, music, and editorial posts live in different tables, with different columns, different publishing cadences, and engagement numbers on completely different scales. "1,000 likes" on a music post and "1,000 likes" on a book review are not the same signal. So the very first architectural decision — before any ranking logic existed — was building a unification layer that maps every content type into a shared shape (type, author, title, cover, category, engagement counters, timestamp) before any scoring happens. Everything downstream depends on that layer being consistent. Generation 1: a weighted ranker living inside a single SQL query The first real version of the algorithm — internally we called it the hybrid model — had a modest goal: get away from a purely chronological feed without building anything resembl

The Movinkpad 11 a versatile little graphics tablet that can help make your wildest digital art dreams come true.

19 new maps continue the story from MachineGames' other campaign additions.

The EU AI Act's Article 50 transparency rules went enforceable on August 2, 2026. If you ship a generative AI feature that touches EU users, you now owe the regulator a machine readable marking on your output. The obvious shortcut, drop a C2PA manifest and call it done, does not survive contact with production. Here is what actually works, with the code to make it real. The Two Layer Reality Article 50(2) requires effective, interoperable, robust, and reliable marking. The EU Code of Practice interprets that as at least two layers: signed metadata (C2PA) plus imperceptible watermarking (SynthID or equivalent). Fingerprinting is optional layer three. The reason for two layers is not bureaucratic. It is a screenshot. C2PA lives in a JUMBF metadata box. X strips it on upload. CDNs strip it during optimization. Screenshots destroy it entirely. Microsoft admitted this openly in its February 2026 Media Integrity report: preventing every attack on provenance is not possible. Invisible watermarks embedded in the pixel content survive those operations but carry very little information. You need both. Generating a Signed C2PA Manifest (Node) // npm install c2pa-node import { createC2pa , ManifestBuilder } from ' c2pa-node ' ; import { readFile , writeFile } from ' node:fs/promises ' ; const c2pa = createC2pa (); async function signGeneratedImage ( inputPath , outputPath , generationMeta ) { const asset = { buffer : await readFile ( inputPath ), mimeType : ' image/jpeg ' }; const manifest = new ManifestBuilder ({ claim_generator : ' firesafe/1.0 ' , format : ' image/jpeg ' , title : ' ai-generated-image.jpg ' , assertions : [ { label : ' c2pa.actions ' , data : { actions : [{ action : ' c2pa.created ' , digitalSourceType : ' http://cv.iptc.org/newscodes/digitalsourcetype/trainedAlgorithmicMedia ' , softwareAgent : generationMeta . modelName , }], }, }, { label : ' com.firesafe.generation ' , data : { model : generationMeta . modelName , modelVersion : generationMeta . modelVer

If you are building anything that touches European business data — onboarding, invoicing, KYB, fraud checks — you will eventually ask the same question I did: which countries can I actually get company data from, for free, without an account? I could not find this written down anywhere, so I worked it out the hard way while building a supplier checker. Here it is. The baseline: VIES The European Commission runs VIES , which validates VAT numbers across all 27 member states plus Northern Ireland ( XI ). It is free, it needs no key, and it is the obvious starting point. Two things about it are worth knowing before you build on it. It answers one question: is this VAT number currently registered. It does not tell you the company is solvent, trading, or that it has not been struck off. A company in liquidation keeps a cleanly resolving VAT number for months, because deregistration and insolvency are run by different authorities on different timetables. Name and address are returned for 25 of the 28 jurisdictions, not all of them. Germany and Spain confirm registration but publish no company name through VIES. I tested three valid numbers for each before accepting that. For those two, a yes/no is genuinely all you can honestly show. Where you can go further, free Ten countries publish enough through a national register to add something meaningful on top of VIES: Country Free register Reports company state Reports VAT-active Romania yes yes yes Poland yes — yes Slovenia yes — yes Estonia yes yes — France yes yes — Greece yes yes — Bulgaria yes yes — Latvia yes yes — Czechia yes — — Finland yes — — Company state means the register tells you whether a business is inactive, in liquidation, bankrupt, insolvent, terminated or struck off. This is the valuable column, and only six countries have it. VAT-active matters more than it sounds. VIES cannot distinguish "this is a real company that is not VAT-registered" from "this number belongs to nobody". Three registers can. Note th

1. Language Architecture in Ghidra When Ghidra loads an architecture (such as the MOS 6502), it parses the .ldefs manifest file, which declares metadata and binds three foundational specification pillars: The .pspec (Processor Specification): Defines the processor’s hardware context. It declares special-purpose registers (e.g., stack pointer SP , status/flags registers), default memory maps (RAM, ROM, I/O), and hardware interrupt vectors. The .cspec (Compiler Specification): Defines the ABI and calling conventions (e.g., parameter passing mechanisms), stack alignment rules, and return value handling. This is the critical building block enabling the decompiler to reconstruct assembly into readable C code. The .sla / .slaspec (SLEIGH Specification): .slaspec : The human-readable source file describing the instruction set architecture (opcodes, instruction formats, and p-code semantics). .sinc (SLEIGH Include): Modular inclusion files (typically used to split complex architectures like ARM or x86, or isolate instruction subsets like Thumb). Given the simplicity of the 6502, everything is defined directly within the .slaspec file. .sla : The compiled binary version of the .slaspec (generated by the Sleigh compiler). Ghidra loads this compiled .sla file into memory at runtime for optimal performance. 2. The Challenges of Reverse Engineering Undocumented Binaries When dealing with a binary compiled for an undocumented processor, Ghidra's default paradigm faces major limitations: The .slaspec file is unavailable. Ghidra attempts to aggressively disassemble everything. Analyzing an undocumented target requires a strict two-phase approach. 3. Missing .slaspec File Without a valid .slaspec definition, Ghidra renders ?? for every opcode. The primary objective when tackling an unknown CPU is precisely to reconstruct this missing .slaspec specification. 4. Overcoming Ghidra's Aggressive Disassembly By default, Ghidra (like most disassemblers) employs an exhaustive strategy (usin

Introduction As software applications grow in size and complexity, managing object creation becomes challenging. Creating objects directly using constructors can result in tightly coupled code that is difficult to maintain and extend. The Factory Method Design Pattern solves this problem by separating object creation from object usage. It provides a flexible and reusable approach for creating objects, making applications easier to modify and scale. What is the Factory Method Design Pattern? The Factory Method Design Pattern is a Creational Design Pattern that provides an interface for creating objects without specifying their exact classes. Instead of directly instantiating objects using the new keyword, a factory class creates and returns the required object. Definition Factory Method Design Pattern: A creational design pattern that defines an interface for creating objects while allowing subclasses or factory classes to decide which object to instantiate. Why Do We Need It? In traditional programming: The client creates objects directly. Code becomes tightly coupled. Adding new object types requires modifying existing code. Maintenance becomes difficult. The Factory Method pattern solves these problems by centralizing object creation inside a factory class. How It Works The client requests an object from the factory. The factory checks the requested type. The appropriate concrete object is created. The factory returns the object to the client. The client uses the object without knowing how it was created. Java Example interface Shape { void draw(); } class Circle implements Shape { public void draw() { System.out.println("Drawing Circle"); } } class Rectangle implements Shape { public void draw() { System.out.println("Drawing Rectangle"); } } class ShapeFactory { public Shape getShape(String type) { if(type.equalsIgnoreCase("Circle")) return new Circle(); if(type.equalsIgnoreCase("Rectangle")) return new Rectangle(); return null; } } public class FactoryPatternDem

If you've ever wondered whether that wild Pokemon you just caught has competitive potential, you've probably heard the term IVs (Individual Values) thrown around. IVs are the hidden genetics of every Pokemon — the 0–31 numbers baked into your Pokemon at birth that determine how strong it can ultimately become. But here's the thing: the game never tells you what your IVs are. You have to reverse-engineer them. In this post, I'll walk you through exactly how IV calculators work under the hood — from the official stat formula, to the nature modifier trick, to why you often get a range instead of a single number. Live Tool: Try the calculator at randompokemongenerator.me/iv-calculator — free, no sign-up required, supports Gen III through Gen IX. What Are IVs, Exactly? Individual Values are six hidden integers between 0 and 31 , one for each stat (HP, Attack, Defense, Sp. Atk, Sp. Def, Speed). They represent the genetic potential of a Pokemon and are permanently set when the Pokemon is encountered or hatched — they can never be changed by leveling up or any in-game action. A stat with 31 IVs reaches its maximum possible value at level 100. A stat with 0 IVs starts at its theoretical minimum. In competitive play, players typically hunt for Pokemon with at least 3–4 perfect (31) IVs , with some strategies deliberately using 0 IVs in Defense or Speed for tactical advantages. The IV system as we know it today started in Generation III (Ruby/Sapphire/Emerald). Gen I–II used a predecessor called DVs (Determinant Values) , which only covered four stats and worked differently — so if you're playing on Virtual Console or Gen I/II, this calculator won't apply. The Stat Formula (Gen III+) The foundation of everything is the official stat calculation formula introduced in Generation III and still used today: For HP: HP = floor(((2 × BaseStat + IV + floor(EV / 4)) × Level) / 100) + Level + 10 For all other stats: Stat = floor((floor(((2 × BaseStat + IV + floor(EV / 4)) × Level) / 100

Understanding the Prototype Design Pattern in Java Introduction When developing software, there are situations where creating a new object from scratch is expensive or time-consuming. For example, an object may require complex initialization, database access, or extensive configuration. In such cases, instead of creating a new object every time, we can duplicate an existing object. This is where the Prototype Design Pattern becomes useful. The Prototype Design Pattern is one of the Creational Design Patterns in Java. It allows developers to create new objects by cloning existing ones rather than instantiating them using constructors. What is the Prototype Design Pattern? The Prototype Design Pattern creates new objects by copying an existing object, known as the prototype. This approach improves performance by avoiding repeated initialization and allows developers to create multiple similar objects efficiently. In Java, cloning is commonly implemented using the Cloneable interface and overriding the clone() method. Why Use the Prototype Pattern? The Prototype Pattern offers several benefits: Reduces the cost of object creation. Improves application performance. Simplifies the creation of complex objects. Avoids repeated initialization code. Makes object creation more flexible. Real-World Example Imagine an online shopping application where thousands of product objects share similar properties. Instead of creating every product from scratch, the application can clone a prototype product and modify only the required attributes such as name or price. Other real-world examples include: Document templates Game characters Employee records Vehicle configurations Graphic design objects UML Structure The Prototype Design Pattern generally includes: Prototype Interface – Declares the clone operation. Concrete Prototype – Implements the cloning functionality. Client – Creates new objects by cloning existing prototypes. Java Implementation Step 1: Create the Prototype Class cla

📑 Table of Contents Introduction Why We Created ValidX? Why Choose ValidX? 5-Minute Quick Start Multilingual Support Important: Null/Empty String Handling Thread Safety Supported Validation Annotations Quick Reference Table Basic Validation Identity Validation Financial Validation Education/Professional Qualification Network Validation China-Specific Validation Automotive Validation Book-Related Validation Mobile Device Validation More Validation Annotations Contribution Introduction ValidX is an open-source Java validation library focused on Chinese business scenarios, making validation simple, elegant, and reliable. Built on JSR-380 standards with 90+ specialized annotations for Chinese identity cards, phone numbers, bank cards, and more. 💡 Why We Created ValidX? When developing applications for Chinese users, we frequently encountered these challenges: Pain Point 1: Java Has Too Few Built-in Validation Rules, Far Less Than Other Language Frameworks If you've used web frameworks in other languages, such as PHP's ThinkPHP or JavaScript's Validator.js, you'll notice they come with incredibly rich built-in validation rules: mobile , idcard , zip , alphaNum , etc.—ready to use out of the box, simple and convenient. But in the Java world, standard Bean Validation only provides a handful of generic annotations like @Email and @Pattern . For common Chinese business scenarios—identity cards, phone numbers, bank cards, unified social credit codes—there's absolutely no support. This forces every Java project to reinvent the wheel: Writing complex regular expressions yourself Implementing Luhn algorithm for bank card validation Handling identity card check digit calculations Copy-pasting validation code found online Why can't Java validation be as ready-to-use as other frameworks? This is why ValidX was born. Pain Point 2: Scattered Validation Logic Difficult to Maintain As projects grow, validation logic becomes scattered across: Manual validation in Controller layer Busine

Additional details about OpenAI's mysterious new AI device make it sound like a pricey smart speaker.

Researchers linked the latest malicious activity to a Chinese company, after one of the spyware's operators placed an order with KFC using their real name and office address.

A 26-year-old Canadian man once described as one of the most consequential cybercrime threat actors of 2024 has pleaded guilty to computer fraud and conspiracy to hack and extort more than 165 organizations that used the cloud data storage provider Snowflake. Connor Riley Moucka, of Kitchener, Ontario, also admitted to stealing call and text history records of more than 100 million AT&T customers.

GitHub malware advisories no longer stop at npm. Here's how we wired OpenSSF's malicious-packages data into the Advisory Database, and why we built the pipeline paranoid. The post How we took malware advisories beyond npm appeared first on The GitHub Blog .

A reverse proxy sits between clients and one or more upstream services. Instead of clients communicating directly with your application, every request first passes through the proxy before being forwarded to an upstream. Mature reverse proxies such as Nginx, Envoy, and HAProxy do much more than simply forward requests. They perform tasks such as load balancing, health checks, rate limiting, metrics collection, and much more. I wanted to better understand how some of these concepts work in practice, so I built a reverse proxy in Go. Along the way I implemented request forwarding, multiple load-balancing strategies, health checks, circuit breakers, rate limiting, request logging, metrics, and graceful shutdown. If you'd like to explore Proxify as we go, you can find the project here: https://github.com/Rahmannugar/proxify Table of Contents Request Lifecycle Project Structure Configuration Reverse Proxy Load Balancing Health Checks Circuit Breakers Middleware Graceful Shutdown Running Proxify with Docker 1. Request Lifecycle At a high level, every request follows the same path through the reverse proxy. A client sends an HTTP request to Proxify instead of communicating directly with an upstream service. Proxify receives the request, selects a healthy upstream using the configured load-balancing strategy, forwards the request, waits for the upstream's response, and finally returns that response to the client. Client │ ▼ +---------------+ | Proxify | +---------------+ │ Select Healthy Upstream │ ┌───────┴────────┐ ▼ ▼ Upstream A Upstream B │ ▼ HTTP Response │ ▼ Client Although the overall flow is straightforward, every step introduces additional considerations. Which upstream should receive the next request? What happens when an upstream becomes unhealthy? How can requests be distributed efficiently across multiple upstreams? How do we prevent a failing upstream from continuing to receive traffic? The remainder of this article answers those questions by gradually buildin