今日已更新 170 条资讯 | 累计 28482 条内容
关于我们

今日精选

HOT

最新资讯

共 28482 篇
第 101/1425 页
AI 资讯 Dev.to

EEPROM Hijacking on 8051 Architecture

1. Introduction and Problem Statement In constrained embedded systems engineering, 8051-type microcontrollers remain ubiquitous. Often coupled with external or internal EEPROM memories of very limited size (a few kilobytes), these environments leave no room for excess. Using high-level compilers like SDCC, while convenient for rapid prototyping, generates heavy code (function prologues, complex stack management) that becomes prohibitive when attempting to insert surgical modifications into an existing binary. This article details the methodology of intercepting an SDCC-compiled function via a direct binary hook (jump) and redirecting execution flow to an optimized pure assembly routine located in an unused memory area (slack space), with the goal of conditionally bypassing a critical logic test when a specific trigger condition is met 2. 8051 Architectural Constraints and Low-Level Logic The 8051 instruction set is rudimentary yet extremely direct. Every recovered byte of memory space represents an insertion opportunity for a control payload. By replacing compiler-generated structures with direct assembly sequences, space waste is eliminated and register cycles are precisely controlled. Tactical Objective: Modify the behavior of a validation function (e.g., a security or integrity test) so that it systematically returns a negative response (False / 0x00) under the effect of a stealthy trigger, while maintaining 100% transparent nominal behavior the rest of the time. 3. Designing the Pure Assembly Patch Imagine an original routine performing a classic conditional check. The original code evaluates a state and jumps depending on the result. #include <mcs51/8051.h> // Simulated security check function generated by SDCC unsigned char verify_system_integrity ( void ) { unsigned char status = 0 ; // Read a configuration or state register status = P1 ; // Critical security test if ( status == 0x5A ) { return 0x01 ; // Success / Authorized } return 0x00 ; // Failure / Unaut

ddupard 2026-07-31 17:47 11 原文
AI 资讯 Dev.to

What Payments Infrastructure Taught Me About Building Systems That Don't Break

Idempotency, vendor failure, monitoring that catches the invisible outages, and the tradeoffs nobody warns you about, lessons from scaling payments infrastructure. Most software fails quietly. A page renders slowly, a recommendation is a little off, a report is stale by an hour. Users shrug and move on. Payments doesn't work like that. When payments break, someone's money is in a place neither of you can account for, and the clock starts ticking on their patience. There's no graceful degradation. Either the money moved, or it didn't, and someone needs to know which. I've spent a good chunk of my career building and scaling payments infrastructure, and it has quietly rewired how I think about engineering in general. Here's what stuck. 📋 The short version # Lesson One-line summary 1 Idempotency You will receive the same request twice. Design for it. 2 Vendor failure Gateways are vendors. Ask "when," not "if." 3 Monitoring Never learn about an outage from a customer. 4 The unglamorous stuff Ledgers, reconciliation, state machines, refunds. 5 Tradeoffs Every lesson above fights at least one other. 1. 🔁 Idempotency isn't a feature. It's a foundation. The first hard lesson: you will receive the same request twice. Not "might." Will. A client times out waiting for your response and retries. A user double-taps a button on a bad connection. A queue consumer crashes after processing but before acknowledging. A gateway sends the same webhook four times because it never got a 200 back. None of these are exotic failure modes, they're Tuesday. If your system treats every incoming call as a new instruction, every one of those scenarios becomes a double charge. And a double charge isn't a bug you fix quietly in the next release. It's a support ticket, a refund, a reconciliation entry, and a customer who now checks their statement every time they use you. The fix is conceptually simple and operationally demanding: every operation that moves money must be uniquely identifiable and sa

Samuel Mutemi 2026-07-31 17:45 8 原文
AI 资讯 Dev.to

yfinance NG=F Not Working? Why Natural Gas Futures Data Fails and 3 Fixes That Work

If your script suddenly started printing this: >>> import yfinance as yf >>> df = yf . download ( " NG=F " , period = " 1mo " ) 1 Failed download : [ ' NG=F ' ]: YFPricesMissingError ( ' possibly delisted; no price data found ' ) …you didn't break anything. NG=F (the natural gas futures ticker on Yahoo Finance) periodically stops returning data for everyone, and futures tickers get hit harder than stocks. This post covers why it happens and the three fixes that actually work, ordered from "quick patch" to "never deal with this again." 1. What the error actually means yfinance is not an official API . It's a (great) community library that scrapes Yahoo Finance's internal endpoints — the same ones Yahoo's own website uses. Yahoo doesn't document them, doesn't promise they'll keep working, and changes them whenever it suits their frontend. When Yahoo changes something — an endpoint, a rate limit, a response format — yfinance breaks until its maintainers reverse-engineer the change. Futures symbols like NG=F and GC=F are the most fragile: they've had recurring gaps and failures reported over the years, for example #2620 (missing recent data for NG=F/GC=F) , #2635 (whole missing days in futures history) and the evergreen #865 "Futures only work sometimes" . So: "possibly delisted" almost never means delisted. It means "the scrape came back empty." 2. Fix #1 — the quick patches (works today, breaks tomorrow) Three things fix most transient failures: Upgrade first. The maintainers usually patch Yahoo changes within days: pip install -U yfinance Retry with backoff. Failures are often intermittent rate-limiting, not hard breaks: import time import yfinance as yf def download_with_retry ( ticker , retries = 3 , wait = 5 , ** kwargs ): for attempt in range ( 1 , retries + 1 ): df = yf . download ( ticker , progress = False , ** kwargs ) if not df . empty : return df print ( f " attempt { attempt } came back empty, retrying in { wait } s… " ) time . sleep ( wait * attempt ) rai

Synergic-Apis 2026-07-31 17:44 6 原文
AI 资讯 Dev.to

The Bloom filter that never existed, and the two ceilings it was hiding

This is a submission for DEV's Summer Bug Smash: Smash Stories powered by Sentry . The most expensive bug I fixed this year was not in the code. It was in the documentation, and it had been shaping what everyone believed the code did. The setup HydraDNS is an open-source DNS security gateway I build in Go. Router points at it, it filters every DNS query on the network against a 92k-domain blocklist, blocks the bad ones, forwards the rest. Before putting it on anyone else's network I wanted a real number for what one box could take, so I sat down with dnspyre and a rule I had written for myself: every number becomes a sales claim or a fix ticket. No number, no claim. Our feature sheet said the blocklist was backed by a Bloom filter, sub-millisecond lookups. Here is the uncomfortable part: at every load this system had ever run, that claim was indistinguishable from the truth. Normal-traffic latency sat at one or two milliseconds. There was nothing to doubt, because nothing observable disagreed. The first ceiling The redline test capped at about 500 queries per second. Odd, but fine, until I noticed the cap would not move. Blocked queries capped at ~500. Cached queries that never touch upstream also capped at ~500. Two paths doing completely different work, same wall, CPU sitting under 30% on a 22-core dev machine. That combination is worth memorizing: when two very different code paths hit the same ceiling and the CPU is bored, the bottleneck is not in either path. It is in something they share. Ours was the blocklist check. IsBlocked ran a SQL COUNT against the 92k-row table on every single query, because the check sits in front of the cache, so even cache hits paid for it. Every one of those reads was serialized through a single SQLite connection, MaxOpenConns=1 , which was also absorbing the async write traffic from query logging. Engine self-latency under load: p50 of 50ms, p99 of five full seconds. For DNS. And the Bloom filter? I went looking for it so I could

Roshan Singh 2026-07-31 17:41 4 原文
AI 资讯 Dev.to

I Stopped Talking To AI And Started Giving It A Place To Live

The breakthrough wasn't a better prompt. It was giving the machine an address. For a long time, I used AI exactly how the landing page told me to. Open tab. Ask brilliant question. Receive eerily competent answer. Steal the good parts. Close tab. Come back 12 hours later to meet a completely new entity with the long-term memory of a goldfish in free-fall. Every session started with the same morning standup for the amnesiac: Here's the project. Here's the stack. Here's what we already tried. Here's the bug you invented yesterday. No, we are not migrating the database at 2am for fun. No, do not rewrite the entire app in Next.js because you felt inspired. Yes, that file you keep ignoring is the entire business logic. It felt productive because words were moving fast. Code poured out. Bullet points bred like mold behind a gas station sink. But the workflow itself was insane. I had a system that could read 10,000 lines of code, hit APIs, run a terminal, crawl docs, and reason across an entire architecture - and I was using it like a genius contractor trapped behind plexiglass at county jail. Every interaction was a visitation. Every visitation required paperwork. The problem wasn't personality. It didn't need a cuter name, a 3,000-word system prompt written like a LinkedIn mantra, or another folder called AI_RULES_FINAL_FINAL.md . It needed continuity. It needed keys to the building. It needed tools, memory, a schedule, a logbook, a junk drawer, and a place where half-finished work could stay half-finished without evaporating. It needed an operating system. Not a literal kernel. Not yet. I don't need my chatbot handling page faults before coffee. I mean operating system in the old, honest sense: a thing that coordinates resources, remembers state, exposes interfaces, enforces limits, and lets processes outlive the conversation that spawned them. The second I started thinking like that, chatting with AI became the most boring thing you could do with it. The Chat Window Is

v. Splicer 2026-07-31 17:36 4 原文
AI 资讯 Dev.to

Manticore Search 28.6.6: UUID document IDs, ordered GROUP_CONCAT(), and 16 fixes

Manticore Search 28.6.6 has been released. The headline additions are UUID document IDs for real-time tables and ordered, limited GROUP_CONCAT() for grouped queries. The release also includes 16 fixes for backups, replication, query processing, SQL compatibility, and secondary indexes. This post covers everything shipped from 28.4.5 through 28.6.6 . Upgrade notes There are no new mandatory data migrations in this release. UUID IDs are an opt-in table definition: existing numeric-ID tables keep working as they are. If you want UUID identifiers, create a real-time table with id uuid ; ALTER TABLE cannot convert an existing table between numeric and UUID IDs. Two fixes are particularly useful for production installations. Successful backups now always unfreeze real-time tables when they finish (previously in rare cases they didn't), rather than leaving writes blocked. And authenticated replication can again add an existing populated RT table with ALTER CLUSTER ... ADD . UUID document IDs for real-time tables Applications often already have UUID identifiers from the system of record. Until now, using them with Manticore Search meant maintaining a separate numeric ID mapping. Real-time tables can now use UUID document IDs directly: CREATE TABLE products_uuid ( id uuid , title text , price int ); Manticore accepts an explicit UUID string, or generates one when id is omitted from an insert or replace. UUID equality and IN filters work in queries, and UUID IDs can be used with REPLACE , UPDATE , and DELETE . This is currently a real-time-table capability, including columnar and replicated RT tables. Plain, percolate, and sharded tables continue to use their existing ID models. Ordered and limited GROUP_CONCAT() Grouped results often need a compact preview of the most relevant values in each group. GROUP_CONCAT() can now sort values and retain only the requested number of them in explicit SQL GROUP BY queries: SELECT category , GROUP_CONCAT ( title ORDER BY price DESC SEPARA

Sergey Nikolaev 2026-07-31 17:33 5 原文
AI 资讯 Dev.to

Running LLMs Locally on Consumer Hardware — Part 1: The Stack and First Benchmarks

This is the first in a series of build-log posts documenting a local LLM project, in which models are run on owned consumer hardware rather than through a cloud API. The present entry covers the hardware, the software stack, and the benchmarks by which a primary model was selected. The hardware Two machines are used, both consumer-grade. All benchmarks reported below were obtained on the primary desktop. Machine CPU RAM GPU Primary desktop Ryzen 5950X ~80 GB DDR4 AMD RX 6900XT (16 GB) Secondary box Ryzen 5600G 32 GB NVIDIA GTX 1060 (6 GB) The software stack Ollama serves as the model runner across two GPU vendors: ROCm 5.7 for the AMD card on the primary desktop, and CUDA for the NVIDIA card on the secondary box. The primary model is Gemma 4 26B, a mixture-of-experts model with roughly 3.8B active parameters, quantized to Q4_K_M and occupying approximately 18 GB on disk. On the RX 6900XT it is run with an automatic GPU/CPU layer split, as the Q4 weights together with the KV cache exceed the 16 GB of available VRAM. Several Ollama settings were enabled to recover headroom: flash attention, and an 8-bit ( q8_0 ) KV cache, the latter approximately halving the cache footprint. A free cloud tier is retained for occasional heavier tasks, though the objective is to run as much as possible locally. Selecting a model: benchmarks Before a primary model was chosen, the installed models were benchmarked. Two properties were of interest: throughput and output quality. Throughput was measured on the primary desktop with a 500-word essay prompt ( ollama run <model> --verbose ): Model Tokens/sec Duration Tokens out gemma4:26b 18.86 50.11s 945 gemma4-26b (64K ctx) 17.96 51.99s 934 mistral:7b-instruct 34.81 10.17s 354 llama3.2 57.11 3.99s 228 The smaller models are substantially faster; their token counts, however, are lower, and in practice their responses were correspondingly shallower. Quality was assessed with a five-task suite spanning logic, coding, summarization, creative writ

Sven Welack 2026-07-31 17:32 4 原文
AI 资讯 Reddit r/programming

Show: Ripple — detects API breaking changes across OpenAPI/Proto/GraphQL/AsyncAPI and auto-opens fix PRs

Problem: You rename a proto field → 3 services silently break in production because their generated clients still reference the old name. Solution: Install Ripple on your GitHub/GitLab org. When you push a breaking spec change, it finds every consumer via grep + git co-change history + pattern playbooks, generates the fix in the consumer's language, and opens a PR. Supports: OpenAPI (6 change types), Protobuf (6), GraphQL (6), Database/SQL (6), AsyncAPI (6). 30 total. The interesting part technically: it doesn't just grep. It scans your git history on install to learn which files always change together (co-change learning), then uses that + domain-specific playbooks + multi-invoker detection for 3x better consumer finding than grep alone. Self-hosted agent available if you're on Phabricator/Gerrit/on-prem Git. Source: https://github.com/Aakash2408/ripple Would appreciate feedback on the detection accuracy — false positives are the main concern. submitted by /u/Own_Industry_1594 [link] [留言]

/u/Own_Industry_1594 2026-07-31 17:30 3 原文
AI 资讯 InfoQ

Article: Virtual Threads After JDK 24: What Changed for Production Java

JDK 24 removed the monitor-related carrier-thread pinning that stalled Netflix and similar teams on Java 21. What has replaced it on JDK 25 LTS is downstream-resource saturation: The bottleneck moved and now demands explicit bounding in application code. This article maps the failure modes that surface after virtual-thread adoption and gives a practical sequence backed by a public benchmark. By Sandeep Bharadwaj

Sandeep Bharadwaj 2026-07-31 17:00 6 原文
AI 资讯 MIT Technology Review

Montana’s new “right to try” law can’t come soon enough for some

Kris DeVault is desperate. His son, Brody, was born in March 2023. It wasn’t long before he started to show signs of developmental delay, says DeVault. As time went on, Brody started missing key milestones in speech, movement, and coordination, he says. When Brody was around two and a half years old, a genetic test…

Jessica Hamzelou 2026-07-31 17:00 4 原文