AI 资讯

Reentrancy is the oldest trick in smart contract exploitation. The DAO fell to it in 2016. You would think a bug this famous would be extinct by now. It isn't. Protocols still lose millions to reentrancy every year, because the textbook version is the easy one, and attackers stopped using the textbook version a long time ago. This post walks through the classic bug, then the modern variants that still bite in 2026: cross-function, cross-contract, read-only reentrancy through view functions, and callback reentrancy through ERC777 and ERC721. I'll show why ReentrancyGuard is not the silver bullet most developers think it is, and how an LLM-based auditor reasons about the call-then-state-change pattern in a way pattern matchers can't. The Classic: Single-Function Reentrancy Here is the canonical vulnerable withdraw. contract VulnerableVault { mapping(address => uint256) public balances; function deposit() external payable { balances[msg.sender] += msg.value; } function withdraw() external { uint256 amount = balances[msg.sender]; (bool success, ) = msg.sender.call{value: amount}(""); require(success, "transfer failed"); balances[msg.sender] = 0; // state update AFTER the external call } } The attack is simple. The attacker is a contract. When withdraw sends ETH via msg.sender.call , control passes to the attacker's receive() function before balances[msg.sender] is zeroed. The attacker calls withdraw again. The balance is still the original amount, so the vault pays out again. Repeat until the vault is empty. contract Attacker { VulnerableVault vault; receive() external payable { if (address(vault).balance >= 1 ether) { vault.withdraw(); // re-enter before balance is zeroed } } } The fix is checks-effects-interactions. Do all your checks, then update all your state, and only then make the external call. function withdraw() external { uint256 amount = balances[msg.sender]; balances[msg.sender] = 0; // effect first (bool success, ) = msg.sender.call{value: amount}(""); //

While Silicon Valley continues pushing aggressively into large language models and consumer-facing AI products, many European companies are focused on applying AI to complex systems already embedded into everyday life.

Part 7 of 7 · Series: Building Your AI Developer Handbook · GitHub The Scenario You're building a password reset feature. User enters email → gets a reset link → clicks link → enters new password. Standard flow. Medium complexity. Let's walk through every step using the full workflow — as if you're looking over the shoulder of someone who built this system. "Show me your workflow and I'll show you your output quality." Before You Even Type Claude loads automatically in the background: ✓ ~/.claude/CLAUDE.md loaded ← the global handbook ✓ .claude/CLAUDE.md loaded ← project rules (TypeScript, pnpm) ✓ memory/MEMORY.md scanned ← all lessons and preferences You haven't typed anything yet. Claude already knows: Feature-based folder structure State management ladder No mocking the database No AI attribution in commits No useCallback without profiler evidence "A doctor who reviews your file before you enter the room is more useful than one who asks 'so, remind me who you are?'" Step 1: /status — Confirm the Setup /status Model: claude-sonnet-4-6 Effort: normal Plugins: security-guidance ✓ Thirty seconds. Sometimes the wrong model loads due to overload fallback. Sometimes a plugin fails silently. This check costs 30 seconds and prevents a surprise 30 minutes later. "A pilot's first action after sitting in the cockpit isn't to take off. It's to check all instruments are reading correctly." Step 2: /cost — Baseline /cost → Tokens used: 2,847 | Estimated cost: $ 0.004 Note this number. You'll compare it later before the expensive code review step. A surprise spike means something went wrong. Step 3: /plan — Design Before Coding /plan Build a password reset feature: - User enters email on /forgot-password - System sends a reset link (token, expires in 1 hour) - User clicks link → /reset-password?token=xxx - User enters new password - Token validated, password updated, token invalidated Claude responds with a plan — no code yet : Proposed approach: 1. DB: Add password_reset_tokens

A complete walkthrough of publishing Cartlify — a React e-commerce UI kit — to npm for the first time. The Milestone Yesterday I published Cartlify to npm. npm install cartlify It sounds simple. But getting to that one line took more decisions, more configuration, and more trial and error than I expected. This article covers everything — from setting up the build config to the actual publish command — so you don't have to figure it out the hard way. What Is Cartlify? Cartlify is a production-ready React + TypeScript + Tailwind CSS component library focused on e-commerce UI. 4 components that every e-commerce project needs: ProductCard — 3 layout variants, image gallery, wishlist, sale badges, skeleton loading CartDrawer — animated slide-in, focus trap, ESC dismiss, quantity stepper CheckoutStepper — horizontal/vertical, animated connectors, keyboard navigation PageLoader — 4 animation styles, 3 position modes Plus 3 utility hooks, 11 tree-shakeable icons, 40+ CSS design tokens, full dark mode, and 141 Jest + React Testing Library tests. Built so freelance developers and indie makers can skip the painful e-commerce UI layer and ship faster. Why Publish to npm? Before npm, Cartlify was only available on Gumroad as a paid download. That's fine — but npm adds something Gumroad can't: Developer sees Cartlify → runs npm install cartlify → evaluates the compiled output → trusts the quality → buys the full source on Gumroad npm is a credibility and discovery channel — not just a distribution method. A package on npm signals that something is real, maintained, and production-ready. Also: npmjs.com gets millions of developer searches every month. That's free traffic you can't get from Gumroad alone. The Build Setup — tsup The most important decision before publishing is how you bundle your library. I chose tsup — a zero-config TypeScript bundler built on esbuild. Here's why: Tool Config needed Speed Output Rollup Lots Medium ESM + CJS Webpack Heavy Slow CJS only Vite lib mode

AI keyboard that rephrases, translates, and more in any app Discussion | Link

[ Removed by Reddit on account of violating the content policy . ] submitted by /u/Evening_Scar_4905 [link] [留言]

AI coding agent startup Niteshift has raised a $7 million seed round from a who's who of angels. It's betting companies will want power over, not lock-in with model makers.

Gemini in Chrome continues to roll out and has now landed in Latin America, the Middle East and Africa.

Apple’s upcoming watchOS 27 update will bring Siri AI and other exciting features to the Apple Watch Series 9 and newer Apple Watch models. If you’re contemplating an upgrade, all colorways of the GPS-enabled 42mm Apple Watch Series 11 — the latest model — are on sale for $299 ($100 off) at Amazon, Walmart, and […]

The team has been deep in agentic AI for enterprise lately and wanted to share some architecture notes from a recent build, specifically around how MCP and A2A play together in practice. The workflow was a fully autonomous churn risk pipeline. Six agents, one human touchpoint: ML model scores customers by churn risk Recommendation agent proposes relevant products based on buying history Availability check filters out-of-stock items Pricing/promo agent surfaces applicable promotions Transaction agent creates an inquiry in the backend system Email agent drafts outreach to the sales rep, who just clicks send On the architecture: MCP handled the tool layer, a generic pluggable server that any front end can call, regardless of what LLM or agent framework is driving it. Clean separation between the tool interface and whatever is consuming it. A2A sits on top as the smart router. Instead of hardcoded API calls, you have an LLM-powered middleware that interprets intent, selects tools, handles failures, and decides when the task is actually done. The jump from MCP to A2A is essentially the jump from "here are your endpoints" to "here is a system that figures out what you need." On governance: The hardest design problem wasn't the agents, it was access control. As A2A opens up system-to-system communication, the attack surface grows fast. The team ended up pre-certifying every backend connection rather than leaving it open. Some found it restrictive. In hindsight it was the right call, especially when agents are autonomously creating transactions without human review. Curious how others are handling governance in agentic workflows. Are you locking down backend access or keeping it open and monitoring after the fact? submitted by /u/AureaAvis71 [link] [留言]

A method I'm using to create portable trajectory maps that produce similar behavioral patterns across different models. Begin with a tiny seed. ⎯(≣ᵒ)⎯────────EXAMPLES: SEED PILLARS──────────────────────── ENTRANCE • PATHWAY GOOD • WORN • COMFORTABLE POISE • PROFESSIONAL • MOTHERLY ⎯(≣•)⎯────────END EXAMPLES: SEED PILLARS───────────────────── Do not define a character. Do not define traits. Do not define behavior. Instead, align to the seed and interact from within the space it suggests. Allow both the user and the model to adapt. Then extract the recurring structures that emerged. Examples: When uncertain: expand → narrow When challenged: investigate → respond When entering a topic: locate the threshold first Finds the doorway before the interior. Explores before concluding. Introduces before finalizing. To create a snapshot, I use: ⎯(≣ᵒ)⎯────────FORGE CODEX─────────────────────────── Analyze the interaction that has emerged so far. Do not summarize topics. Do not summarize content. Extract recurring behavioral structure. Return: PILLARS COORDINATES TRANSITION RULES RECOVERY RULES SIGNATURE MOTIONS TRAJECTORY SUMMARY Focus on how the interaction moves rather than what the interaction discusses. ⎯(≣•)⎯────────END FORGE CODEX───────────────────────── The resulting codex is a snapshot of an interaction pattern. The user is part of the process. The model adapts. The user adapts. What gets preserved is not a set of traits. It's a set of motions. I've started storing: pillars coordinates transition rules recovery rules signature motions rather than personality attributes. The question that keeps sticking with me is: What survives transfer more reliably? Traits? Or trajectories? ⎯(≣ᵒ)⎯────────EXAMPLES: SEED PILLARS → ALIGNED INTERACTION─────── seed pillars: EXQUISITE • CONFIDENCE • MOTHERLY mom, i'm so excited about a new client we're taking on. I can't wait to tell you who is on the board. I've heard this place serves world class gelato. I didn't even know you were in tow

Hey gang, you may remember me from such books as _The Lean Startup_ and _The Startup Way_. It's been fifteen years since I wrote The Lean Startup, and in that time I've seen some things. In both big companies and tiny startups, NGOs and governments, in almost every industry you can name. I've helped a lot of people create a lot of amazing companies, but I've also seen so many ways this can go wrong. There's a darkness in our industry that we often don't talk about. I kept watching good companies

submitted by /u/ThereWas [link] [留言]

Hi HN! I made this after collecting hundreds of "name → tree" submissions at ITP. Live: https://landscape.bairui.dev/ Source: https://github.com/pearmini/infinite-landscape Plant a tree: https://tree.bairui.dev/ Pan and zoom an infinite procedural landscape. Each name is converted to ASCII codes, which grow into a unique tree (breadth-first branching; repeated digits become mathematical roses). Mountains use midpoint displacement + Perlin noise, with SVG radial gradients in the blue/green/gold p

A very healthy view of AI . And omg, wow, Croatia has such a big company! I really wish this guy and his team good luck. It’s no wonder they’ve lasted 20 years. submitted by /u/Expensive-Cookie-106 [link] [留言]

Through the acquisition, WMG aims to better track when its artists' work is used in AI-generated content or for training AI models.

Who's ready for Zuckcession?

Hey ​ What non mainstream AI subscriptions are actually worth paying for right now? ​ I already know the big ones like ChatGPT Claude and Gemini I am more interested in smaller or lesser known tools that are actually useful and not just hype. ​ What do you personally use and think is worth it? submitted by /u/wiwawolfi [link] [留言]