AI 资讯

I built CVE-Bench: 20 real-world CVEs across 18 Python projects (Pillow, GitPython, yt-dlp, urllib3, others), 5 frontier models, 3 prompt conditions, 300 runs total. Each agent runs in a sandboxed container and is scored against a hidden test_security.py derived from the maintainer's own fix. Binary pass/fail (a 90%-patched vulnerability is still a vulnerability). To better understand failure modes, I've tested three prompt conditions : advisory (full GHSA report), diagnose (exploit description only, no file or function), and locate (exact file and function, no description of the flaw). The three conditions test meaningfully different things. A model that does well on advisory but drops on diagnose can’t translate a behavioral description into a location in the codebase. A model that holds up on locate is recognizing dangerous code on its own. The leaderboard isn't the finding. Best solve rate is 50% overall, 60% under advisory. Cross-family separation (OpenAI vs Laguna) is confirmed under McNemar's test with continuity correction (all four pairs cross α = 0.05). Within-family gaps are noise: a power analysis puts the task count needed to detect a meaningful within-family edge at ~700. That cuts both ways: if the expensive models had a large true advantage, 20 tasks would have been enough to surface it. gpt-5.5 at 12× the cost of gpt-5.4-mini is not the rational choice. All four cross-family pairwise comparisons reach statistical significance at α = 0.05 (McNemar test with continuity correction, n = 60 tasks per model pair): gpt-5.5 vs laguna-m.1 (p = 0.015), gpt-5.4-nano vs laguna-m.1 (p = 0.017), gpt-5.5 vs laguna-xs.2 (p = 0.028), gpt-5.4-nano vs laguna-xs.2 (p = 0.040). Within-family comparisons remain far from significance; those rankings should be read as approximate. The failure taxonomy is the most interesting finding. Wrong-search drift — model finds the right file early, makes one incorrect inference, spends the remaining turns chasing it. Budget expires,

https://preview.redd.it/se5nr2z7tt4h1.png?width=3046&format=png&auto=webp&s=7db15b73afb749da236e5bb50ff96372f6a3239b Hi, Niels here from the open-source team at Hugging Face. It's been 2 weeks since I launched paperswithcode.co , a revival of the website we all loved. It allows us to keep track of the state-of-the-art (SOTA) across various domains of AI, from agents to computer vision and time-series forecasting. I've just added conference support as a new feature. The idea is that you should be able to easily browse all papers of major AI conferences like NeurIPS, CVPR, and ICML. As CVPR 2026 takes place next week in Denver, USA, I've indexed all papers with corresponding arXiv IDs. They are categorized by task, and tagged with linked GitHub and project page URLs, Hugging Face artifacts, and evals. You can also browse the papers which were accepted for an Oral presentation as well as the Spotlight papers. You can try it at https://paperswithcode.co/conferences ! Feel free to leave feedback. submitted by /u/NielsRogge [link] [留言]

Frontend automation has been getting pretty wild lately. 🫠 A few months ago, this comparison would...

So basically Claude at 20 buck sub is not much better than free. Chatgpt. It is pretty much shit. Gemini. It seems to have some reductions to its abilities in the last couple of months as well. The 20 buck price range used to have lots of good ais. Now they are all limited, downgraded. What would be the king in this price range? I have found myself using gemini ai pro with other ais as free on the top of that. submitted by /u/aluode [link] [留言]

Hi, I'm prepare for a phd in the US in medical AI, so I want to improve listening and speaking skills. I warry about admission interview, and I like discuss research. I find male friends because I have a girlfriend. I don't want to make her worry. I find the friends online firstly. Please feel free to contact me. submitted by /u/CrazyIndependent7436 [link] [留言]

https://archive.ph/TNLUr

A hands-on knowledge-distillation project: Qwen2-VL-7B → 2B for UI-screenshot understanding, trained, evaluated and benchmarked end-to-end on an M4 Pro. 2.4× faster — and why the teacher lost on ROUGE-L.

Over the past few months, I've been working on a high-scale scraping pipeline to aggregate listings directly from company job boards and applicant tracking systems. Mapping over 100,000 distinct companies to their career pages turned out to be a massive engineering headache, but it's finally stable. The result is a unified database of more than 2 million active job postings, which I'm opening up to everyone for free. I am running daily delta refreshes to keep it current. Dataset Overview Scale: 2M+ active job listings across 100,000+ unique companies. Format: Parquet. (To keep storage costs to minimum) Core Fields: job_title, company_name, company_website, job_description, location, post_date, and the original tracking URL. For more detailed info check here . Update Cadence: Refreshed daily straight from the source. View the stats here . (Currently it contains only minimal stats, but I plan on improving it based on the comments) Why I Built This Finding a clean, scaled, and up-to-date job dataset is surprisingly difficult. Most available options are either heavily gatekept by expensive subscription APIs or restricted to a single job board like LinkedIn. By scraping the actual employer sites directly, this collection sidesteps the noise and captures a much cleaner cross-section of the live market. How to Access It I set up a dedicated project space where you can grab the data directly: Open Job data Let me know what kind of analysis or projects you end up running with it. If you have questions about the engineering architecture behind handling this scale, or ideas for specific fields you'd like to see enriched next, let's discuss in the comments. submitted by /u/Invicto_50 [link] [留言]

I've been building out embedded reporting for b2b clients (i use next.js), and as our user base grows, the P95 latency is becoming a nightmare. Every time a user changes a date filter, it triggers a fresh compute spin-up on the warehouse. I’m currently refactoring the stack to put a universal semantic layer (in my case, cube core) between the frontend and the database. and the goal is to move all the logic, like multi-tenant row-level security (RLS) and complex joins, out of the React code itself and into a declarative modeling layer since I started, the biggest win (so far) is using pre-aggregations. now, instead of hitting raw tables, the API hits a warmed caching tier which is in the 'cubestore'. it feels more like querying a structured API than a database for those of you here who do high-concurrency analytics in SaaS, a question! are you just throwing more money at warehouse compute, are you moving toward this kind of decoupled architecture, what other best practices do you have? now trying to figure out if I should stick with this or just move everything to a huge ClickHouse instance and hope for the best submitted by /u/sivyh [link] [留言]

OpenAI calls for global action on youth AI safety, proposing an international institute to strengthen safeguards, standards, and opportunities for young people.

Why C Is Still the GOAT (And Why People Like Me End Up Hating C++) Disclaimer: This is a personal opinion from a developer who enjoys simple tools, simple languages, and simple debugging sessions. The Eternal Question Every few months, somebody asks: "Why are you still writing C in 2026?" My answer is always the same: Because C knows exactly what it is. No hidden magic. No surprise abstractions. No template metaprogramming black holes. No compiler errors longer than my source code. Just you, a compiler, and a Segmentation Fault waiting patiently around the corner. C Is Honest One thing I love about C is that it never pretends to protect me. If I allocate 8 bytes and write 16 bytes? Boom. If I dereference a bad pointer? Boom. If I forget to free memory? Boom (eventually). But here's the important part: I know exactly why I got cooked. The language didn't hide anything from me. C basically says: "Here's the loaded foot-gun. Try not to shoot yourself." And honestly? I respect that. Meanwhile in C++ C++ often feels like this: template < typename T > concept SomethingComplicated = requires ( T t ) { // 300 lines of magic }; Then the compiler responds with: error: instantiation of recursive template ... required from ... required from ... required from ... required from ... ...followed by 14 pages of diagnostics. At this point, I'm no longer debugging my code. I'm debugging the language itself. My Personal Villain Origin Story I started using Visual C++. You know. The gigantic Microsoft ecosystem. The IDE. The project files. The build settings. The mysterious compiler flags. Eventually I found myself spending more time fighting tools than writing software. And somewhere along the way, I started associating that frustration with C++ itself. Fair or unfair? Probably unfair. But emotions aren't always rational. Modern C++ Feels Like Three Languages Wearing a Trench Coat Old-school C++? Pretty understandable. Modern C++? Sometimes it feels like: C Object-Oriented C++ Template

Security is not a feature you bolt on after launch. It is not the CISO's problem alone. It is not a checklist you run through before a compliance audit. It is a shared responsibility across every engineer, every team, every layer of the stack. This guide walks through the three layers where most web vulnerabilities live — Frontend , In Transit , and Backend — using a threat modeling lens: thinking like an attacker so you can build like a defender. What Is Threat Modeling? Before writing a single line of defensive code, you need to think systematically about your system's attack surface. Threat modeling is the process of: Identifying entry points — Where does untrusted data enter your system? Form inputs, URL parameters, uploaded files, third-party APIs? Assessing potential impact — If this entry point is exploited, what can an attacker access or do? Designing defenses proactively — Before the exploit occurs, not after. It shifts your mindset from "let's hope nothing breaks" to "let's assume something will be tried." Part 1 — Frontend Security: Stopping XSS What Is XSS? Cross-Site Scripting (XSS) happens when untrusted data is rendered as executable code in a browser. An attacker injects a script; your application runs it on behalf of your users. The consequences are severe: session hijacking, credential theft, defacement, redirects to malicious sites. There are three flavours: ┌─────────────────────────────────────────────────────────────────┐ │ XSS TYPES │ ├──────────────────┬──────────────────────────────────────────────┤ │ Stored XSS │ Malicious script saved in your DB, │ │ │ served to every user who loads that data. │ │ │ Most dangerous — persistent and broad. │ ├──────────────────┼──────────────────────────────────────────────┤ │ Reflected XSS │ Script lives in a URL parameter. │ │ │ Requires tricking the user into clicking │ │ │ a crafted link. Temporary, per-request. │ ├──────────────────┼──────────────────────────────────────────────┤ │ DOM-Based XSS │ Entir

When I started learning JavaScript, I thought the hardest part would be understanding syntax. It wasn’t. The hardest part was going from tutorials to actually building something on my own. You watch a few videos, learn map , filter , and reduce , and everything feels manageable. Then you try to build even a simple project and suddenly nothing works anymore. Errors everywhere. Logic breaking for no reason. You spend 40 minutes debugging something only to realize you misspelled a variable name. That phase is frustrating, but it’s also normal. Here are a few things that genuinely helped me get past it. Stop Trying to Memorize Everything Early on, I wasted a lot of time trying to memorize array methods and syntax. That was a mistake. You do not need to remember everything. You just need to know what exists and roughly when to use it. The rest can be searched in seconds. The basics matter more than memorization: Variables ( let and const ) Conditions ( if / else ) Loops Functions Arrays and objects Basic DOM selection That foundation carries you much further than trying to memorize every method on MDN. Even experienced developers still look things up constantly. Arrays Started Making Sense When I Stopped Overcomplicating Them For a long time, I thought my code had to look “advanced.” It doesn’t. Sometimes a simple loop is enough. let numbers = [ 1 , 2 , 3 , 4 , 5 ]; let result = []; for ( let i = 0 ; i < numbers . length ; i ++ ) { if ( numbers [ i ] > 2 ) { result . push ( numbers [ i ] * 2 ); } } Is it the shortest solution? No. Does it work? Yes. You can always refactor later after your logic makes sense. Objects Are Just Organized Data Objects confused me at first because people explained them in complicated ways. In reality, they’re just containers with labels. let user = { name : " Alex " , age : 29 , hobbies : [ " coding " , " coffee " ] }; console . log ( user . name ); That’s most of what you need to understand at the beginning. Functions Became Easier Once I Th

If you write code for Adobe Commerce or Magento 2, you spend a lot of time waiting. Build times are slow, static content deployment takes forever, but the real time sink is documentation. The EAV architecture, nested XML layouts, and ever-changing GraphQL mutations mean you are constantly Alt-Tabbing to a browser to double check a syntax pattern. Every time you leave your IDE to search the Experience League portal, you lose your train of thought. You copy error codes, dig through unrelated search results, and try to find a working code snippet. It is exhausting. I wanted my coding assistant to just know this stuff without making me look it up. That is why I configured this MCP server. The adobe-commerce-docs-mcp package connects your IDE directly to the official Adobe documentation. It works with Cursor, Claude Desktop, VS Code, and Windsurf, pulling raw markdown docs right into your chat context. The architecture: bridging AI and docs Instead of relying on web search or stale training data, the server queries the live Adobe Experience League site. It indexes the content locally, caches pages, and handles queries via the MCP protocol. 1. BM25 search ranking The server parses the official Adobe sitemap and ranks pages using BM25 relevance scoring. This is the same search algorithm databases use to weigh search term frequency against document length. It means your assistant gets the most relevant setup guide first, not just the page that mentions a keyword the most. 2. Synonyms and fuzzy matching You do not have to query exact terminology. The search engine maps Magento specific synonyms: graphql searches also find pages with gql module searches also match extension cloud searches match ece It also corrects simple typos like chekout or catlog to checkout and catalog. 3. Local caching Network requests are slow, so the server uses two layers of caching: An in-memory cache for recent queries. A persistent file cache on your disk. Sitemap data lasts 24 hours, while downlo

Switching focus from Frontend development to Data Engineering means shifting from building user interfaces to architecting robust data pipelines. It’s a completely different mindset, and the learning curve is exciting! As I dive deeper into the world of Data, these are the 4 essential tools and concepts that have become the absolute backbone of my daily learning roadmap: 1️⃣ Python (The Swiss Army Knife): Coming from JavaScript/TypeScript, picking up Python has been a breath of fresh air. From writing custom ETL scripts to data manipulation with Pandas, it's the ultimate language for data manipulation. 2️⃣ Advanced SQL (The Core): It's not just about simple SELECT statements anymore. Mastering Window Functions, CTEs (Common Table Expressions), and query optimization is where the real magic happens when interacting with Data Warehouses. 3️⃣ ETL/ELT Pipelines: Understanding how to efficiently Extract, Transform, and Load data without breaking downstream analytics. Moving from UI state management to Data state management is a game-changer. 4️⃣ Cloud Ecosystems & Modern Stack: Exploring how data flows through modern cloud environments and learning how big data tools manage scale. The transition requires patience, but applying my previous engineering background to these new tools makes the journey incredibly rewarding. 💡 To the Data Engineers in my network: What is the one tool or concept you believe is a "must-have" for someone transitioning into the field today? Drop your advice below!

Most people use these technologies every day. Almost nobody knows they exist. Every time you open YouTube, browse Instagram, join a Zoom meeting, or play an online game, your router is quietly performing a series of networking tricks behind the scenes. Those tricks have names: NAT SNAT DNAT PAT Port Forwarding They sound intimidating. They're actually much simpler than they appear. Let's break them down using something familiar: your home Wi-Fi. The Problem the Internet Had to Solve Imagine a family of five living in one house. Everyone owns a device: Laptop Phone Smart TV Gaming Console Tablet Each device needs internet access. The problem? Your Internet Service Provider usually gives you only one public IP address . Something has to manage all those devices sharing a single internet connection. That's where NAT comes in. NAT: The Receptionist of Your Network NAT stands for Network Address Translation . Think of NAT as a receptionist in an office building. People inside the building have room numbers: Laptop = Room 101 Phone = Room 102 TV = Room 103 But when communicating with the outside world, everyone uses the building's main address. The receptionist keeps track of who sent what. Your router does exactly the same thing. What Happens When You Visit Google? Inside your home: Laptop 192.168.1.10 Your router: Public IP 49.x.x.x When you open Google: 192.168.1.10 ↓ Router ↓ 49.x.x.x ↓ Google Google never sees your private IP. It only sees your router's public IP. That's NAT in action. SNAT: Changing the Sender's Address SNAT stands for Source Network Address Translation . The keyword is: Source It changes the sender's address. Before leaving your network: Source: 192.168.1.10 After SNAT: Source: 49.x.x.x The router replaces your private IP with its public IP. Without SNAT, websites wouldn't know how to send responses back to you. Real-Life Example Imagine mailing a letter. Instead of writing your bedroom number as the return address, you write the house address. Tha

Google has released a new CLI for Google Workspace, offering a unified interface for various services like Drive, Gmail, and Calendar. Built in Rust, the tool dynamically adjusts to API changes and features over 100 bundled skills. It requires Node.js and a Google Cloud project for setup. Initial community feedback is mixed, highlighting both its dynamic capabilities and setup challenges. By Daniel Curtis