AI 资讯
103. Agent Memory: Short-Term, Long-Term, and Episodic
Agent Memory: Short-Term, Long-Term, and Episodic Main Thumbnail Image Prompt: A human brain cross-section illustration in neon tones on dark background. Three regions clearly demarcated and labeled. The hippocampus region glows blue, labeled "Episodic Memory: what happened." The prefrontal cortex glows orange, labeled "Working Memory: what I'm doing now." A network of distributed nodes glows green, labeled "Semantic Memory: what I know." Arrows show information flowing between regions. Scientific but accessible, the memory architecture made neural and visual. Memory Architecture Diagram Image Prompt: Four storage boxes arranged vertically on dark background. Top: "In-Context Window (Working Memory)" — fastest, smallest, temporary, shown as RAM chip icon. Second: "External Vector Store (Semantic Memory)" — fast retrieval, persistent, shown as cylinder with search icon. Third: "Key-Value Store (Episodic Memory)" — structured facts, shown as database icon. Bottom: "Fine-Tuned Weights (Procedural Memory)" — slowest to update, most permanent, shown as brain with lock. Arrows showing read/write speeds between boxes. Clean, technical, the hierarchy is the insight. Memory Retrieval Flow Image Prompt: A query arrives at an agent on the left. Four parallel arrows go right to four memory sources: conversation history (short chat bubbles), vector database (semantic search visualization), structured database (table icon), model weights (brain icon). Each source returns relevant items. A "Memory Fusion" box on the right combines the results. The agent sees an enriched context. The retrieval from multiple stores is the architecture. Every conversation with an LLM starts from zero. You explain your project. You explain your preferences. You explain your constraints. You spend five minutes providing context. You come back tomorrow. You do it all again. The model remembers nothing between sessions. The context window closes. The state is gone. Every interaction is the agent's first
AI 资讯
Introduction to n8n: Beginner Course Summary
In this blog, I’ll give a clear brief summary of the n8n beginner course . You can watch the full video course on the official n8n website (link in the references below). What is n8n? n8n is a powerful workflow automation platform that combines AI capabilities with business process automation. It offers a node-based visual interface while giving you full control to write custom JavaScript or Python code directly in the canvas. APIs and Webhooks Understanding APIs An API (Application Programming Interface) allows different applications to communicate with each other. Almost every modern app has an API you can connect to. Example: Google Sheets API lets you read or update data in spreadsheets. When working with APIs, we make requests and receive responses . Components of an HTTP Request There are four main components: URL – The unique address of the resource (page, image, data, etc.). Includes: Scheme, Host, Port (optional), Path, Query Parameters (optional). Method – Defines the action you want to perform: GET – Retrieve data POST – Send data PUT / PATCH / DELETE – Update data (less common) Headers – Provide additional context (language, device type, location, etc.). Body – Contains data being sent (used mainly with POST requests). Authentication (Credentials) To prove you’re allowed to make a request: API Key (via query parameter or header) OAuth (most secure common method) HTTP Response Components Status Code – Tells if the request was successful: 200 = Success 401 = Unauthorized 404 = Not Found 500 = Server Error Headers – Metadata about the response (content type, length, expiration, etc.). Body – The actual data returned (usually JSON, HTML, or binary). What are Webhooks? Webhooks are used when an external service needs to notify your workflow automatically (e.g., every time a payment is made in Stripe). You provide a URL that receives a POST request when the event occurs. Nodes in n8n Nodes are the building blocks of every workflow. There are three main categor
AI 资讯
Great Stack to Doesn't Work Bonus: SQL vs NoSQL: Which One in 2026?
The honest decision framework, not another flame war. The SQL vs NoSQL debate has been running for 15 years and it still generates more heat than light. Here's the framework that actually helps you decide. The Real Question It's not "SQL or NoSQL." It's: what does your access pattern look like? If your application is mostly reading and writing related data through well-defined queries — orders with line items, users with addresses, products with categories — relational databases are purpose-built for this. JOINs are not expensive when they're indexed. Transactions are not slow when they're scoped correctly. PostgreSQL handles 50 million rows comfortably on a single node. If your application is reading and writing self-contained documents with predictable access by a primary key, and you rarely need cross-document queries — user profiles, product catalogs, content management — a document database simplifies your code. No ORM mapping hell. No migration files for adding a field. If your application writes massive volumes and reads by partition key with eventual consistency — time-series data, IoT telemetry, activity feeds at scale — wide-column stores like Cassandra were built for this specific workload. The 2026 Reality PostgreSQL has eaten NoSQL's lunch in many areas. JSONB support means you can store and query unstructured data inside PostgreSQL with GIN indexes. You get the document model flexibility without giving up transactions, JOINs, and a 30-year ecosystem. For 80% of startups and mid-size companies, PostgreSQL is the only database you need. MongoDB has gotten more relational. Multi-document ACID transactions (since 4.0), schema validation, aggregation pipelines that look suspiciously like SQL. It's converging toward what PostgreSQL already does, but with a different starting point. DynamoDB dominates serverless. If you're in AWS and your access pattern is simple key-value with known query patterns, DynamoDB's pricing model (pay-per-request) and operational s
AI 资讯
[Imposter syndrome] Back to the beginning (DevSecOps path)
I’ve been writing my project - Python port scanner for 9 months now. You might be wondering, “Why is it taking so long?” Most of the time was spent figuring out how raw sockets work, how to write a function for manually assembling a packet, calculating the checksum, packing the IP packet bytes, the TCP header, the pseudo-header using struct.pack, sending the packet, and how SYN scanning works. Why did I decide to take such a complicated route instead of just using Scapy? I’m a principled person and have a very exhausting yet useful skill—understanding everything. That’s how I got acquainted with big-endian, or “network byte order.” I won’t go into the details of big-endian logic, to be honest, I’m already mentally exhausted It took several evenings and nights to analyze and understand the principles—watching videos, reading RFCs, and looking at GitHub code (which I didn’t understand)—but what bothered me most was that I had to ask gemini for an explanation. As I mentioned above, I’m very principled; I can’t just copy code without understanding it, so I ask gemini for a prompt like this: “Don’t write the code for me. If I end up asking you for an example because I’m tired, explain it line by line.” Yesterday I realized I don’t fully understand Python (basics)—I don’t remember REPL—so I went to ask Gemini for advice; I don’t have anyone competent who could help me with advice. I’m not very sociable, and the only thing that’s interested me for the last four years is IT. I used to make music. Lately, something strange has been going on with my health, the day before yesterday I woke up because of a nosebleed; this has happened before, but on a larger scale. I stopped working on the scanner yesterday and decided to try writing a backup script in Python. I found an article and jotted down in Obsidian what the project should and shouldn’t do. Previously, the project used Docker, Prometheus, and Grafana. My questions: Am I a good developer, and am I even one at all? Should
AI 资讯
An Introduction to AI Hub, Part 2: Custom MCP Servers
Welcome back to a series of introductory articles on AI Hub, the new product feature currently in an early access program! (links: EAP Site for download, documentation ) In the last article, we covered how to create agents and agent tools directly in ObjectScript using the new %AI classes. However, sometimes, instead of creating a new agent, you just want to add some custom tools to an existing agent so you can ask your local claude code, codex, copilot or other agent of choice to query your data directly. This is where MCP Servers might come in. In this guide, we will walk through how you can create your own MCP Servers to access your data. Disclaimer: AI Hub is an early access preview, with features likely to change before production releases, any issues identified can be raised as issues on the documentation GitHub repo linked above. The EAP preview is not to be used in production settings. A very brief intro to MCP I'm going to keep this brief because there are loads of other good articles on MCP Servers Model context protocol (I recommend starting with this article from @pietro .DiLeo or this brilliant introductory video from InterSystems President Don Woodlock). Model Context Protocol is a transport protocol allowing external tools to be added to an agent . There is a discovery 'handshake' where the MCP server sends a list of tools to the MCP Client. After the tools are discovered, the agent can send requests for tool executions, including parameters, to the MCP server, which executes the tool call and returns the result. MCP servers can be remote servers, i.e. running on a different machine to a client, this usually uses a streamable http/https connection or Server-Side Events. Or MCP servers can be local servers, i.e. running on the same machine, usually using a stdio connection. An important distinction AI hub allows you to create custom MCP servers within your IRIS environment, allowing agents to access or monitor your IRIS databases, productions and statu
开发者
The Unlikely Journey from Bricks to Bytes
I'm a builder. I taught myself to run servers because freelancers kept burning my money. West London, 2021. I was standing on a site holding a cup of tea that had gone cold an hour earlier, watching a crew argue about where a wall should go. That's my actual job. Schedules, suppliers, the kind of problems that only exist at 7am when half the crew hasn't shown up and the client is already phoning. But my head was somewhere else. I'd been chewing on an idea for a classifieds platform for months. Not a grand vision, nothing with a business plan and projections. Just a gap I could see — a way to connect buyers and sellers that felt easier and more global than what was out there. The problem was that I knew nothing about programming. And I mean nothing. I didn't know what a database was. I'd never written a line of code. My entire technical CV was "reasonably good at not breaking my own phone." So I did what most people in my position do. I tried to buy my way in. The expensive year I found a ready-made classifieds script online. Looked professional, had features, didn't cost the earth. The smart shortcut, I told myself. Then I hired a freelancer to customise it. Then another one, when the first disappeared mid-project. Then another, when the second delivered something that worked on a good day and fell over on a bad one. Here's the thing nobody warns you about hiring freelancers when you can't read code: you can't judge the work. You can't tell the difference between someone who wrote something clean and someone who duct-taped it together to last until the invoice clears. Both show you the same thing — a screen where the button does what the button's meant to do. So you pay, you say thanks, you move on. And three months later the button stops working and the freelancer's gone. Meanwhile the bots had found me. Within weeks of going live, automated scripts were hammering the contact form, then the registration page, then the login. "It's normal," a freelancer told me. "Ha
AI 资讯
CSRF, and the cookie flag
<form action= "https://bank.com/transfer" method= "POST" > <input name= "to" value= "attacker" > <input name= "amount" value= "10000" > </form> <script> document . forms [ 0 ]. submit () </script> Five lines of HTML on a malicious page. When a user who's logged into bank.com in another tab visits this page, the browser auto-submits the form, attaches their session cookie, and ten thousand dollars leave their account. They didn't click anything. The malicious site didn't see their password. There was no XSS, no breach, no leak in the traditional sense. The browser did exactly what it was designed to do. That's CSRF — Cross-Site Request Forgery — and it's been the classic "confused deputy" attack on the web for two decades. Let's walk through what makes it work, why CORS doesn't help, and the one cookie flag that mostly killed it around 2020. Why the browser attaches your cookie to that request Cookies belong to a domain. When you log into bank.com , the bank sets a session cookie in your browser: Set-Cookie: session=abc123; HttpOnly From that point on, every single request your browser sends to bank.com carries that cookie. Every page load. Every API call. Every image fetch. The browser does it automatically, without asking, and regardless of who triggered the request. That last word is the door CSRF walks through. The browser attaches the cookie based on where the request is going , not where it came from . So when evil.com triggers a POST to bank.com/transfer , the browser sees a request destined for bank.com , looks up the cookies for bank.com , and attaches them. As far as the bank's server can tell, the request looks exactly like one the user submitted from inside the bank's own page. This is the "confused deputy" idea. Your browser is the deputy. It has authority on your behalf (your cookies). And it's been tricked into using that authority for someone else's benefit. The server has no way to tell the difference, because from its point of view, there isn't one.
AI 资讯
Quark's Outlines: Python User-defined Functions
Quark’s Outlines: Python User-Defined Functions Overview, Historical Timeline, Problems & Solutions An Overview of Python User-Defined Functions What is a Python user-defined function? You can define your own function in Python using the def keyword. A Python user-defined function is made when you write a def block in your code. When Python runs this block, it creates a function object. A function object has special parts. These include its name, its list of default values, and its code. It also keeps a link to the global names from the file where it was made. You can use this object to call the function later with any valid input. Python lets you create named function objects with the def keyword. def greet ( name = " friend " ): return " Hello, " + name print ( greet ()) print ( greet ( " Mike " )) # prints: # Hello, friend # Hello, Mike The function greet is now a user-defined function. Python stores its name, code, and default values for later use. What are the special parts of a Python function? A Python function holds many facts about itself. These are called attributes. For example, __name__ holds the function name. __defaults__ is a tuple of default values. __globals__ holds the global names it can see. __code__ is a special object that stores the function’s bytecode. Python functions store their details in special attributes. def square ( x = 2 ): return x * x print ( square . __name__ ) print ( square . __defaults__ ) print ( square . __code__ . co_varnames ) # prints: # square # (2,) # ('x',) These parts let Python understand and run your function later. A Historical Timeline of Python User-Defined Functions Where do Python’s user-defined functions come from? User-defined functions in Python build on ideas from earlier languages. They let you name blocks of code and reuse them. Over time, Python added new parts to function objects—like closures, default values, and metadata—to make them more powerful. People designed ways to name and reuse logic 1958 — Fu
开发者
I Updated My GitHub Auto-Commit Desktop App
A few weeks ago I posted about building a desktop app that automates GitHub commits because...
AI 资讯
SQL Pattern Series #1: The Presence Pattern
Thinking in terms of existence instead of lists SQL Pattern Series #1 of 21 A collection of practical SQL patterns that help developers recognize common solutions to recurring database problems. What You'll Learn In this article you'll learn: When EXISTS and IN solve the same problem The difference between set membership and existence Why the underlying mental model matters When I typically reach for EXISTS Most SQL developers write a query like this at some point: SELECT c . CustomerID , c . CustomerName FROM Customers c WHERE c . CustomerID IN ( SELECT o . CustomerID FROM Orders o ); And it works. But sometimes it isn't the best way to think about the problem. The Question Behind the Query Many SQL problems can be framed in two different ways. Set Membership Is this value in a set? WHERE CustomerID IN (...) Existence Does at least one matching row exist? WHERE EXISTS (...) Both approaches often return the same result. But they represent different mental models. The Presence Pattern The Presence Pattern is useful when you do not actually care about the values being returned from a related table. You only care whether a matching row exists. For example: Customers who have placed an order Users who have logged in Employees assigned to a project Products that have sales In these cases, the question is often: Does a related row exist? rather than: What values are contained in this list? Example Using EXISTS SELECT c . CustomerID , c . CustomerName FROM Customers c WHERE EXISTS ( SELECT 1 FROM Orders o WHERE o . CustomerID = c . CustomerID ); The subquery is correlated to the outer query. Conceptually, SQL asks: For this customer, does at least one matching order exist? As soon as the answer becomes true, the condition is satisfied. Why This Pattern Matters Many SQL developers initially learn syntax. Over time, they discover that query writing is really about choosing the right mental model. The Presence Pattern encourages you to think in terms of: existence relationshi
AI 资讯
You'll not be replaced by AI if ...
There are many reasons why one may not be replaced by AI, not even by a possible future ASI. Here's one reason that may just apply to you! ❤️ You'll not be replaced by AI if you can generate creative ideas faster than AI can implement them! 🫡🚀 Note for critics: Current AI models (as of May, 2026) are not advanced enough to implement complex ideas without human interventions. But even if a possible future Artificial Super Intelligence (ASI) implementation can do so, laws of physics like massive energy requirements, environmental concerns etc. will prevent the implementation to replace the work of Billions of people world-wide. Our hardware advancement rate is far far slower compared to our software advancements. We humans are far more efficient and compatible to planet earth compared to the hardware we've invented. Fayaz Follow A Software Engineer who is not afraid of being replaced by AI, loves coding and writing with and without using AI, and values human life and human dignity far more than technological advancements.
AI 资讯
You're Using Git Wrong — How Worktrees Will Change Your Workflow Forever
You have a pull request open. Tests are failing. Your PM asks you to fix a production bug — right now. You have two choices: Stash your current work, switch branches, fix the bug, switch back, unstash Clone the entire repo again to a separate folder Both are terrible. But there's a third option most developers don't know about. What Are Git Worktrees? A worktree is a linked copy of your repository that lets you check out a different branch in a separate directory — without switching your current working tree. # While working on feature/login, create a worktree for a hotfix git worktree add ../project-hotfix fix/production-crash # Fix the bug in a SEPARATE directory cd ../project-hotfix # ... make changes, commit, push ... cd ../project # You're STILL on feature/login. Nothing stashed, nothing lost. No stashing. No cloning. No context switching overhead. Why This Is a Superpower 1. Parallel Branches Without the Pain # Review a PR without touching your current work git worktree add ../pr-review feature/new-dashboard cd ../pr-review git log --oneline -5 # Check the commits npm test # Run the tests cd ../project git worktree remove ../pr-review 2. Side-by-Side Comparison Want to compare your branch against main? Open them in two editor windows: git worktree add ../project-main main # Now open ../project/ (your branch) and ../project-main/ (main) side by side 3. CI Debugging Without Stopping Everything # Keep working on feature/x while debugging CI on a specific commit git worktree add ../ci-debug 7a3f9e1 cd ../ci-debug npm ci && npm test # ... debug CI failure without touching ../project/ 4. Documentation and README Updates The classic "quick fix while in the middle of something": git worktree add ../docs-update main cd ../docs-update # Edit README, commit, push cd ../project git worktree remove ../docs-update # Back to your feature branch, zero context loss The Workflow That Changed My Life Here's my daily workflow now: # Monday morning: start feature git checkout -b f
AI 资讯
I'm 15, Built My First Real Project in 4 Days, and Put It on Gumroad
I'm 15 and Built an AI Energy Dashboard with Next.js 15 + Groq Hey Dev.to! 👋 I'm a 15-year-old student developer from South Korea. I just finished my first real production project — FuelScope AI. What is it? An energy market intelligence dashboard that uses Groq's Llama 3.3 70B to summarize real energy news in real time. 🔗 Live Demo: https://fuelscope-ai.vercel.app What it does ⛽ Regional gas price cards 📈 Energy stock tickers (XOM, CVX, SHEL) 🤖 AI-summarized energy news (Llama 3.3 70B via Groq) 🗺️ Interactive Mapbox station map 📍 GPS nearest station finder 🎨 Apple-inspired clean design Tech Stack Next.js 15 + TypeScript Tailwind CSS Groq API (Llama 3.3 70B) — FREE tier GNews API — FREE tier Mapbox GL JS Vercel deployment What I learned This was my first time building something with: Real API integrations AI summarization pipeline Production deployment on Vercel Apple design system principles Honestly learned more in 4 days building this than months of tutorials. Honest disclosure Gas prices and stock data are mock values — the README includes guides for swapping in real APIs (EIA, Alpha Vantage, etc.). The AI news summaries are 100% live though. Template I'm selling the template for $19 on Gumroad if anyone wants to build on top of it: 👉 https://LZF01.gumroad.com/l/djzoaj Would love any feedback from the community! 🙏 Built with Next.js 15, Groq, GNews, Mapbox
AI 资讯
Learning Progress Pt.22
Daily Learning part twenty-two. I haven't been active in three days due to Eid Al‑Adha. On Tuesday I went to my family house, where we go once in a while. We call it the family house because that's where my grandmother, uncles, aunts, and cousins live. I didn't bring my laptop with me because I wanted to spend some time with my family, which I haven't done in months. I stayed there for the two days of Eid. Today I came back by bus. I was supposed to arrive at 17:00, but due to traffic I arrived at 18:40. When I arrived I ate a small sandwich and got back to work. I started the session at 19:30. The first thing I did was complete the HTML Tables section. It was difficult to learn (at least for me). It covered HTML Tables, Table Borders, Table Sizes, Table Headers, Padding & Spacing, Colspan & Rowspan, Table Styling, Table Colgroup, Exercises, and finally the Code Challenge. Then I did a quiz and the Unit 2 test in Khan Academy and also completed one lesson in Unit 3. Now I have started a Tic‑Tac‑Toe challenge in Python. I watched a video on the minimax algorithm, which the game uses. I have started coding, but I am far from finishing it. I am ending today's session at 23:40. Eid Al‑Adha Mubarak to all Muslims. "Speak good or remain silent." Prophet Muhammed (peace be upon him)
AI 资讯
I Built a Simple Web App to Discover the Meaning Behind Names 🚀
Hello Dev Community 👋 I recently built my first web project called Namastra — a simple tool to explore the meanings, origins, and insights behind names. 👉 Live Demo: 💡 Why I built this I noticed that many people are curious about: What their name means Where their name comes from What personality or cultural meaning it carries But most websites are: Too slow Full of ads Hard to navigate So I decided to build something simple, fast, and clean. ⚙️ What Namastra does With Namastra, users can: 🔍 Search any name instantly 📖 Get meaning and origin 🌍 Learn cultural background ⚡ Use a clean and fast interface 🛠️ Tech Stack I built this project using: HTML CSS JavaScript GitHub (version control) Netlify (deployment) Hosted here: [Netlify] Code managed via: [GitHub] 🚧 Challenges I faced As a beginner developer, I faced challenges like: Designing a clean UI Making search functionality smooth Deploying with GitHub + Netlify Structuring data properly But I learned a lot through building it step by step. 🎯 What I learned How to build and deploy a full project How important UI simplicity is How real users think differently than developers How deployment pipelines work (GitHub → Netlify) 🚀 Future improvements I plan to add: More name data Better UI design Categories (religion, origin, country) Possibly AI-based name insights 🙌 Feedback welcome This is my first real web project, so I’d really appreciate your feedback and suggestions. Try it here: 👉 Thanks for reading ❤️ Happy coding!
AI 资讯
Python Day Three – Lists, Indices, and Packing Your Virtual Backpack 🎒
Welcome back to Day 3, Python dynamic duo! 🚀 If you survived Day 2 , you now know how to create variables and throw strings, integers, floats, and booleans into their own little cardboard boxes. 📦 But what happens when you’re building a game and your character needs an inventory? Or you're making a shopping list app? Creating 50 different variables like item1, item2, item3 will make you want to throw your router out the window. 🪟💻 Today, we are leveling up our storage game. We are moving out of single cardboard boxes and packing a Virtual Backpack: Enter Lists! 🎒🎉 🎒 What is a List? In Python, a List is a data structure used to store a collection of items in one single variable. Think of it like a backpack where you can stuff multiple things inside, keep them in a specific order, and pull them out whenever you need them. Creating a list is simple. You use square brackets [] and separate your items with commas: # Packing our survival backpack 🗺️ backpack = [ " map " , " flashlight " , " water bottle " , " protein bar " ] print ( backpack ) # Prints: ['map', 'flashlight', 'water bottle', 'protein bar'] The coolest part? Python lists don’t care what you put inside. You can mix strings, integers, and booleans all in one single backpack (though usually, it makes the most sense to keep similar things together). 🤯 The First Rule of Coding Club: We Start Counting at Zero! Here is where programming turns your brain upside down. 🧠🙃 If I asked you what the first item in our backpack list is, you’d logically say "map". And you'd be right in human language. But in Python-speak, computer memory starts counting at 0. This is called Indexing. To pull a specific item out of your backpack, you write the name of the list followed by the item's position (index) inside square brackets: backpack = [ " map " , " flashlight " , " water bottle " , " protein bar " ] # Pulling out the items using their index 🔍 print ( backpack [ 0 ]) # Prints: map (The absolute first item!) print ( backpack [
AI 资讯
How to Build a Coffee Subscription on Shopify That Actually Retains Customers (A Practical Guide)
If you've ever built or set up a subscription experience on Shopify for a coffee brand, you've probably run into the same problem most merchants face: The signup flow works great. The first order goes out. And then subscribers start quietly disappearing before the third delivery. This isn't a coffee problem. It's a subscription infrastructure problem — and it's almost always caused by the same handful of missing pieces in the system underneath the storefront. In this guide I'll walk through the practical setup decisions that actually move the needle on retention for coffee subscription businesses on Shopify — from choosing the right model and pricing structure to the fulfillment calendar, dunning logic, and cancellation flow that most setups skip entirely. Why Coffee Works So Well as a Subscription Product Before getting into setup, it's worth understanding why coffee is genuinely one of the better products to build a subscription around — when the infrastructure supports it. Predictable consumption cycle. A 12-oz bag of whole beans lasts roughly two to three weeks for a single drinker. That natural rhythm makes it easy to design a billing and delivery schedule that matches actual usage patterns. Daily habit. Roughly two-thirds of American adults drink coffee every day. A subscription removes the friction of reordering, and that convenience compounds into real retention over time. Freshness as a retention argument. Coffee quality degrades noticeably after roasting. Subscribers who care about quality genuinely prefer a recurring shipment over buying retail — which means freshness becomes a built-in reason to stay subscribed that most product categories simply don't have. The global coffee subscription market reached $808.8 million in 2024 and is projected to surpass $2.2 billion by 2033. The infrastructure opportunity for developers and merchants building on Shopify is real and still early. Step 1 — Choose the Right Subscription Model Before You Build The model choic
产品设计
My First Cybersecurity Writeup – VAPT Experience
Overview This is my first real-world cybersecurity VAPT experience inside an enterprise insurance company environment. I worked across network infrastructure, web applications, internal devices, and physical security — and learned how professional security assessments are actually performed beyond labs and CTFs. Introduction I am a cybersecurity enthusiast focused on SOC operations, web application penetration testing, and vulnerability assessment. In this engagement, I worked on assessing the security posture of an insurance company across its network infrastructure, devices, web applications, and physical security controls. This was my first real-world experience working in an enterprise environment, and initially I was not fully confident about the workflow. However, with the guidance and support of my senior, I was able to understand the process step by step and actively contribute to the assessment. Objective Identify security vulnerabilities across network, web, and internal systems Assess exposure of critical assets Analyze potential attack paths in the environment Evaluate basic physical security controls Scope of Work Network infrastructure assessment Web application security testing Device-level security review Basic physical security evaluation Tools Used Nessus (vulnerability scanning) Burp Suite (web application testing & request interception) Nmap (network discovery & port scanning) GVM / OpenVAS (vulnerability assessment) OWASP ZAP (automated web scanning) Wireshark (packet analysis & traffic inspection) Approach / Methodology Performed network discovery using Nmap to identify active hosts and open ports Conducted vulnerability scanning using Nessus and GVM to detect known security issues Analyzed web application behavior using Burp Suite and OWASP ZAP Intercepted and inspected HTTP/HTTPS traffic to understand request/response flow Used Wireshark to analyze packet-level communication and detect anomalies Evaluated system exposure across internal devic
AI 资讯
What actually happens when you run `go run main.go`
Hello, I'm Maneshwar. I'm building git-lrc, a Micro AI code reviewer that runs on every commit. It is...
AI 资讯
Discovering Google Lighthouse . A Small Tool That Changed How I See Web Development
Today I discovered something I honestly should have explored a long time ago: Google Lighthouse. Funny enough, revamping my portfolio is one of those projects I kept pushing forward with the classic “I’ll do it tomorrow” mindset — and somehow tomorrow kept winning. But today I finally sat down and started improving it, and during that process, I came across Lighthouse. For anyone who hasn’t heard of it yet, Google Lighthouse is an open-source automated tool designed to help developers improve the quality of web pages. You can run it on almost any page — whether it’s public or behind authentication. What immediately caught my attention is that it audits things like: Performance Accessibility SEO Best Practices And probably a few more things I’m still discovering You can run Lighthouse directly inside Chrome DevTools, through the command line, or even as a Node.js module. The process is simple: You give Lighthouse a URL, it scans the page, runs a series of audits, and then generates a detailed report showing how your website performs. What makes it powerful is that it doesn’t just tell you what’s wrong it also explains: _ Why the issue matters How it affects users And how you can fix it _ As a beginner software engineer and developer, I’m slowly realizing that writing code is only one part of building great applications. Performance, accessibility, maintainability, and user experience matter just as much. And honestly, tools like Lighthouse make the learning process feel less overwhelming because they point you in the right direction. One thing I’ll say though don’t fall into the trap of chasing a perfect Lighthouse score instead of building useful projects. A lot of developers start optimizing numbers before validating whether the product itself solves a real problem. Lighthouse is a guide, not the final goal. For my portfolio specifically, Lighthouse exposed a few weaknesses immediately: Large unoptimized images Accessibility issues Slow-loading assets Missing metad