标签：#c

GitHub热门项目 | 《深入理解 AI Agent：设计原理与工程实践》（李博杰 著）开源主仓库：全书正文、编译版 PDF 与按章配套代码 | Stars: 5,299 | 1,734 stars today | 语言: Python

Last week I was reviewing the staking engine of a protocol before its mainnet launch. Deep in a 1,400-line contract, I found what looked like a serious bug. The reward math multiplied three values before dividing: uint256 delta = (lot.amount * rBase * midpointRate) / (RAY * RAY); Multiply-before-divide. If that intermediate product overflows uint256 , the whole epoch settlement reverts — and since every stake , withdraw , and setStake runs it, the post's funds get permanently frozen . That's a High-severity, fund-locking DoS. I had the finding half-written. lot.amount can reach 10M tokens ( 1e25 ). rBase grows with elapsed time. midpointRate can hit RAY . Multiply those and you blow past 2^256 ... I was ready to send it. Then I did the one thing that separates a real audit from false-positive spam: I checked the actual constants before writing the claim. uint256 private constant RAY = 1e18; // I'd assumed 1e27 RAY was 1e18 , not the 1e27 I'd been carrying in my head. And the interest rate had a hard cap — MAX_RATE_MAX_RAY = 5e18 , enforced even against a fully-captured timelock. I ran the numbers with the real values: For that multiplication to overflow, the protocol would need to go 2.3 × 10¹⁵ years without a single state update. Not reachable. The bug didn't exist. I deleted the finding. Why this matters more than the bug would have If I'd sent that report, here's what happens: the team's engineer clones the repo, plugs in the real constants, and realizes in ten minutes that I flagged an overflow that can't happen. Every other finding in my report now gets read with a raised eyebrow. My credibility — the entire product — is gone. This is the dirty secret of automated smart-contract auditing: the bottleneck isn't finding issues. It's not drowning the real ones in false positives. Anyone can run a scanner and paste 40 "criticals." A team that has to triage 40 flags to find the 2 that matter will — correctly — stop trusting you. The bar I hold: zero false positives o

.The V8 engine speeds up JavaScript by dynamically compiling frequently run bytecode into optimized native machine code. However, if you pass inconsistent argument types to these optimized functions, V8 panics and deoptimizes back to bytecode. Keeping your functions monomorphic (single-typed) prevents this costly deoptimization loop, ensuring maximum runtime execution speed. If you’ve spent as much time digging into V8 execution flags as I have, you quickly realize that JavaScript is constantly rewriting itself under the hood. We like to think of JavaScript as a dynamically typed scripting language. But at runtime, engines like V8 are working tirelessly to turn your code into a highly optimized, statically typed powerhouse. When we violate that type stability, we pay a massive performance tax. How does the V8 engine optimize JavaScript at runtime? V8 uses a multi-tiered compilation pipeline that starts with an interpreter for fast startup times, then upgrades hot functions to optimized machine code using a JIT compiler. By tracking runtime type patterns, the engine can safely make assumptions to skip expensive dynamic lookups. When I look at V8’s execution pipeline, I see two primary systems working in tandem: Ignition (the interpreter) and TurboFan (the JIT compiler). Initially, Ignition compiles your raw JavaScript into bytecode so your app can boot instantly. As this bytecode executes, V8 allocates a data structure called a Feedback Vector for each function. Inside this vector are Feedback Slots (managed by Inline Caches, or ICs). These slots act as recorders, capturing the exact types (or "shapes") of the variables passing through your code. Once a function runs frequently enough to cross an execution threshold, V8 marks it as "hot" and hands it to TurboFan. TurboFan reads those feedback slots, assumes the types will remain identical in the future, and compiles a highly streamlined, native machine code version of that function. What happens when you pass differe

Modern web applications demand responsive, non-blocking user flows. This tutorial demonstrates a production-grade implementation for handling form submissions without full-page reloads using the native Fetch API and clean async/await syntax. The Complete Source Code Create a file named app.js and drop in the following event-driven architecture: JavaScript document.getElementById('registrationForm').addEventListener('submit', async (event) => { event.preventDefault(); // 1. Stop full page reload const form = event.target; const formData = new FormData(form); const submitBtn = form.querySelector('button[type="submit"]'); const responseMessage = document.getElementById('responseMessage'); // 2. UI Feedback: Disable button during network request submitBtn.disabled = true; submitBtn.textContent = 'Processing...'; responseMessage.textContent = ''; try { // 3. Asynchronous Fetch Request const response = await fetch(form.action, { method: 'POST', body: formData, headers: { 'X-Requested-With': 'XMLHttpRequest' } }); // 4. Status Code Validation if (!response.ok) { throw new Error(`HTTP error! Status: ${response.status}`); } const result = await response.json(); // 5. Dynamic UI State Handling if (result.success) { responseMessage.style.color = '#155724'; responseMessage.textContent = result.message; form.reset(); // Clear form on success } else { responseMessage.style.color = '#721c24'; responseMessage.textContent = result.error || 'Submission failed.'; } } catch (error) { // 6. Global Error Catching responseMessage.style.color = '#721c24'; responseMessage.textContent = 'A network error occurred. Please try again.'; console.error('Submission tracking error:', error); } finally { // 7. Reset UI State Guaranteed submitBtn.disabled = false; submitBtn.textContent = 'Submit Data Securely'; } }); The Problem with Synchronous Form Lifecycles Traditional submissions trigger a synchronous navigation cycle: the browser constructs a payload, issues a full HTTP request, and replaces the

Understand anything online without leaving the page. Discussion | Link

This is a submission for DEV's Summer Bug Smash: Clear the Lineup powered by Sentry . Project Overview Formbricks is an open-source survey and experience management platform built with Next.js, TypeScript, React, and Tailwind CSS. It lets teams create and deploy surveys across websites, apps, and email. Developers can self-host it or use the cloud version. With over 12,000 GitHub stars and hundreds of contributors, it is one of the most actively maintained open source alternatives to Qualtrics. Bug Fix or Performance Improvement Formbricks supports custom regex validation rules on survey questions. A survey creator can set a pattern that user responses must match before they are accepted. The problem was in how that pattern was stored. The validation schema for regex pattern rules only checked that the input was a non-empty string: // Before the fix export const ZValidationRuleParamsPattern = z . object ({ pattern : z . string (). min ( 1 ), flags : z . string (). optional (), }); z.string().min(1) means "give me any string with at least one character." It does not verify that the string is actually a valid regular expression. So a survey creator could type [invalid as their pattern, the schema would accept it, it would be saved to the database, and then when a real user submitted a response, the system would try to run new RegExp("[invalid") , JavaScript would throw a SyntaxError , and the survey would crash silently at runtime. The bug never surfaced during setup. It only appeared when a real user was trying to submit a real response. Code Pull Request: github.com/Tobore005/formbricks/pull/1 Here is the fix: const isValidRegexPattern = ( pattern : string ): boolean => { try { new RegExp ( pattern ); return true ; } catch { return false ; } }; const isValidRegexFlags = ( flags : string | undefined ): boolean => { if ( flags === undefined ) return true ; try { new RegExp ( "" , flags ); return true ; } catch { return false ; } }; export const ZValidationRuleParamsPa

So I've been working on this app for a very long time now. Started off by wanting an app that separates long form notes from short form notes visually and keeps everything organized on a canvas. The app features: -Sticky notes for quick, small notes and A4 notes for long form documents -A quick mode that uses local storage to quickly open the app and jot down a thought on the canvas -A PDF export option that exports your notes into 3 custom designed PDF styles -Visual hierarchy to replicate file

Are AI Agent Engrams Open Source or Proprietary? The short answer: both, and the split matters. The major agent-memory engines — Mem0, Letta, Cognee, Graphiti, LangMem, and PLUR — are all Apache-2.0 or MIT licensed on GitHub. But "open source" and "open format" are not the same thing. A project can ship under Apache-2.0 while storing your memories in opaque vector blobs you cannot read, edit, or export. The real question is not whether the software is open — it usually is — but whether your memories are. This distinction separates the field into three tiers: fully open (software + format + data you own), open-core (software is open, but the hosted memory is not portable), and fully proprietary (memory baked into a model provider's infrastructure, no export at all). Why this question exists AI agents face a brutal constraint: they forget. Every new session starts blank. Every context window overflows. The fix is persistent memory — but persistent where, and in whose format? The term "engram" comes from neuroscience. Richard Semon coined it in 1904 for the physical trace a memory leaves in biological tissue (Semon, 1904; cited in Wikipedia, "Engram (neuropsychology)"). Applied to AI agents, an engram is one discrete thing an agent has learned — a correction, a preference, a procedure — stored so it survives across sessions. The question "open source or proprietary?" asks two things at once: Is the engine that stores and retrieves engrams open source? Is the format those engrams are stored in open — readable, editable, portable? Conflating the two is how vendors end up with open-source repos and locked-in data. Tier 1: Fully open — software, format, and data These projects ship under permissive licenses (Apache-2.0 or MIT) AND store memory in a format you can inspect, edit, and export. Project License Stars (Jul 2026) Memory format Data ownership PLUR Apache-2.0 ~215 Human-readable YAML engrams Yours — plain files PLUR stores each engram as a plain-text YAML entry — an

Scan a menu, pay a bill, onboard a smart plug, and you are using a piece of technology that was never meant for any of those things. The QR code was invented in 1994, and its original job was tracking car parts on a factory floor. Understanding why it was built the way it was explains why it now shows up on nearly every connected device. Who invented the QR code The QR code was created in 1994 by a team led by engineer Masahiro Hara at Denso Wave, a subsidiary of the Toyota group in Japan. At the time, the automotive industry ran on standard one-dimensional barcodes, the striped labels still seen on grocery products. Those barcodes held very little data, usually around 20 characters, and a busy assembly line often needed a worker to scan ten different labels on a single box of components. It was slow, and it was error-prone. Hara wanted a code that could store far more information and be read much faster. His answer was to go two-dimensional: instead of encoding data only in the width of vertical bars, a QR code (short for "Quick Response") stores data across a grid of black and white squares, packing in thousands of characters in a fraction of the footprint. The board game that shaped it The most famous detail of the QR code's origin is where Hara found his design inspiration. He was reportedly playing the board game Go on a lunch break, staring at the black and white stones arranged on the grid, when the idea of encoding information in a two-dimensional matrix of light and dark cells clicked into place. The harder problem was speed. A scanner needs to find the code and figure out its orientation before it can read anything, and in a factory a label might be rotated any which way. Hara's team solved this with the three distinctive square markers in the corners of every QR code. Those "position detection patterns" use a ratio of black to white areas that almost never occurs by chance in printed material, so a scanner can instantly locate the code and work out its an

Some commands you can walk back. Terminating an EC2 instance is not one of them. Day 14 paired a recoverable problem, a web server knocked over by a rogue process, with an unrecoverable one, deleting a server on purpose, and the contrast is the whole lesson. One Linux task, one AWS task. Track down the process blocking Apache and restore the service, then terminate an EC2 instance and confirm it is gone. The tasks come from the KodeKloud Engineer platform. httpd: diagnose in order, then restore When httpd will not start, resist the urge to guess. Work in order. Start with what the service itself reports: # What does httpd think is wrong systemctl status httpd systemctl start httpd The status output usually names the problem, and a failed bind on the port is the classic one. Before assuming a rogue process, check that httpd's own config is sane, because a wrong port or hostname produces the same "won't start" symptom: # Check the configured listen port and server name grep -i listen /etc/httpd/conf/httpd.conf vi /etc/httpd/conf/httpd.conf # Fix the ServerName directive if it is wrong: ServerName hostname:<port> If the config is fine and the port is genuinely taken, then you go hunting for the process holding it: # Find the PID on the conflicting port sudo su - yum install -y net-tools netstat -tulpn # Clear it, then bring httpd back kill -9 <PID> systemctl enable httpd systemctl start httpd systemctl status httpd kill -9 is SIGKILL, the instant, no-cleanup kill. It is the right tool when a process is wedged and ignoring a polite request, but as a default habit, it is worth trying a plain kill first. The order that matters here is diagnostic: config before process, gentle signal before forceful one. Rushing to kill -9 at the first sign of trouble is how you mask the real cause instead of fixing it. Terminating EC2: the command with no undo Day 9 was about protecting an instance from termination. Day 14 is the other side of that lever, actually terminating one, on purp

Just why? ʅ͡͡͡͡͡͡͡͡͡͡͡(̸̢̛̼̞̭͋ͅ)̸͚̰͛̔̾̀̿͒͂:̴͓̞̑̌̂̆̊͋̀:̸͎̟̯̂̓̌ ҉ ͡ ͞ ͞ ͞ ҉● ࿀ ● ࿀ ● ҉⃝ ⃝͢ ͞ ͘ ͞⃝̕ ͢ ̛ ⃝ ̸ ̡ ͢⃝̧ ͡ ͡ ̀ ̧ ̢⃝͜ ҉ ͞ ͞ ⃝͞ ͞ ͡⃝ ⃝҉҈҉҈҉҈҉҈҉҈҉ :̶̢͙͙͕̠̩͆(̷̮͍͚̫͚͂̍)̵̳̗̊( ̟̞̝̜̙̘̗̖҉̵̴̨̧̢̡̼̻̺̹̳̲̱̰̯̮̭̬̫̪̩̦̥ What am I supposed to do with this? It's un-Googleable. Unpronounceable. It doesn't even render the same way on various platforms. It looks one way on YouTube Music. Another on Apple Music. And yet another on Bandcamp. Even the artist name ⣎⡇ꉺლ༽இ•̛)ྀ◞ […]

Hi, I'm Cesar, a Senior Software Engineer with 10+ years of experience. In 2023, I got sick and...