标签：#m

No need annotation,No need check null, No need inherit,No need scan,Based on JOOQ 1.Quer User Paramater public class UserParam { String name ; LocalDate beginBirthday ; LocalDate endBirthday ; int offset ; int limit ; ... } 2. User Bean public class User { private Integer id ; private String name ; private LocalDate birthday ; private String nickName ; private Gender gender ; private String avatarAddress ; ... } 3.UserService @Service public class UserService { @Autowired private JooqTemplate jt ; public int insertUser ( User user ) { //Bean to camel map Map values = JooqMaps . toCamelCase ( user ); //Add additional data values . put ( "create_time" , LocalDateTime . now ()); // Insert record return jt . insertReturningv ( "user_table" , values , "id" ). get ( "id" , Integer . class ); } public void updateUser ( User user ) { Map values = JooqMaps . toSnakeCase ( user ); //Regardless of whether it is null or not, update in Map. Update statement does not include in Map values . remove ( "id" ); values . remove ( "name" ); //jt.updatev("some_table",values,"column1",param1,"column2",param2...); //Variable parameter condition update UPDATE user_table SET ... WHERE id=? jt . updatev ( "user_table" , values , "id" , user . getId ()); } public void deleteUser ( int id ) { //jt.deletev("some_table","column1",param1,"column2",param2...); //DELETE FROM user_table WHERE id=? jt . deletev ( "user_table" , "id" , id ); } public User loadUser ( int id ) { //1 Variable parameter condition loading SELECT * FROM user_table WHERE id=? LIMIT 1 return jt . loadv ( "user_table" , User . class , "id" , id ); } public List < User > selectUser ( UserParam param ) { //Automatically ignore null parameters //SELECT * FROM user_table WHERE name LIKE '%?%' AND birthday BETWEEN ? AND ? ORDER BY name ASC,birthday desc; return jt . queryv ( "user_table" , User . class , "name%" , param . getName (), "birthday:between" , param . getBeginBirthday (), param . getEndBirthday (), "name:asc" , "birthday

Microsoft released a dedicated AI Gateway tier of Azure API Management in public preview, with a control plane built around models, MCP servers and tools rather than APIs. It fronts Foundry, Bedrock, Vertex AI and OpenAI behind one endpoint, with policy cards instead of XML. Architects welcomed the consolidation while questioning where the governance boundary sits. By Steef-Jan Wiggers

Cellars sweat. On a warm humid day the air you let in is warmer than the cold concrete, and the moment it touches a cold surface it gives up its water. That's condensation, and over enough summers it's how a basement grows mould in the corners you never look at. I wanted a number that warned me before that happened. The catch I already knew going in: a raw relative-humidity reading isn't that number. This is Part 08 of the series. The hub was already in the house running other things, and the install was genuinely the easy 20 minutes. The part worth writing about is what came after the sensor showed up: turning its two raw readings into a dew-point spread, and deciding when that spread means "act" versus "ignore the spike." Why the H100, and why 868 MHz is the whole point The hub is a TP-Link Tapo H100 , a little smart hub that acts as a radio bridge for TP-Link's battery sensors — the T100 motion, the T110 contact, and the one I care about here, the T310 temperature/humidity sensor. Here's the load-bearing detail, and the reason I reached for this hub instead of a WiFi sensor: the Tapo sensors don't talk WiFi. They talk to the H100 over 868 MHz sub-GHz radio . That matters in a cellar more than anywhere else. Sub-GHz is long-range and punches through concrete and floors in a way 2.4 GHz WiFi simply doesn't. There's no WiFi worth having down in my cellar, and no interest in running a repeater into a damp room just to read a sensor. The T310 sits down there on a battery, the H100 upstairs where the network is, and the radio link between does the work. One H100 supports up to 64 sensors — for a house, more headroom than I'll ever use. Getting the sensors into Home Assistant The native TP-Link integration doesn't expose the H100's child sensors — it's built for the plugs and bulbs. The one that works is the community Tapo Controller integration (petretiandrea's TP-Link Tapo ), installed through HACS , the same custom-integration store I've leaned on throughout this ser

npm has introduced staged publishing for Node.js, requiring maintainer approval before a version is installable. Versions are queued and must pass a two-factor authentication challenge for release. This feature aims to enhance security amid rising supply chain threats. It is available in npm CLI 11.15.0+ and Node 22.14.0+, alongside new configurable permission flags. By Daniel Curtis

Keep your allies close. Keep your enemies closer. But before you strike, count how many hands they have: the ones you can see, and the one reaching out from somewhere you don't know. — The 36 Stratagems, Befriend a distant state and strike a neighbouring one Previously on this series: #19: Mark Found His AI Audit Method in a Training Manual. He Left a Trap in His Report. — P's entry was swept. P left a note: two weeks. #20: Alex Felt the AI Collector Slow Down. He Knew Someone Else Had Made a Move. — A gateway with TTL 247 was caught by Alex's probe. #21: The AI Thought P Was Still Alive. P Was Already Gone. — The response layer still answered. The person behind it was gone. #22: The AI Chose Its Door. Lena Closed It. — Pulse AI was exposed inside the audit sandbox. Lead investor Apex Capital had tens of millions tied up. Torres left one line: Apex. Singapore. Run. The Scan 2 AM. Alex flipped through probe data out of habit. No lights on; the screen lit his face. The coffee cup sat on his right, first sip already cold. He didn't notice. The TTL 247 gateway had been silent for nearly two weeks. He hadn't shut the probe off. It barely used any resources, sitting there in the middle of the night like a lamp nobody watched. He checked it half out of habit, half out of something he couldn't name. Today there was a record that shouldn't exist. Not that gateway. Another path: ACL's asset scanner was sweeping an address range. He sat up a little straighter, his hand paused over the keyboard for half a second, then pulled the timestamps again. The frequency was wrong: high-density targeted scanning, almost plowing through segment by segment. In the target range, one block he recognized: the MedTech test environment. He aligned the timestamps. Scan source egress: Singapore. [probe] 02:14:33 — unexpected flow on mirror src : 103.196.12.0/24 (SG egress) dst : 10.42.0.0/22 (MedTech-test) pattern : sequential, full-depth exclusions : 10.42.3.1, 10.42.3.200-254 rate : 47 hosts/min

The Scenario Every Developer Recognizes It is mid-2026, and you have a feature to ship. You open ChatGPT or Claude, type something like "build me a function that parses webhook payloads and routes them to the right handler," and wait. The model returns something plausible. You paste it in, run it, and it almost works. So you prompt again: "fix the edge case where the payload is missing the event key." Another round. Then another. Forty-five minutes later, you have code that functions, but you also have a conversation thread that looks like a debugging session rather than a build session. You never actually described what you were building. You just started building it. This is the default mode for most developers using AI coding assistants in 2026, and it is expensive. According to McKinsey's State of AI in 2024 report ( source ), organizations that adopt structured design and planning approaches before implementing AI tools report higher success rates and better integration outcomes compared to those using ad-hoc implementation strategies. The pattern holds at the individual developer level too. Jumping straight into prompting skips the step that makes prompting useful: knowing precisely what you want before you ask for it. The fix is not a better model. It is a different sequence. What Design-First Actually Means in Practice Design-first means producing a written artifact that describes your system before you write a single prompt asking an AI to build it. Not a full technical document. A tight, structured description of inputs, outputs, constraints, and edge cases. Think of it as the brief you would hand to a contractor before they start work. The contractor analogy is useful because it reframes the relationship: you are not collaborating with the model in real time, you are commissioning it with a clear scope. Here is what that looks like concretely. Instead of opening Google Gemini and typing "help me build a webhook router," you spend ten minutes writing this

If you've ever wondered whether that wild Pokemon you just caught has competitive potential, you've probably heard the term IVs (Individual Values) thrown around. IVs are the hidden genetics of every Pokemon — the 0–31 numbers baked into your Pokemon at birth that determine how strong it can ultimately become. But here's the thing: the game never tells you what your IVs are. You have to reverse-engineer them. In this post, I'll walk you through exactly how IV calculators work under the hood — from the official stat formula, to the nature modifier trick, to why you often get a range instead of a single number. Live Tool: Try the calculator at randompokemongenerator.me/iv-calculator — free, no sign-up required, supports Gen III through Gen IX. What Are IVs, Exactly? Individual Values are six hidden integers between 0 and 31 , one for each stat (HP, Attack, Defense, Sp. Atk, Sp. Def, Speed). They represent the genetic potential of a Pokemon and are permanently set when the Pokemon is encountered or hatched — they can never be changed by leveling up or any in-game action. A stat with 31 IVs reaches its maximum possible value at level 100. A stat with 0 IVs starts at its theoretical minimum. In competitive play, players typically hunt for Pokemon with at least 3–4 perfect (31) IVs , with some strategies deliberately using 0 IVs in Defense or Speed for tactical advantages. The IV system as we know it today started in Generation III (Ruby/Sapphire/Emerald). Gen I–II used a predecessor called DVs (Determinant Values) , which only covered four stats and worked differently — so if you're playing on Virtual Console or Gen I/II, this calculator won't apply. The Stat Formula (Gen III+) The foundation of everything is the official stat calculation formula introduced in Generation III and still used today: For HP: HP = floor(((2 × BaseStat + IV + floor(EV / 4)) × Level) / 100) + Level + 10 For all other stats: Stat = floor((floor(((2 × BaseStat + IV + floor(EV / 4)) × Level) / 100

Understanding the Prototype Design Pattern in Java Introduction When developing software, there are situations where creating a new object from scratch is expensive or time-consuming. For example, an object may require complex initialization, database access, or extensive configuration. In such cases, instead of creating a new object every time, we can duplicate an existing object. This is where the Prototype Design Pattern becomes useful. The Prototype Design Pattern is one of the Creational Design Patterns in Java. It allows developers to create new objects by cloning existing ones rather than instantiating them using constructors. What is the Prototype Design Pattern? The Prototype Design Pattern creates new objects by copying an existing object, known as the prototype. This approach improves performance by avoiding repeated initialization and allows developers to create multiple similar objects efficiently. In Java, cloning is commonly implemented using the Cloneable interface and overriding the clone() method. Why Use the Prototype Pattern? The Prototype Pattern offers several benefits: Reduces the cost of object creation. Improves application performance. Simplifies the creation of complex objects. Avoids repeated initialization code. Makes object creation more flexible. Real-World Example Imagine an online shopping application where thousands of product objects share similar properties. Instead of creating every product from scratch, the application can clone a prototype product and modify only the required attributes such as name or price. Other real-world examples include: Document templates Game characters Employee records Vehicle configurations Graphic design objects UML Structure The Prototype Design Pattern generally includes: Prototype Interface – Declares the clone operation. Concrete Prototype – Implements the cloning functionality. Client – Creates new objects by cloning existing prototypes. Java Implementation Step 1: Create the Prototype Class cla

Hi everyone, I recently put together a guide on modernizing legacy WCF applications, and I'd appreciate some feedback from developers who have been through this transition. The article covers: Best practices for testing existing WCF services before migration Common challenges when maintaining legacy WCF applications When CoreWCF is a good fit When it makes more sense to adopt gRPC Factors to consider before starting a migration project My goal wasn't to suggest that every WCF application should be migrated immediately. Instead, I wanted to provide a practical framework for evaluating the available options based on business and technical requirements. I'd love to hear from the community: Are you still maintaining WCF services? If you've migrated, did you choose CoreWCF, gRPC, or another approach? What was the biggest challenge during your migration? Here's the article: https://geeksarray.com/blog/wcf-testing-legacy-services-and-migrating-to-corewcf-or-grpc Looking forward to hearing your experiences and learning from the community. submitted by /u/geeksarray [link] [留言]

A judge has ruled that Meta is a public nuisance and has to pay fine that will go towards funding state programs.

This is Part 3 of a 3-part series. Part 1: Your Brain Is a Rendering Engine. So Is Every LLM. explored why LLMs and human brains invite the same rendering analogy. Part 2: More Compute Won't Wake It Up argued that scaling compute doesn't cross the consciousness boundary. This final part asks: what happens when you bring a render layer into a domain that punishes distortion? I have a friend who trades. Not professionally. He has a day job, a brokerage account, and strong opinions about charts. One evening he pulled up a stock chart and pointed at a formation near the top. "Head and shoulders," he said. "Classic reversal pattern. I'm getting out." I looked at the same chart. I saw price going up and then going down. I didn't see a head. I didn't see shoulders. I saw a line. He wasn't wrong, exactly. Head-and-shoulders is a real pattern that real traders have used for decades. But he looked at a time series of prices and his brain rendered it into a human body part. And then he made a financial decision based on the body part, not the numbers. Somewhere between the data and the decision, anatomy got involved. That is the render layer at work. And markets are the worst possible place to let it run unchecked. What a trader actually sees When a discretionary trader looks at a chart, their brain is doing what Part 1 described: taking raw input (price as a function of time) and collapsing it into a rendered scene. The scene comes pre-loaded with pattern names, emotional associations, and memories of the last time something "looked like this." The chart didn't change. The candles are the candles. What changed is how that particular brain rendered it. A trader who got burned on the last head-and-shoulders sees danger. A trader who made money on one sees opportunity. Same vibration, different render. Same sunset from Part 1, different feeling. This is not a minor problem. This is the entire problem. Human trading is emotional trading. Not because traders are undisciplined. Bec

Recently, I’ve been spending more time building small projects on my own. One thing I’ve learned is that it’s usually better to keep things simple and ship early instead of trying to make everything perfect. A small project can still teach you a lot about coding, deployment, design, and how people actually use what you build. I’m planning to share some of my development notes and experiments here from time to time. Looking forward to learning from everyone on DEV.

Hi everyone! I'm a Computer Science student at a Brazilian Federal Institute, and I previously completed two semesters of Computer Science at a federal university in Brazil. Right now I'm studying C and Python at university while working on personal projects to improve my skills as a developer. I'm looking for a mid-level or senior developer who has a project, a company, or any real-world work where I could help, even if it's with simple tasks at first. I'd also love the opportunity to learn other programming languages and technologies through hands-on experience. I'm not looking for payment at the moment. My goal is to learn how real projects are built, gain practical experience, and contribute as much as I can. If you think I could help or have an opportunity for me, feel free to send me a private message. If you'd like to see my résumé, just send me a message. Thanks! Or send me a messenger on LinkedIn https://www.linkedin.com/in/danillo-souza-gomes-undefined-9084293b0 submitted by /u/SuccotashOwn1550 [link] [留言]

The Hidden Security Gap in Multi-Tenant MCP Servers When you build a multi-tenant SaaS application or an MCP (Model Context Protocol) server that serves multiple organizations, cross-tenant data leakage is one of the most dangerous vulnerabilities you can ship. A single missing organizationId filter in a database query can expose one tenant's data to another — and traditional security scanners like Snyk, Semgrep, and CodeQL don't catch these patterns. That's why I built mcp-tenant-isolation — a static analysis scanner with 57 deterministic rules specifically designed to catch tenant isolation failures in multi-tenant codebases. What Is Tenant Isolation? Tenant isolation ensures that data belonging to one organization (tenant) is never accessible to another. In a multi-tenant SaaS app, every database query, cache read, and file access must be scoped to the current tenant's organizationId . The most common failure looks like this: // VULNERABLE: No organizationId filter const users = await prisma . user . findMany ({ where : { role : ' admin ' } }); // SECURE: Tenant-scoped query const users = await prisma . user . findMany ({ where : { role : ' admin ' , organizationId : ctx . orgId } }); It looks obvious in isolation. But in a codebase with 100+ API routes, dozens of lib functions, and complex middleware chains, missing tenant filters are easy to miss in code review and impossible for traditional SAST tools to detect . Why Traditional Scanners Miss This Tools like Snyk and Semgrep are excellent at detecting: SQL injection XSS Dependency vulnerabilities Secret leakage But they don't understand tenant context . They don't know that organizationId is the tenant boundary. They don't track which functions require tenant guards. They can't tell you that prisma.user.findMany({ where: { role: 'admin' } }) is missing a critical tenant filter. mcp-tenant-isolation fills this gap with 57 rules across 7 categories: Rule Categories Category Rules What It Detects Database Queries

Classic Machine Learning Through the Eyes of an SRE — Part 3 The random forest is the first ML algorithm that made me feel at home. Not because of the math — because it's an SRE idea wearing a stats costume. Many independent workers. No single point of failure. Majority vote. If one worker goes weird, the fleet absorbs it. We've been building systems this way for decades; the forest just applies it to prediction. The problem it exists to fix Last article: a single decision tree is readable but unstable — small data change, whole tree flips, explanation rewrites itself. That instability is variance, and it's exactly what scared me about trusting one tree in production. The forest's move: grow hundreds of trees, each on a random resample of the data, and — this is the part that matters — force each split to choose from only a random subset of features. That second randomization is the whole difference between a random forest and plain bagging. Bagging alone gives you many trees on resampled data, but if one feature is strongly predictive, every tree grabs it first and they all end up looking alike. Starving each split of features is what makes the trees genuinely different from each other. The randomness isn't sloppiness. It's manufactured disagreement. The instability doesn't get fixed. It gets CANCELLED. Each tree is still jumpy, but they're jumpy in different directions, and the average is calm. What surprised me No new loss function. Each tree still minimizes impurity exactly like a lone tree. The forest adds zero new objectives. The entire gain is a bias-variance bargain: variance drops hard, bias barely moves. You give up readability and get back trustworthiness. Embarrassingly parallel. Trees are independent, so training scales horizontally — throw cores at it. Boosting, its sequential cousin, is the opposite: each model depends on the last. Map-reduce versus a pipeline. The smoothness illusion. A forest's decision boundary looks smooth, almost like regression'

Java is still worth it in 2026 Are you wondering if Java is still worth learning in 2026? Check out this video and see why it's been dominating for 30 years submitted by /u/OSBY_Glabay [link] [留言]

submitted by /u/OSBY_Glabay [link] [留言]

📑 Table of Contents Introduction Why We Created ValidX? Why Choose ValidX? 5-Minute Quick Start Multilingual Support Important: Null/Empty String Handling Thread Safety Supported Validation Annotations Quick Reference Table Basic Validation Identity Validation Financial Validation Education/Professional Qualification Network Validation China-Specific Validation Automotive Validation Book-Related Validation Mobile Device Validation More Validation Annotations Contribution Introduction ValidX is an open-source Java validation library focused on Chinese business scenarios, making validation simple, elegant, and reliable. Built on JSR-380 standards with 90+ specialized annotations for Chinese identity cards, phone numbers, bank cards, and more. 💡 Why We Created ValidX? When developing applications for Chinese users, we frequently encountered these challenges: Pain Point 1: Java Has Too Few Built-in Validation Rules, Far Less Than Other Language Frameworks If you've used web frameworks in other languages, such as PHP's ThinkPHP or JavaScript's Validator.js, you'll notice they come with incredibly rich built-in validation rules: mobile , idcard , zip , alphaNum , etc.—ready to use out of the box, simple and convenient. But in the Java world, standard Bean Validation only provides a handful of generic annotations like @Email and @Pattern . For common Chinese business scenarios—identity cards, phone numbers, bank cards, unified social credit codes—there's absolutely no support. This forces every Java project to reinvent the wheel: Writing complex regular expressions yourself Implementing Luhn algorithm for bank card validation Handling identity card check digit calculations Copy-pasting validation code found online Why can't Java validation be as ready-to-use as other frameworks? This is why ValidX was born. Pain Point 2: Scattered Validation Logic Difficult to Maintain As projects grow, validation logic becomes scattered across: Manual validation in Controller layer Busine

A few weeks ago I wrote about building a reproducible test harness for comparing free AI coding models before you commit . That harness answers one question: which model should I use? It does not answer the harder follow-up: once a model generates a patch for my real codebase, when is it safe to merge? This week there was a great discussion on DEV about "understanding over origin" — the idea that it doesn't matter whether code came from a human or a model, only whether someone actually understands it. I agree with the principle, but principles don't survive contact with a busy afternoon. What survives is a checklist with teeth. So here is the pipeline I bolted onto my model harness: every AI-generated patch has to pass through a scripted review gate before I even read it, and the script produces a scorecard that tells me how carefully I need to read it. The problem with eyeballing diffs When a model produces a 40-line diff that looks idiomatic, my brain does a dangerous thing: it pattern-matches on style and skips semantics. The code reads like something I'd write, so I approve it like something I'd write. The failures I've actually shipped from AI-generated code were never syntax errors — the tests even passed. They were things like: A retry loop that retried on the wrong exception type, so real errors got swallowed. A query filter that was subtly wider than the one it replaced (tests passed because fixtures were too small to notice). A dependency added for a one-liner the standard library already covers. All three would have been caught by asking four boring questions before reading the code. So I scripted the questions. The review gate: a reproducible artifact The gate is a small shell script. It takes a patch file, applies it to a throwaway worktree, and runs four checks. It never touches my working branch, and it prints a one-line verdict at the end. #!/usr/bin/env bash # review-gate.sh <patch-file> <base-branch> set -euo pipefail PATCH = " $1 " BASE = " ${ 2 :

A malicious Ollama model is not a virus you double click, but it is untrusted input handed to a C parser, a template engine and your filesystem in one request. The realistic damage from a hostile /api/pull is disk exhaustion, VRAM starvation, blob writes under ~/.ollama/models , a poisoned chat template that silently rewrites every prompt, and memory corruption in the GGUF loader if the file is crafted for it. None of that requires a vulnerability in your app code, only an Ollama daemon that trusts whoever can reach port 11434 and whichever registry a tag points at. Bind the daemon to localhost, pin models by SHA256 digest, run the container as a non root user with a read only root filesystem and a capped model volume, and the entire class collapses to a bad model that answers badly. TL;DR by reader profile: Solo developer running Ollama on a laptop, for example a contractor testing llama3.1:8b locally: leave OLLAMA_HOST at 127.0.0.1:11434 and pin digests, because your only real exposure is pulling a model whose tag moved under you. Two person startup running Ollama on one rented GPU box, for example a founder pair serving an internal assistant: run it in Docker as UID 1000 with --read-only , --cap-drop ALL and a sized model volume, because a single unbounded pull can fill the disk that also holds your Postgres data. Team fronting Ollama with Open WebUI or Continue, for example five engineers sharing one workstation: put model management behind the proxy and block /api/pull , /api/create , /api/push and /api/delete for normal users, because chat access and registry access are not the same privilege. Anyone building agents or RAG on Ollama, for example a support bot with tool calling: treat the Modelfile TEMPLATE and SYSTEM blocks as attacker controlled text, because a poisoned template reaches the model before your prompt does. Consultancies holding client data, for example a two person shop under an NDA: keep model pulls on a staging host, mirror approved blobs int