标签：#p

Canonical URL: https://blog.1001020.xyz/ Suggested cover image: use a recent image from https://blog.1001020.xyz/gallery I have been building a small publishing system called 1001020 , a serverless blog and AI gallery running on Cloudflare Workers. The live site is here: 1001020 — AI Gallery & Cloudflare Experiments The goal was not to build another static blog generator. I wanted something that could publish articles, serve an image gallery, manage uploaded assets, expose structured sitemaps, and stay operational without a traditional server. The basic architecture The whole public site runs on Cloudflare Workers. Articles, settings, comments, gallery metadata, and telemetry live in Cloudflare KV. Managed images are stored in R2 and served through a dedicated image domain. The main pieces are: Cloudflare Workers for request routing and rendering Cloudflare KV for article and site metadata Cloudflare R2 for managed image uploads A theme system for different frontend layouts XML sitemap and image sitemap generation A small local AI drafting tool for preparing and publishing content The gallery is a first-class part of the site, not just a media folder. You can browse it here: AI Gallery on 1001020 Why Workers instead of a conventional backend? For this project, Workers are a good fit because the workload is mostly request routing, HTML generation, metadata reads, and small API writes. A conventional server would work, but it would add deployment and maintenance overhead that I did not need. Cloudflare Workers also make it easy to keep the app close to the edge while still handling dynamic behavior. The blog can render pages server-side, expose APIs, and support admin operations without a separate Node or container deployment. KV as the content store The project stores persistent content in KV using explicit keys for articles, gallery records, settings, telemetry, comments, newsletter subscribers, and other small datasets. This shape works well for a personal publishi

A code-first language for durable, governed AI workflows Discussion | Link

Industrializing the disassembly of an undocumented processor from a raw binary is a complex task that can be broken down into four key steps: Verify that the binary does not belong to a known processor. Verify that the binary is not obfuscated, compressed, or encrypted code for a known processor. Build an undocumented processor generator. Create the analysis pipeline and custom disassembler generation process. For the first phase of this project, the goal is to build dedicated, lightweight disassemblers—since, for bare-metal binaries, tools like Ghidra require manual processor target selection before analysis can begin. 1. Why Build a Custom Disassembler? To determine whether a binary was compiled for a specific architecture, the strategy consists of disassembling the binary (both statically and dynamically) against candidate instruction sets until: One or more bytes fail to match any valid instruction for that architecture, allowing us to rule it out. The disassembly succeeds completely. (Note: a successful disassembly does not guarantee that the binary was originally intended for that CPU; control flow validity must also be verified). Static disassembly is the first line of defense. However, if it fails due to obfuscation, compression, or encryption, we must escalate to dynamic execution and analysis. Only after systematically eliminating all known architectures can we confidently conclude that we are dealing with a custom or undocumented processor . 2. How to Build Your Custom Disassembler Before deploying heavy machinery for undocumented processors, the logical first step was to check against known architectures. Approach 1: Ghidra and SLAgh Ghidra relies on the SLAgh specification language and maintains an extensive library of processor definitions. The original plan was to leverage its API to extract a normalized opcode mapping table. However, after several attempts, Ghidra proved unsuitable for this specific pipeline for two reasons: Operand Type Loss: Detail

Listmargin works out your eBay final value fees, ad fees, and what you actually keep on a sale. Most fee calculators copy a four-line summary of eBay's rates. This one reads the full published schedule: all 46 category rates, the store subscription tables, and the four categories where crossing a price threshold re-rates the entire sale. It's free, with no signup and no paid tier. There's an embeddable version if you run a blog or a tool site. A weekly monitor re-reads eBay's own fee pages, so when a rate moves the calculator gets corrected instead of drifting out of date.

Founded by the creators of viral offline events like San Francisco’s citywide scavenger hunt Pursuit, Outernet's app helps users save places and events they discover online, then nudges them to actually go.

submitted by /u/onatm [link] [留言]

Meta says it’s restoring access to WhatsApp accounts that were mistakenly flagged and placed “under review” after users reported being unexpectedly locked out of the messaging app.

Corner the small enemy. Strip away its options, and there is nowhere left to run. — The 36...

The European Union has ushered in some additional rules that aim to make it easier for people to identify chatbots and AI deepfakes online. The new transparency obligations under the bloc's landmark AI Act came into effect on August 2nd, requiring companies to disclose when people are interacting with AI models, and if content has […]

AirTags are great, but there are competing trackers that offer handy features and unique form factors.

submitted by /u/cdb_11 [link] [留言]

The Kindle Scribe is worth considering if you’re heading back to school, as its large 10.2-inch screen can display textbooks and ebooks, or let you jot down handwritten notes during class. Now through August 8th, the first-gen model (with a Premium Pen) is down to just $149.99 with 16GB of storage in refurbished condition at […]

Valar Atomics raised $1 billion at a $6 billion valuation after signing a development deal with Nvidia in June.

Base Power’s $1 billion round will help the startup ramp production of its home batteries.

I have been observing the Pawn ecosystem lately and noticed it is far from inactive, with ongoing development of modern tools like a web-based Pawn Studio designed to replace the outdated Pawno editor, alongside projects such as PawnPlus which continue to receive updates, with version 1.5.3 released just a few months ago in February 2026. This activity seems to be driven largely by the SA-MP and Open.mp modding communities, with open.mp itself being actively maintained and improved, and the broader GitHub ecosystem showing dozens of public repositories related to Pawn and Open.mp . Given this context, I would like to ask whether the Pawn community, especially within the SA-MP and Open.mp scene, is still significant enough to consider the language actively relevant in 2026, or if this is primarily a legacy ecosystem with a concentrated but declining user base. I would be grateful to hear from developers who are currently working with Pawn about their experiences, whether modern tooling like Pawn Studio and PawnPlus have meaningfully improved development, and whether they are seeing new developers enter the scene or if the community is largely composed of seasoned veterans. Thank you for your thoughts. submitted by /u/PutuSuhartawan [link] [留言]

House spending records show OpenAI's ChatGPT dominates paid AI use on Capitol Hill, with congressional offices relying on the chatbot to draft memos, summarize legislation, and assist constituent communications.

Wispr Flow's new terms of service indicate it will introduce a notetaker that generates meeting summaries and action items.

At $25,305, you won't find many new cars for less. But you get what you pay for.

It was 2 AM, and the on-call chat was on fire again: the order service was healthy on every dashboard, but throughput had flatlined at ~800 req/s while P99 climbed past 4 seconds. The usual suspect? A thread pool sized by guesswork during a late-night deploy, six months earlier. We'd hand-tuned maxThreads to "something that felt right," and it wasn't right anymore. That's the moment I started appreciating a different default: in Solon, all of those knobs ship as 0 — meaning auto , derived from your machine's actual CPU cores at runtime. You can go months without thinking about a single thread-pool property. This post walks through the five knobs that exist, how the auto-tuning math works, and the three failure modes that tell you it's time to touch them. The five knobs under the hood Solon exposes these on app.yml (all values are the documented defaults): # Minimum threads for the http server (0 = auto; also accepts fixed values like 2, or core multiples like x2) server.http.coreThreads : 0 # Maximum threads for the http server (0 = auto; also accepts fixed values like 32, or core multiples like x32) server.http.maxThreads : 0 # Idle thread timeout in ms (0 = auto) # supported since v1.10.13 server.http.idleTimeout : 0 # Is this an IO-bound service? (default true) # supported since v1.12.2 server.http.ioBound : true # Enable the virtual thread pool (default false) # supported since v2.7.3 solon.threads.virtual.enabled : false Notice what's missing: no hard-coded defaults for coreThreads or maxThreads . 0 means "figure it out from the hardware." That single decision removes a whole class of "copy-pasted tuning values" problems — the ones that were right for someone else's 32-core box and wrong for your 2-core container. CPU-bound or IO-bound: the one question that matters The auto-tuner only needs you to answer one question: is your workload CPU-bound or IO-bound? CPU-bound : the work happens entirely in CPU and memory — think a "hello world" handler that returns a s

GitPython ships a guard against dangerous git options. If your code builds a clone command out of anything that arrived from outside, the library will not let --upload-pack or --config through by default, because both of them execute an arbitrary command. The guard is on out of the box and turns off only with an explicit allow_unsafe_options=True . I handed it --upload-pack=/srv/lab/helper.sh . It refused. I handed it the same thing written differently, -u/srv/lab/helper.sh , and it let it through. The script ran. This is CVE-2026-67324, published on 1 August 2026, scored 9.8 on CVSS 3.1 and 9.3 on CVSS 4.0. Those numbers still come from the CNA that filed it: NVD has not run its own analysis yet, the record sits in status Received, so the score may move. Version 3.1.50 is vulnerable, 3.1.51 is fixed. Below, step by step: the lab, both attempts with real output, the code of the check and why it missed, and what the attack looks like from the outside. Plus the part I find more interesting than the hole itself. This is the third bypass of the same barrier within one year, and all three share a root cause. Why this deserves your attention Almost nobody installs GitPython on purpose. It gets 254 million downloads a month from PyPI against five thousand stars on GitHub, and a two-order gap like that means one thing: it arrives as a passenger. With MLflow, with DVC, with bandit, with semgrep, with half the homegrown scripts that touch repositories in CI. Let me draw the boundary right away, so nobody panics for nothing. Having it installed is harmless on its own. The hole fires only when two conditions hold at the same time: your code calls Repo.clone_from(..., multi_options=[...]) , something an outsider influences ends up inside multi_options . The second one happens more often than it sounds. A repository URL from a web form, build parameters from a config another team edits, a field in a CI job, arguments from a webhook. And if you are leaning on allow_unsafe_options=