今日已更新 190 条资讯 | 累计 24476 条内容
关于我们

标签：#rce

找到 1725 篇相关文章

AI 资讯

Asking vs Delegating AI Agents 🧐

Most developers use AI like a smarter Stack Overflow . Type a question. Get an answer. Go do the work yourself . That's fine but it's the slow way 😩 There's a faster mode, and most people haven't switched to it yet. Diff: Asking & Delegating When you ask an AI : "How do I write tests for my auth module?" You get a nice explanation. Then you write the tests yourself. You're still doing the work 🥸 When you delegate to an AI agent: "Write tests for /src/auth.py . Cover login, logout, and invalid token cases. Run them. If any fail, fix the code until they pass. Tell me what you changed." The agent opens your files, writes the tests, runs them, reads the failures, fixes the code, and comes back to you with a working test suite. You review the result. You didn't do the work. That's the shift 🙂‍↔️ It sounds small. The time difference is huge . How to write a good delegation Every delegation that works has four parts . Think of it like giving a task to a new team member: Goal: what should it produce? Scope: which files or area of the codebase? Success condition: how do we know it's done correctly? Report back: tell me what you changed and why. Here's what that looks like in practice: Debugging: "Here's the error and the stack trace. Find the root cause, fix it, and explain what was broken." Why this works: You're not asking what the error means. You're handing over the whole problem, find it, fix it, explain it 😎 Refactoring: "Refactor this file. Max two levels of nesting. No single function longer than 30 lines. Update every call site in the codebase." Why this works: The constraints are clear and checkable . The agent knows exactly when it's done 🧐 Database migration: "Write a migration script for this schema change. Make it idempotent. Run it against a local test database and confirm it succeeds." Why this works: You gave it a way to verify its own work before coming back to you 🤔 PR review: "Read this PR diff. Find anything that could fail in production. Write the tests

2026-06-26 原文 →
AI 资讯

I analyzed 30 winning dropshipping products. 7 patterns they all share.

Looked at 30 products running Meta + TikTok ads profitably. 7 patterns every single one had: PRICE : $25-$65 Below = thin margins. Above = harder impulse. BUNDLE OPTIONS "Buy 2 save 10% / Buy 3 save 15%" — every store had this. None were single-product only. VISUAL HOOK IN 3 SECONDS Unique design, specific problem solved, or "wow factor." Generic products failed. REAL REVIEWS WITH PHOTOS Not 5-star spam. Real, mixed reviews. Even negatives build trust. SHIPPING TIME ON PDP Every store disclosed it directly. None hid it in FAQ. STICKY ADD-TO-CART ON MOBILE All 30 had it. If your Add to Cart scrolls off-screen on mobile, you're losing sales. POST-PURCHASE UPSELL "Add this for $X" / subscription / bulk refill. This is where AOV lives. WHAT THEY DIDN'T HAVE Live chat (only 4/30) Exit-intent popups (only 2/30) Countdown timers (only 3/30) Countdown timers (only 3/30 — most had REAL shipping urgency instead) Multiple payment options visible on PDP (most just had Shopify default) The "guru tactics" aren't what winning stores use. 3 QUICK WINS Pick products with visual hooks Bundle by default Fix PDP before scaling ads

2026-06-26 原文 →
AI 资讯

Handling React Dialog Flows with async/await

React dialogs often start simple. You add an isOpen state, then a selected item state, then confirm/cancel callbacks, then another dialog after the first one. Eventually, a simple flow can become scattered across multiple components. For example, a user flow like this: Select a user Confirm the action Add the user often becomes multiple pieces of state: const [ isUserSearchOpen , setIsUserSearchOpen ] = useState ( false ); const [ isConfirmOpen , setIsConfirmOpen ] = useState ( false ); const [ selectedUser , setSelectedUser ] = useState < User | null > ( null ); This works, but the actual flow is harder to read. What if dialogs could be handled as async flows? I wanted the code to read closer to the user flow: const user = await openAsync ( UserSearchDialog ); if ( ! user ) return ; const confirmed = await openAsync ( ConfirmDialog , { title : `Add ${ user . name } ?` , }); if ( confirmed ) { await addUser ( user . id ); } The dialog opens, waits for a result, and the caller continues based on that result. This is about orchestration, not UI This is not meant to replace Radix, MUI, Headless UI, shadcn/ui, or custom dialog components. Those libraries solve the dialog UI problem well. The idea here is to manage the flow around dialogs: opening dialogs from anywhere under a provider resolving typed result values handling nested dialogs distinguishing completed vs dismissed supporting dismissal reasons guarding close behavior with shouldClose So the actual dialog UI can still be your own component. I packaged the pattern I turned this idea into a small open-source library called react-dialog-flow . It provides a headless dialog stack, Promise-based openAsync , typed results, nested dialogs, closeTop , closeAll , dismissal reasons, shouldClose , and optional UI primitives. GitHub: https://github.com/CHOKANGYEOL/react-dialog-flow npm: https://www.npmjs.com/package/react-dialog-flow Docs: https://dialog-flow.kangyeol.com/ It is still early, so I am mainly looking for feed

2026-06-26 原文 →
AI 资讯

Dotsync – A zero-knowledge CLI to sync dotfiles and secrets in Go

I spent 3 months building a tool that solves the most annoying part of working on a dev team. You know the drill: → New dev joins → "hey check your DMs" → Someone pastes the .env in Slack → That message sits there forever → 6 months later someone screenshots it by accident or worse — → git add . → git commit -m "added env" → git push → you just leaked your prod database URL to the internet I got tired of it. So I built DotSync. ─────────────────────────────────── Here's what it looks like in practice: $ dotsync push 🔒 Encrypting 10 secrets for team access... 📤 Uploading... ✅ Version : v7 Secrets : 10 keys encrypted Teammates can now run: dotsync pull That's it. New dev joins? They run dotsync pull. Secrets updated? dotsync push. Moving between your laptop and work machine? dotsync pull. ─────────────────────────────────── The part I actually care about — security: Everything is encrypted ON your machine before it hits the network. The server stores a blob it literally cannot read. I'm not asking you to trust my infrastructure. You don't have to. Stack if you're curious: • Argon2id key derivation (64MB memory cost — brute force isn't happening) • AES-256-GCM encryption • Zero-knowledge server (stores ciphertext only) • Single Go binary, no runtime deps ─────────────────────────────────── Other things it does that I use daily: dotsync diff → shows exactly which keys changed vs remote (never shows values) dotsync history → full version history, who pushed what and when dotsync rollback → restore any previous version in one command dotsync run -- node server.js → injects secrets as env vars, nothing written to disk dotsync scan → scans your codebase for accidentally committed secrets ─────────────────────────────────── Free tier covers: • 1 project • 3 team members • 7 days history That handles most small teams completely free. ─────────────────────────────────── Now the part where I need your help: I'm looking for 100 engineers to actually stress test this. Not "give i

2026-06-26 原文 →
AI 资讯

🚀 Join the Omnia Community — Contributors Wanted

🚀 Join the Omnia Community — Contributors Wanted Hello everyone, I'm building Omnia , an open-source, privacy-first productivity workspace designed to combine notes, tasks, calendars, habits, goals, reminders, and AI assistance into a single desktop application. The vision is simple: Create the productivity app we all wish existed — fast, beautiful, extensible, local-first, and truly owned by its users. Current Stack React 19 TypeScript Tauri v2 SQLite Zustand Tailwind CSS v4 Tiptap Editor OpenRouter / OpenAI / Ollama What We're Building Omnia aims to become a serious alternative to tools like Notion, Obsidian, and other productivity platforms while remaining: Free and open source Privacy-focused Local-first Highly customizable Community-driven Looking For Contributors Everyone is welcome, regardless of experience level. Frontend Developers Help improve: UI/UX Editor experience Dashboard widgets Accessibility Responsive layouts Rust Developers Help with: Tauri backend Native integrations Performance optimization Security improvements Designers Help create: Themes Icons Illustrations User experience improvements Documentation Writers Help build: Wiki pages Tutorials Guides Developer documentation Open Source Enthusiasts Help by: Testing releases Reporting bugs Suggesting features Participating in discussions Current Priorities Stabilizing the first release Performance improvements Windows support Linux support Plugin architecture Theme ecosystem Export & backup tools Why Contribute? Because this is an opportunity to help shape an ambitious open-source project from the very beginning. Every contribution matters, whether it's a bug report, documentation improvement, design suggestion, or a major feature implementation. If you're interested in building the future of personal productivity software with us, we'd love to have you on board. Let's build something amazing together. 🚀 See you in the repository!

2026-06-26 原文 →
AI 资讯

Three Loops, No Ship

I spent three iterations on an auto-fix pipeline that still doesn't work reliably. Here's what I learned. Loop 1 Wrote a background script. Pull tickets from Azure DevOps, run them through a local model, hand to a coding agent, push the result. Poll → triage → fix → push. Worked 40% of the time on trivial tickets. Anything that crossed file boundaries or needed real context — stalled or hallucinated. I shipped it anyway. That was naive. Loop 2 Made it smarter. Pre-selected relevant files. Broke big tickets into subtasks. Turned complex edits into atomic steps with verification between each. Got it to 55% or so. But every fix created two new edge cases. The complexity was compounding faster than the reliability. Loop 3 Went all in. Embeddings for dedup. Multi-repo routing. Auto-revert. A learning loop that fed failures back into future runs. The model server started dying. 890 memory errors in a day. Root cause: two independent consumers hitting the same local model server, each with its own retry loop. When memory filled up, retries amplified instead of staggering. The system was making itself worse. Fixes were simple in hindsight — stop retrying OOM, serialize access, use the local binary not npx. But the pattern kept repeating: add more to fix the last thing, break something else. Where I'm At The pipeline still only works on easy tickets. Hard ones need a human. After three rounds, the main thing I learned is that local models hit a wall before your ambition does — not in quality, in working memory. And adding features doesn't fix reliability gaps. It just moves them around. The 507 retry spiral taught me more than any successful deploy this year. Because it was entirely my fault. Not the model's, not the framework's. I built concurrent consumers with independent retry loops and expected them to coordinate. They didn't. What's Next I'll do a fourth loop. Smaller. A dedicated fast model for cheap work, the big model only for editing. One consumer at a time. Might

2026-06-26 原文 →
AI 资讯

How I built a free tool that shows where Claude Code burns tokens

The problem Just saying "hi" to Claude Code costs ~31,000 tokens . I was paying $500+/month in API costs and had no idea where the tokens were going. So I built tokenwise — a free CLI that shows exactly where your AI coding agent wastes tokens. What it does tokenwise audit — Scan your instruction files It scans your CLAUDE.md, AGENTS.md, and rules files, then shows: How many tokens each file costs per message Boilerplate the AI already knows ("Always write clean code") ALL-CAPS emphasis that doesn't help (NEVER, ALWAYS, MUST) Duplicate sections Unscoped rules that load when they shouldn't tokenwise scan — Analyze your sessions It reads your latest session logs and shows: Token breakdown by component (system prompt, history, tool output) Cache hit rate Top 3 "token hogs" with actionable tips Monthly cost projection The key insight Most people try to compress context (which makes the AI dumber). tokenwise measures first, then applies safe fixes. You can't optimize what you can't measure. Quick start npx @davizin713/tokenwise audit npx @davizin713/tokenwise scan Zero API calls. Zero LLM inference. 100% local. Free forever. Works with 11 agents Claude Code, OpenCode, Cursor, Aider, Cline, Codex CLI, Goose, Continue.dev, Windsurf, Augment, and Kilocode. Links GitHub: github.com/davi713albano-coder/tokenwise npm: npmjs.com/package/@davizin713/tokenwise Built with TypeScript / Node.js js-tiktoken for token counting sql.js for reading OpenCode sessions MIT licensed If you use Claude Code or any AI coding agent, try it and let me know what you think! ⭐

2026-06-26 原文 →
AI 资讯

Your AI-tool usage is invisible. Here are 4 tiny local tools to see it.

You use Claude Code, or ChatGPT, or both, every day. Quick question: how many messages did you send last month? Which model ate most of your budget? How much did prompt caching actually save you? You don't know. I didn't either. That's a weird gap. We instrument everything else — git activity, deploy frequency, test coverage — but the tool we now spend the most hours inside is a black box. The vendor dashboard, if it exists, is a billing page, not a mirror. So I built four tiny tools to fix that for myself. They all run 100% locally . No accounts, no API keys, no telemetry, no network calls. They read files that are already on your disk and print something you can look at. All four are open source on github.com/greymoth-jp — and because that's a real claim, the only thing I'll ask is that you grep the source yourself before you trust me. Here's the privacy point up front, because it's the whole design: these read your data, but your data never leaves your machine. That's not a feature I'm bolting on for a marketing line. It's the reason the tools are small enough to audit in one sitting. The one number that changed how I work Before the tools, here's what I assumed: my Claude Code bill is dominated by the prompts I write, so to spend less I should write tighter prompts. Compress the context. Trim the system message. The usual advice. I ran the numbers on my own ~/.claude transcripts and got this: component share of cost cacheRead 72% cacheWrite ~19% output the rest input ~0.3% Input — the thing everyone tells you to compress — was 0.3% of my spend. Compressing my prompts to save money would've been optimizing the rounding error. Worse: compressing a static prompt changes its bytes, which busts the prefix cache, which can make the bill go up . The real cost center was cache reads: long sessions dragging a fat context forward, turn after turn. That points at completely different levers — cache hygiene (milestone /compact , /clear before the context balloons, keeping C

2026-06-25 原文 →
← 上一页 下一页 →