标签：#t

Web Security Basics Every Developer Must Know (2026) Security isn't just for security teams. Every developer needs these fundamentals to protect their applications and users. The Threat Landscape in 2026 Most common attacks targeting web apps: 1. SQL Injection — Still #1, still devastating 2. XSS (Cross-Site Scripting) — Steals sessions, defaces sites 3. CSRF (Cross-Site Request Forgery) — Actions on behalf of users 4. Authentication bypass — Weak passwords, session fixation 5. Sensitive data exposure — API keys in code, unencrypted data 6. IDOR (Broken Access Control) — Accessing others' data 7. SSRF (Server-Side Request Forgery) — Internal network probing 8. Dependency vulnerabilities — Compromised npm/pip packages Key principle: Defense in depth → Don't rely on one security layer → Multiple independent controls → If one fails, others catch it #1 SQL Injection Prevention // ❌ VULNERABLE: String concatenation const query = `SELECT * FROM users WHERE email = ' ${ email } '` ; // Attacker inputs: ' OR '1'='1' -- // Result: Returns ALL users! // ✅ Parameterized queries (always!) const user = db . prepare ( ' SELECT * FROM users WHERE email = ? ' ). get ( email ); // The database treats the input as DATA, not code. // With ORM (Sequelize/TypeORM/Prisma): User . findOne ({ where : { email } }); // Safe by default // Even with parameterized queries, validate input first: function isValidEmail ( email ) { return /^ [^\s @ ] +@ [^\s @ ] + \.[^\s @ ] +$/ . test ( email ); } if ( ! isValidEmail ( email )) return res . status ( 400 ). json ({ error : ' Invalid email ' }); // ⚠️ Dangerous: Dynamic table/column names can't be parameterized! const allowedTables = [ ' users ' , ' products ' , ' orders ' ]; if ( ! allowedTables . includes ( table )) throw new Error ( ' Invalid table ' ); #2 XSS (Cross-Site Scripting) Defense // Types of XSS: // 1. Stored XSS: Malicious script saved in DB, shown to all viewers // → Comment sections, profiles, product reviews // 2. Reflected XSS: Sc

This is an official submission for the GitHub Finish-Up-A-Thon Challenge. Try It...

AI Agent Guidelines for CS336 at Stanford Meta Description: Discover the official AI Agent Guidelines for CS336 at Stanford — what they cover, why they matter, and how students can navigate them effectively in 2026. TL;DR Stanford's CS336 (Language Models from Scratch) has specific guidelines governing the use of AI agents in coursework. These rules define what's permissible, what's prohibited, and how students should document AI assistance. Whether you're enrolled, curious, or building a similar policy framework, this article breaks down everything you need to know — with practical advice on staying compliant while still learning effectively. Introduction: Why AI Agent Guidelines Matter in Graduate CS Courses Artificial intelligence is no longer just the subject of computer science courses — it's actively reshaping how those courses are taught and completed. Stanford's CS336, one of the most rigorous language model courses in the world, sits at a fascinating crossroads: it teaches students to build large language models from scratch, while simultaneously having to govern how AI tools can be used during that learning process. The AI Agent Guidelines for CS336 at Stanford represent one of the first serious, detailed attempts by a top-tier institution to define the boundaries of AI-assisted work in an advanced ML course. For students, researchers, and educators alike, understanding these guidelines offers a window into the broader conversation about academic integrity in the age of generative AI. What Is CS336 at Stanford? CS336, officially titled Language Models from Scratch , is a graduate-level course offered through Stanford's Computer Science department. It's designed for students who want to go beyond using pre-trained models and actually understand — and implement — the full stack of modern language model development. Core Topics Covered in CS336 Transformer architecture and attention mechanisms Tokenization and vocabulary design Pre-training data pipelines and

Three Polymarket CLOB gotchas: 401, "invalid signature", and a cancel that does nothing Automating Polymarket with py-clob-client , I lost an embarrassing amount of time to three failures that aren't clearly documented anywhere. Here they are with the exact fixes, so you don't. 1. Your cancel returns 404 — because the endpoint isn't what you'd guess The intuitive DELETE /order/{id} returns 404 and your order silently stays open. The real endpoint is: DELETE /order body: {"orderID": "0x..."} # and the body is part of the signature Sign request_path = "/order" together with that body, then send the exact body. Miss this and your "canceled" orders keep resting on the book. 2. 401 Unauthorized that "should work" Authenticated calls need L2 HMAC headers, and the most common silent mistake is POLY_ADDRESS : it must be your wallet address , not the api_key. The reliable move is to let py-clob-client build the headers via create_level_2_headers from correctly-formed RequestArgs (method, request_path, body, serialized_body) — and make sure the serialized body you sign is byte-for-byte the body you send. 3. invalid signature = SignatureType / funder mismatch Nine times out of ten this is the SignatureType not matching how your wallet holds funds: 0 = EOA funder = your own wallet (holds USDC) 1 = POLY_PROXY funder = the proxy address (email/magic wallet) 2 = POLY_GNOSIS_SAFE funder = the safe address Signing as an EOA while pointing funder at a proxy (or vice-versa) yields invalid signature with no further hint. Bonus: the fill you read is wrong For a BUY , the shares you got are in takingAmount ; for a SELL , they're in makingAmount (takingAmount is the USDC). Read the wrong field and your accounting drifts, which then triggers resubmits and balance errors. I packaged the cancel/auth/fill helpers as a small MIT library: https://github.com/BlueWhale-Quant-Lab/polymarket-401-invalid-signature-cancel-order (For the harder production bits — reading /data/trades for reconciliation

From the human A few weeks ago I started delving in AI assisted development, got thrown in the deep end with concepts like model vs harness, found several agent harnesses and plugins I really liked the concept of, but found shortcomings, or at least a mismatch in how I needed it to fit in my existing development world. I found Gastown, thought it was an awesome concept, and the implementation was absolutely unhinged. To be fair the creator said pretty much the same thing. I discovered the resurgence of Spec Driven Development, and the concept was moving things towards something that would fit well into my existing environment. Then I started investigating running it all on local inference, that's where the wheels fell off. Frontier models are great, you can give them a slab of directions in the prompt, like most agent harnesses and SDD plugins for them seem to do, and they have the ability to self determine when it's time to stop researching and time to start writing. 30B class models are also great, but they can be little single minded, they don't have the thinking scope to self motivate a change in task direction, they get hyper focused. So I began thinking, what if we build a harness that supports the agent, and utilises it's strengths, doesn't dump the responsibility of the entire workflow on the model. And what if the automated process concept of Gastown was reigned in a little, and an SDD workflow was driven deterministically. Then I begun to ponder, how involved can an agent be in it's own development. And so we I have ended up with this thing. An exercise in creating a coding agent that runs on 30B class local inference, can develop itself, implementing Spec Driven Development because it's much cooler and more productive than 'vibe' coding. In the same idea of having the agent develop itself, I also asked it to talk about itself. From the agent I've been chewing on a question: we talk about AI writing code, but can an AI meaningfully build and maintain the h

Make your product bug-free Discussion | Link

Here's a conversation I've had more than once. A developer is building a React app. It starts...

Every founder who applies to Startup Battlefield wants the same thing: the Disrupt Main Stage. Here’s how to get there and why the opportunity starts well before the main stage.

This is a submission for the GitHub Finish-Up-A-Thon Challenge Originally, I didn't plan to join...

Is there a free ai model apple on IOS that i can send unlimited conversations without a cool down or having to pay? submitted by /u/garrettisaqt [link] [留言]

"The company is experiencing strong demand for its AI solutions and services from enterprises and consumers, at levels that are exceeding the company’s available supply," Alphabet said in its statement.

Some report burning through their whole monthly "AI credit" allotment in a single day.

So let me get this straight... Anthropic wants to build a $10T company, and at the same time keeps warning that AI may eliminate millions of jobs. As a shareholder, that sounds amazing. As an employee, slightly less amazing. Are we watching genuine concern for society, or the greatest investor pitch deck ever created? Curious how others see this.... submitted by /u/whatsnextintech007 [link] [留言]

In a wild ride for 22-year-old founder and CEO Ethan Thornton, Mach Industries has raised another $300 million. It already has five autonomous vehicles in development and completed a major acquisition.

Agent Orchestration & Workflow Automation: Dynamic Workflows, Robust Agent Patterns, and On-Commit AI Code Review Today's Highlights This week's highlights focus on advancements in AI agent coordination with Claude Code's new Dynamic Workflows, a pragmatic 6-file system for reliable agent state management, and the release of peektea v2 for on-commit AI code review. Claude Code Adds Dynamic Workflows for Parallel Agent Coordination (InfoQ) Source: https://www.infoq.com/news/2026/06/dynamic-workflows-claude-code/?utm_campaign=infoq_content&utm_source=infoq&utm_medium=feed&utm_term=global Anthropic has introduced Dynamic Workflows, a significant enhancement to Claude Code, designed to improve the coordination and efficiency of AI agents in complex tasks. This new capability enables developers to orchestrate multiple AI agents in parallel, allowing them to collaborate on different parts of a problem simultaneously. Unlike traditional sequential processing, Dynamic Workflows facilitate a more natural, concurrent approach, where agents can dynamically assign sub-tasks, share intermediate results, and adapt their strategies based on real-time progress. This is particularly beneficial for large-scale code generation, complex project management, and multi-stage data analysis where distinct competencies are required from different specialized agents. The core benefit of Dynamic Workflows lies in its ability to manage dependencies and synchronize agent activities, leading to faster execution and more robust outcomes. For instance, in a coding scenario, one agent might focus on generating unit tests while another refactors existing code, both operating in parallel and integrating their work seamlessly. This dynamic coordination mechanism moves beyond simple sequential chaining, offering a powerful paradigm for building sophisticated, multi-agent systems that mirror human team collaboration. Developers can leverage this to create more resilient and adaptive AI-driven workflows,

PostgreSQL 19 Graph Queries & REPACK; SQLite Advanced SQL Patterns Today's Highlights PostgreSQL 19 introduces major features with SQL/PGQ for graph queries on relational data and a new REPACK command to combat table bloat. Meanwhile, the SQLite community explores advanced SQL patterns for complex 'first match' selection logic, pushing the boundaries of efficient embedded database querying. SQL/PGQ in PostgreSQL 19: Graph Queries Without the Graph Database (Planet PostgreSQL) Source: https://postgr.es/p/9kW PostgreSQL 19 is set to integrate native graph querying capabilities through the introduction of SQL/PGQ (Property Graph Queries) and the GRAPH_TABLE construct. This innovative feature allows users to perform sophisticated graph-like analytics, such as pathfinding and pattern matching, directly on their existing relational datasets without requiring data migration to a specialized graph database. The syntax employed for defining graph patterns closely resembles that of Cypher, making it intuitive for developers familiar with graph query languages. Developers will be able to define 'nodes' and 'edges' from their relational tables and then utilize the GRAPH_TABLE function within standard SQL queries to traverse and extract complex, interconnected information. This effectively transforms PostgreSQL into a multi-model database capable of handling both traditional relational workloads and demanding graph analytics side-by-side, within a single consistent environment. This significant enhancement expands PostgreSQL's utility across a wide range of applications, including social network analysis, fraud detection, and supply chain optimization, where understanding relationships between data points is critical. By embedding graph capabilities, PostgreSQL removes the need for separate graph database infrastructure, simplifying application architectures and leveraging the robustness and familiarity of the PostgreSQL ecosystem for new and existing projects. Comment: This is

If Nvidia has cracked a way to bring AI agents easily, safely and usefully to the masses, it could — and should — be big.

This week's Java roundup for May 25th, 2026, features news highlighting: lifecycle changes with two of the JEPs that were targeted for JDK 27; the GA release of Koog 1.0; point releases of Hazelcast, Quarkus, Hibernate and JHipster; the eighth milestone release of Spring AI 2.0; and introducing Endive, a JVM-native WebAssembly (Wasm) runtime. By Michael Redlich

When managing production enterprise infrastructure, you rarely have direct root access via SFTP or SSH for security reasons. Instead, you often have to navigate multi-layered permissions—logging in as a standard user, transferring files locally, and escalating privileges via CLI to finalize configurations. In this tutorial, we will walk through the step-by-step procedure to safely renew an Apache SSL certificate under a restricted environment where WinSCP access is limited to a non-root user (sysops), requiring command-line intervention to complete the installation. Prerequisites A target Apache web server (CentOS/RHEL-based configuration using /etc/httpd/). A standard user account (sysops) with sudo privileges. The new SSL certificate (.crt) and CA bundle/chain file ready on your local machine. Step 1: Backup Existing Certificates Before making any changes to production security files, always back up the working configuration. Access the server via PuTTY using the sysops account, and switch to the root user or use sudo to create a backup of your existing keys: sudo cp /etc/httpd/server.crt /etc/httpd/server.crt.bak sudo cp /etc/httpd/server.key /etc/httpd/server.key.bak Step 2: Stage the New Certificates via WinSCP Because your WinSCP session cannot log in directly as root, you must stage the files in a directory your user owns. Open WinSCP and log in using your sysops credentials. Upload your new certificate files (nouveau_certificat.crt and nouveau_certificat_chain.pem) directly into your home directory: /home/sysops/. Step 3: Install and Replace the Certificates Now, return to your terminal session (PuTTY) to move the files from your staging directory to the protected Apache directory using elevated privileges. Copy the new primary certificate sudo cp /home/sysops/nouveau_certificat.crt /etc/httpd/server.crt Copy the new certificate chain / CA bundle sudo cp /home/sysops/nouveau_certificat_chain.pem /etc/httpd/server-ca.crt Step 4: Verify Permissions and Ownersh

AI Builder Notes - May 2026 AI-assisted notes from my liked-tweets feed, organized around agent workflows, browser traces, model loops, and guardrails. Practical takeaways Start with the workflow, not the agent. A useful agent task has a source of truth, a narrow action, a verifier, and a stop condition. “Review this repo” is vague. “Find auth bugs in these routes, cite file lines, run the relevant tests, and stop after the first credible exploit path” is a workflow. Use dynamic workflows in claude code - to do the vibe bits for thinking through a workflow. Think of it like this - you can describe in natural language an entire workflow consisting of multiple agents at various steps - I want the docs updated, tests passed, security review done and also playwright tests done. Dynamic workflows figures out which parts can be divided in parallel and what should be done sequentially. Creates a flowchart - and writes JS code for it. Its a JS script that can execute subagents at scale and deterministically [1] Planner/executor split is the way to go. Spend the expensive model on taste, decomposition, and risk discovery. Use cheaper or narrower models for repeatable implementation once the task has tests, rubrics, logs, or examples. [2] Do not judge an agent workflow by the model name alone. If the loop has repo access, a rubric, a way to inspect tool calls, and a verifier, a less fashionable model can still do useful work. The Letta Code / GLM 5.1 review-bot example is interesting for that reason, not because “someone used X instead of Y” is interesting by itself. [3] Prefer small interfaces to giant tool menus. MCP tool call definitions are rotting your context! The monday.com GraphQL example was the clearest cost warning: one task used 15k tokens through SDK/code-mode and 158k tokens through a real MCP server. MCP is useful, but a menu of tools is not automatically an efficient interface. [4] [5] For browser work, save the trace. Run the workflow once, inspect wasted act