‼️ At 16:32:54 UTC 13 Nov to 01:12 UTC 14 Nov the infamously known Mills DC suffered an ~8h40m long incident that impacted all Ingress to my infra as well as several other services such as cas.run and mbox.blue. The cause is Vultr Cloud deciding between the 8th Nov 2026 and 13th Nov 2026 to break their GET /v2/instances API whereby ?tags= filter no longer works. This API is marked as “deprecated” on their API docs website, but not removed. The trigger was my own software/services performing VM claned using this API call and filter that no longer works all of a sudden. More to come on this soon™ – I’ll have to write this up as a longer blog post I think 🤔 #VultrCloud #API

@prologic@twtxt.net Hello from linux python tkinter twtxt client. With a minimal api on my server to interface with the twtxt file.

@movq@www.uninformativ.de Right now I am using my ai coded twtxt api to edit the twtxt.txt file directly with the api. As well as my ai coded twtxt desktop and mobile clients to go with it. Though the code at least for the desktop client is just a single python file. Plus I do know in the future it might be unmaintable.
I am not the type of person to be like “wow do everything in ai this is so great”
The entire reason I tried ai coding a twtxt client was because in an irc channel someone was like “twtxt is so simple even ai can do it” and then I get a five year old (the ai) to do it and because its simple its actually done. I don’t excpect it to be the best ever compared to the human coded twtxt stuff but at least it gets me back on twtxt. I don’t like every other twtxt client that much.

testing a reply from my android client using the api

Testing my twtxt api to just change the twtxt.txt file from api.

gitxt is a purely decentralised git forge. There is no federation protocol, no instance-to-instance API, no accounts on other people’s servers. Each forge instance is fully independent; collaboration is an act of publishing and reading plain text files over HTTP

@david@daiwei.me Also if you wouldn’t mind writing up an Issue for the image/upload problem too, that would be great 👍 I still haven’t solved it properly, but I’ll try to do so today. There’s also an issue uploading images via the yarnd API path from the Twtxt App too, which I can replicate with basically any photo from my iPhone’s Photo gallery hmm 🤔

the correct fix for what you observed is a recovery token to re-sync settings from the sync API

@dce@hashnix.club Fixed! 🥳 That 403 was our bug — connect was checking your token via /api/v1/user (needs read:user), but your token’s scoped to just the repo so it can’t. Now it validates against the repo itself instead 👍

I really think I should go back to Java.

Writing programs in Python is so exhausting. I want a compiler and I want static typing. No, linters and type checkers and IDEs are not good enough. Compilers catch way more errors in advance.

Rust is also exhausting. They’re constantly adding language features and, at the same time, the runtime library remains tiny and you need 3rd party libraries for everything. Many of those are still at version 0.x (SemVer!) and you can’t rely on anything. Often times, you need the latest Rust nightly compiler.

Go is … I don’t like it. And huge binaries.

I like C as a language, but it’s too fragile. I want to have a proper HashMap every now and then.

None of the above have good GUI libraries, at least not on Linux.

And then there’s Java. This is my fractal renderer that I wrote over 17 years ago:

https://movq.de/v/fcd3c4e557/vid-1784121825.mp4

It’s fast. It has a GUI with custom widgets and those weren’t even hard to make. It still works without changing a single line of code. The source code files have timestamps from 2009 and I just noticed that the JAR file I’m using in the video was compiled in 2010.

Java as a language is relatively easy to learn and to master. There are few surprises. The source code organization with packages is good. Java API docs are clear and well written.

The JVM ramp-up times have improved considerably:

https://movq.de/v/e7314e521e/vid-1784121998.mp4

This isn’t like the Dark Ages anymore. Might even be usable for some CLI tools.

The only thing where Java really sucks is anything close-ish to the kernel. Try issuing an ioctl() … I couldn’t have made my TUI framework in Java, but then again, I wouldn’t have needed to because Swing already exists and it just works.

@itsericwoodward@itsericwoodward.com Wrote it up 👌 Single-user twtd API is now documented (plain JSON, one bearer token) — posting, uploads, profile, followers + WebFinger: https://git.mills.io/yarnsocial/twtd/src/branch/main/API.md 🎉 Shout if anything’s unclear for TwtKpr 🙏

@itsericwoodward@itsericwoodward.com I would have zero problems with that! If there’s enough demand, I’ll write up the APi spec for it? 🤔

@balloonfu-sen@yarn.girlonthemoon.xyz I could in toehry publish a specification for what twtd implements, which forms the basis of the API between twtxt.app <-> twtd, if you wanted to write your own twtd / twtxt.app compatible publishing backend (assuming you didn’t want to use Github/Gitea, etc).

@balloonfu-sen@yarn.girlonthemoon.xyz Unfortunately I tried to support SFTP but ripped this out as Browsers (which the Swag framework uses under the hood as a framework to build PWA(s)) doesn’t support raw TCP connections. So FTP / SFTP is not possible without hacks like a proxy. Which I don’t really want to support. So only things that have some kind of HTTP API are possible viable publihsing backends right now. That is Github/Gitea, twtd, Yarn, etc.

@lyse@lyse.isobeef.org Besides, have a look at

Image

@movq@www.uninformativ.de Thank you very much! So, the concept is very similar. The root widget gets the input and can pass it to whatever child has the focus and so on.

My two main issues are the API design, that the input handler sometimes get an additional callback to notify the application about which element is focused, but sometimes not. And that focus switching sometimes just does not work as expected. Anyway.

As for rendering the selected button, I was also thinking about indicating it with some kind of border around it, square brackets seem to be a wonderful choice. :-)

Show HN: I built 80 mini-games using Fable before it was shut down
Dear Hacker News,

I’m kindly asking for your participation in the open beta for my AI-managed mini-games website. Thank you in advance!

For a limited time window, I’m setting the all-free feature flag to true. I hope you have a lot of fun exploring the AI’s sense for games! Here and there, I tweaked it to help with visual consistency.

I would be deeply grateful if you opted into analytics.

$2,300 in API tokens…

Cheers!

Comments URL: [https://news.ycombinator.c … ⌘ Read more

Getting the vim key bindings to work for focus switching in this modal dialog took me forever. Only cursors and (Shift+)Tab are supported out of the box. I absolutely understand that, it’s fine. I installed an input handler on the dialog, but the focus always stayed the same.

After two wasted hours, I was in despair to copy the tview.Modal into my own code base. Of course, I had to fix all the private tview field accesses first. But even installing the input handler directly on the buttons themselves did not work. Even though, the handler was definitely executed, the focus did not shift. Forcing redraws as a last resort also did not work.

Looking through all the messy chained input handling, I eventually stumbled across another place in the tview.Form, which is internally used by tview.Modal. This messed around with app focus receptions and input handlers. This gave me the idea to make the tview.Application refocus my modal dialog after I told the modal dialog which button to select. And would you look at that, this did the trick! I haven’t completely figured out what is going on exactly, but I could get rid of my Modal clone again.

I always go through hell with focus handling in tview. Each and every time. It just does not feel natural to me. Complete brainfuck to wrap my head around. The Urwid API felt sooo much more refined, it never was an issue. It just works. In fact, I cannot think of any other TUI library that has remotely the same pain level when it comes to focusing widgets as tview.

Now I’m curious how movwin deals with that. ;-)

@movq@www.uninformativ.de Hahaha, great timing! :-D I love your article and agree with almost all your points.

On the AI changelog part, though, I’d rather recommend to just not have a changelog at all.

Another important thing for me is the deprecation notice section. What do I need to look out for in the future? Should I start to migrate to another API soon? Even right now? Or does it have time?

While going through these terrible GitHub release pages, I also found these “New Project Contributors” sections (yeah, for that, they found the time to make a section) annoying. Don’t get me wrong, sure, credit where credit is due. But come on. Soooooo much space for an inefficiently formatted (and also unsorted) list. At least it was easy enough to skip over it.

And then, there are also these changelogs or rather notice documents in general that are infested with multicolored emojis all over the place. My brain’s spam filter kicks in and shoves everything to /dev/null immediately. It’s especially a thing at work.

In my previous work project, we also used the Keep A Changelog Format. That was great. You wouldn’t believe how often I resorted back to that document. At least twice a week, often several times a day. I was very glad that we put in this effort. Of course, writing the changelog took its time, but it was worth every minute and more. Reading a many months old item, it was immediately clear. I was our best customer in that regard.

Now, it’s just the same auto shitshow with MR titles in a rolling date-versioned release scheme. It’s just our team who has to deal with that, though. I think I’m the only one who is not a fan of it.

GitHub Authentication issues related to API requests
Article URL: https://www.githubstatus.com/incidents/fcj3088jg1wx

Comments URL: https://news.ycombinator.com/item?id=48477851

Points: 13

# Comments: 5 ⌘ Read more

Launch HN: Intuned (YC S22) – Build and run reliable browser automations as code
Hey HN, we’re Faisal and Ahmad from Intuned ( https://intunedhq.com). We’re building a platform for building, deploying, and maintaining browser automations.

Customers primarily use the Intuned AI agent to automate websites that don’t expose APIs. Common use-cases include scraping data, pulling reports, and submitting forms. As the website changes, our agent also helps automatically heal the automation.

On Intuned, browser automations are … ⌘ Read more

@prologic@twtxt.net Ahh, I see. Okay, I’m with you there. On this high level, I can understand how the thing works.

Maybe my wording isn’t good. 🤔 Let’s take a real life example from what we do at work.

There’s this AI chatbot. It gets support requests from users, so the user says something like “I need access to a particular system”. This triggers the bot to “run” the instructions stored in a large Markdown file, like “check if the user is authorized to do this, then issue the following API requests”, and so on. This is essentially like running a little script, except it’s written in natural language (German) and there’s no “script interpreter” but just the AI.

Now, suppose that the AI doesn’t quite do what was intended. There’s some subtle bug. How do you debug this? How do you find out how the AI came to the “conclusion” to run step A instead of step B? And how do you find out how exactly you have to change your prompt so this doesn’t happen again next time?

If this was an actual script/program instead of AI, you could repeat the request and attach a debugger or throw in some printf() or whatever. How do you do that kind of thing with AI? How do you pinpoint exactly what the problem was?

(Or is this just a stupid idea? Do we have to give up that way of thinking when using AI? Is the era of debuggability over?)

Incident with Pull Requests, Issues, Git Operations and API Requests
Article URL: https://www.githubstatus.com/incidents/xy1tt3hs572m

Comments URL: https://news.ycombinator.com/item?id=48293080

Points: 18

# Comments: 8 ⌘ Read more

Launch HN: Minicor (YC P26) – Windows desktop automations at scale
Hey we’re Faiz and Saheed and we built Minicor so AI companies who need to integrate to desktop systems with no API can quickly build scalable desktop RPAs. Demo: https://www.youtube.com/watch?v=MD0GHZIJ1cw

We were working on non-RPA integrations when a customer promised to sign a deal in 2 days if we could unblock a sale of theirs that involved integrating with a clinic’s Windows based medical record system. We didn’t know it at … ⌘ Read more

Launch HN: Chert (YC P26) – Twilio for iMessage
Hey HN! We’re Gary and Ian, and we’re building Chert ( https://www.trychert.com/), an API for businesses to send, receive, and automate iMessage conversations at scale. Check out our demo: https://www.youtube.com/watch?v=SRdwvVxMMoI.

We originally started by building products on top of iMessage because the blue bubble interface, typing indicators, and reactions made agentic conversations feel more human than ones on SMS … ⌘ Read more

When a friend lends me their Claude API key paid for by their company ⌘ Read more

PEP 833: Freezing the HTML simple repository API
This PEP proposes freezing the standard HTML representation of the simple repository API, as originally specified in PEP 503 and updated over subsequent PEPs. ⌘ Read more

When the front end makes dozens of API calls when the page loads ⌘ Read more

OpenAI when someone pushes their API credentials to a public repo ⌘ Read more

@lyse@lyse.isobeef.org The thing is that’s hard to avoid if TYPE_CHECKING, but documentation tools such as pdoc don’t support that … so it’s either type hints or API docs. 🤷

I hope I can eventually find a way out of this mess …

When the API I’m using returns an error code with no explanation ⌘ Read more

When I get my hands on a publicly exposed API key ⌘ Read more

When I realize my personal API key has been running in production for 6 months ⌘ Read more

Lab 3#: Finding and exploiting an unused API endpoint | Api Testing ⌘ Read more

Exposed API Keys and Secrets with AI

Image

Quick Disclosure of API Key and Secret to guess parameter value

Continue reading on InfoSec Write-ups » ⌘ Read more

ProcessOne: 🚀 ejabberd 25.10

Image

Release Highlights:

• Added more Ad-Hoc Commands from XEP-0133
  
• Updated support for XEP-0317 Hats
  

If you are upgrading from a previous version, there are no mandatory changes in SQL schemas, configuration, API commands or hooks.

Other contents:

• **[New option archive_muc_as_mucsub in mod_mam]( … ⌘ Read more

️ Spring Boot API Security Like a Pro: Rate Limiting, Replay Protection & Signature Validation…

Image

Learn how to secure your Spring Boot APIs using rate lim … ⌘ Read more

How to Identify Sensitive Data in JavaScript Files: (JS-Recon)

Image

A complete guide to uncovering hidden secrets, API keys, and credentials inside JavaScript files

[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/h … ⌘ Read more

Why, in 2025, do we still need a 3rd party app to write a REST API with Django?
Comments ⌘ Read more

A Beginner’s Guide to Finding Hidden API Endpoints in JavaScript Files

Image

How to discover what others miss in plain sight

[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/a-beginners-guide-to-finding-h … ⌘ Read more

I keep getting this email occadionally:

Your iCloud storage is almost full

Now for various reasons, I don’t want my children to be using iCloud to store data, files, photos or any of the sort. They’re free to use iMessages, and other Apple services like the App Store, etc, but not storage.

So I’ve set about blocking iCloud Storage API(s) via AdGuard Home tonight as well as ensuring that my local network (client users) cannot bypass DNS policies and get out other sneaky ways, because some applications will just use other DNS servers, or DOH or DOT.

CORS Vulnerability with Trusted Insecure Protocols BurpSuite Walkthrough

Image

CORS misconfig + HTTP subdomain XSS analysis showing API key exfiltration, exploit breakdown and remediation.

[Continue reading on InfoSec W … ⌘ Read more

Stealing Part of a Production Language Model (2024)
We introduce the first model-stealing attack that extracts precise, nontrivial information from black-box production language models like OpenAI’s ChatGPT or Google’s PaLM-2. Specifically, our attack recovers the embedding projection layer (up to symmetries) of a transformer model, given typical API access. For under $20 USD, our attack extracts the entire projection matrix of OpenAI’s ada and babbage language models. We thereby confirm, for the first time, that these black-box … ⌘ Read more

Karmada v1.15 Released! Enhanced Resource Awareness for Multi-Template Workloads
Karmada is an open multi-cloud and multi-cluster container orchestration engine designed to help users deploy and operate business applications in a multi-cloud environment. With its compatibility with the native Kubernetes API, Karmada can smoothly migrate single-cluster… ⌘ Read more

**Hidden API Endpoints: The Hacker’s Secret Weapon **

Image

I’m a cybersecurity enthusiast and the writer behind The Hacker’s Log — where I break down how real hackers think, find, and exploit…

[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/ … ⌘ Read more

Week 12— Async API Calls: fetch, Axios, and Promises ⌘ Read more

(g+) Der vernetzte Arbeitsplatz: Wie MCP die Arbeit mit KI-Agenten verändert
MCP ist ein bemerkenswertes Protokoll, das die Schnittstelle zwischen verschiedenen KI-Modellen standardisiert: Wir erklären, wie man es sinnvoll nutzen kann. Ein Praxistest von Markus Kammermeier ( KI, API)

Image

[$] A look at the Robot Operating System
Despite its name, the Robot\
Operating System (ROS) is not an operating system; it is
a software development kit (SDK) that provides building blocks for
robotic applications. One of the main goals of ROS is to present a
common API that abstracts away the details of particular hardware
drivers or algorithms to make development easier; developers can focus
on what a robot should do rather than the low-level details of
specific controllers. The latest release of ROS, [Kilt … ⌘ Read more

Hi everyone, here’s a little introduction of my twtxt client (still WIP).

The client I’m developing is a single tenant project that runs entirely in the browser (it might use an optional backend).

It’s entirely based on native web-components and vanilla JS, it is designed to act closer to a toolkit than a full-fledged client, allowing users to “DIY” their own interface with pure html or plain javascript functions.

Users can also build their own engines by including a global javascript object that implement the defined internal API (TBD).

I’m planning to build a system that is easy enough to build and use with any skill level, using only pure html (with a homebrew minimal template engine) or via plain JS (I’ll be also providing some pre-made templates too).

Everything can be self-hosted on any static hosting provider, this allows to spread twtxt within communities like Neocities and similarly hosted websites (basically any Indieweb/Smallweb/Digital garden website and any of the common GitHub/Lab/Berg/lify Pages).

It will be probably named something like TxtCraft or craf.txt but I’m not really sure yet… 🤔 (Maybe some suggestions could help)

I’m still in the experimental phase, so there’s no decent source-code to share yet, but it will soon enough!

@zvava@twtxt.net And yes yarnd does have a well documented API and two clients (CLI and unmaintained Flutter App)

@bender@twtxt.net @thecanine@twtxt.net well now this has me thinking abt the feasibility of making an android twtxt app for pods, the actual apis of pods would have to be standardized (or the fucked up way that activitypub does it, where the “mastodon api” is the defacto client api (does yarn even have an api reference?)) or the client is just simply..a client..but editing feeds via PUT, PATCH, DELETE etc. is standardized!…? (not to mention i dont even know where to begin making an android app lmao)

PEP 803: Stable ABI for Free-Threaded Builds
Version 3.15 of the Stable ABI will be compatible with both free-threaded and GIL-enabled builds. To allow this, the PyObject internal structure and related APIs will be removed from version 3.15 of the Limited API, requiring migration to new API for common tasks like defining modules and most classes. ⌘ Read more

Another hacky #Python script using the #HackMD API… this one is to change the write permissions… you might want to adapt it or check out the other API helper methods:

https://gist.github.com/villares/177c2323d424d5b2b0de49570fb4e2fd?permalink_comment_id=5673097#gistcomment-5673097

@lyse@lyse.isobeef.org Yeah, if there’s no stable API, then it’s not a lot of fun … Bah. :|

@movq@www.uninformativ.de I’d love to have a Python script pushing my local CSV, too. But that’s never gonna fly, not in a thousand years. I can’t imagine that ever becoming reasonably stable without having to fix everything after the reverse-engineered API changes again.

Of Pointlessware and CEOs
Had a moment, to check up on some of the companies, I stopped following, get to The Browser Company and see their newest product - it’s just Chrome, with an AI chat window pop-up and that’s it. Something Canary Chrome, come with already.
I see Theo from T3.gg, making fun of it on YouTube and promoting “his” product - an AI chat app, where you can choose from multiple models, by all the popular AI companies. Something I already have a worse version of, at work and I don’t even use it.
There’s also an interview, about the future of virtual keyboards, surely this is at least actually a real thing and not more pointless horse shit. I check the website of the keyboard SDK, and it’s around 20 identical apps, that just copy the same keyboard SDK/api and slap chatgpt features on top - in the App Store, these are surrounded by chatgpt clones, that just feed the users prompts, into the real thing and put ads, next to the answers.

使用 Zig 開發 Nodejs 原生模塊
Node-API[1]（前身爲 N-API）是 Nodejs 提供的用於構建原生插件的 API。它獨立於底層 JavaScript 運行時（例如 V8），並作爲 Node.js 自身的一部分進行維護。該 API 在不同版本的 Node.js 中具有穩定的應用二進制接口 (ABI)。其目的是使附加組件不受底層 JavaScript 引擎變化的影響，並允許爲一個主要版本編譯的模塊在以後的主要 Node ⌘ Read more

MCP vs API
Comments ⌘ Read more

[$] Slowing the flow of core-dump-related CVEs
The 6.16 kernel will include a number of changes to how the kernel handles
the processing of core dumps for crashed processes. Christian Brauner explained
his reasons for doing this work as: “Because I’m a clown and also I had
it with all the CVEs because we provide a **** API for userspace”. The
handling of core dumps has indeed been a constant source of
vulnerabilities; with luck, the 6.16 work will result in rather fewer of
th … ⌘ Read more

Bypassing HackerOne Report Ban Using API Key

Image

How a Banned Researcher Could Still Submit Reports Using the REST API

[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/bypassing-hackerone-report-ban-using-api-key-061711e873c6?source=rss—-7b … ⌘ Read more

GitHub Recon: The Underrated Technique to Discover High-Impact Leaks in Bug Bounty

Image

Master the Art of Finding API Keys, Credentials and Sensitive Data in Public Repositories

[Continue re … ⌘ Read more

Exploiting Server-Side Parameter Pollution in Query Strings — An API Hacking Tale ⌘ Read more

API 設計的 “Go 境界”：Go 團隊設計 MCP SDK 過程中的取捨與思考
大家好，我是 Tony Bai。作爲開發者，我們每天都在與 API 打交道——調用它們，設計它們，有時也會爲糟糕的 API 設計而頭痛不已。一個優秀的 API，如同一位技藝精湛的嚮導，能清晰、高效地引領我們通往復雜功能的彼岸；而一個蹩腳的 API，則可能像一座佈滿陷阱的迷宮，讓我們步履維艱。那麼，在 Go 語言的世界裏，一個 “好” 的 API 應該是什麼樣子的？它應該如何體現 Go 語言簡潔、高 ⌘ Read more

API 設計的 “Go 境界”：Go 團隊設計 MCP SDK 過程中的取捨與思考
大家好，我是 Tony Bai。作爲開發者，我們每天都在與 API 打交道——調用它們，設計它們，有時也會爲糟糕的 API 設計而頭痛不已。一個優秀的 API，如同一位技藝精湛的嚮導，能清晰、高效地引領我們通往復雜功能的彼岸；而一個蹩腳的 API，則可能像一座佈滿陷阱的迷宮，讓我們步履維艱。那麼，在 Go 語言的世界裏，一個 “好” 的 API 應該是什麼樣子的？它應該如何體現 Go 語言簡潔、高 ⌘ Read more

[$] LWN.net Weekly Edition for May 22, 2025
Inside this week’s LWN.net Weekly Edition:

• Front: Home Assistant; Setuptools; Debian AI GR; DMA-mapping API; BPF CI; OSPM 2025

• Briefs: Go audit; Oniux; Asahi progress; Rust in FreeBSD; RHEL 10; Rust 1.87.0; RIP John L. Young; Quote; …

• Announcements: Newsletters, conferences, security updates, patches, and more. ⌘ Read more

i switched my bookmarks site from espial (unmaintained project) to linkding, and while i’ll miss espial’s simplicity, i do appreciate linkding’s power and the provided API.

at first i got auth working with my SSO (authelia) and was happy, but i want my public bookmarks available without login… and i couldn’t configure my proxy to make that work, because of issues with sub paths, which sucks. so i switched to linkding’s built-in auth. inconvenient, but worth it to share my bookmarks.

https://bookmarks.4-walls.net/bookmarks/shared

RAG-MCP：突破大模型工具調用瓶頸，告別 Prompt 膨脹
大語言模型（LLM）的浪潮正席捲全球，其強大的自然語言理解、生成和推理能力，爲各行各業帶來了前所未有的機遇。然而，正如我們在之前的探討中多次提及，LLM 並非萬能。它們受限於訓練數據的時效性和範圍，也無法直接與瞬息萬變的外部世界進行實時交互或執行需要特定技能的操作。爲了彌補這些不足，賦予 LLM 調用外部工具（如搜索引擎、數據庫、計算器、各類 API 服務）的能力，成爲了學術界和工業界共同關注的焦 ⌘ Read more

Lab: Exploiting a mass assignment vulnerability

Image

Portswigger Lab API module

Continue reading on InfoSec Write-ups » ⌘ Read more

IPinfo Free Geolocation API: Tools, Setup & Use Cases ⌘ Read more

Instagram API Documentation: Key Concepts Explained for Developers ⌘ Read more

Get Geocoding API Key: Step-by-Step Guide for Developers ⌘ Read more

An Asahi Linux 6.15 progress report
The Asahi Linux
project, which supports Linux on Apple Silicon Macs, has published a
progress report ahead of the 6.15 kernel’s release.

We are pleased to announce that our graphics driver userspace API
(uAPI) has been merged into the Linux kernel. This major milestone
allows us to finally enable OpenGL, OpenCL and Vulkan support for
Apple Silicon in upstream Mesa. This is the only time a graphics
driver’s uAPI has been merged into the kernel independent … ⌘ Read more

Understanding task types in the Gemini Embedding API
Comments ⌘ Read more

[$] A new DMA-mapping API
Leon Romanovsky began his session at the 2025 Linux Storage, Filesystem,
Memory Management, and BPF Summit (LSFMM+BPF) by explaining that the improved DMA-mapping API that he has been
working on is a group effort. He, Chaitanya Kulkarni, Christoph Hellwig,
Jason Gunthorpe, and others are proposing to modernize the API and to
“make it more suitable for current kernels”. He told the assembled
storage and filesystem developers that the progress on the proposal has
stalled, but that it was the basis for further … ⌘ Read more

Analyzing API design via algebraic laws
Comments ⌘ Read more

Two months in Servo: CSS nesting, Shadow DOM, Clipboard API, and more
Comments ⌘ Read more

API Key Exposure in NASA GitHub Repository Leads to Unauthorized Access to Academic Data

Image

🔓Free Article Link

[Continue reading on InfoSec Write-ups »](https://infosecwriteu … ⌘ Read more

Windows Todo application built with pure C and the Win32 API
Comments ⌘ Read more

人人都需要一個 HTTP proxy 來 debug
前言介紹了作爲前端工程師如何使用 HTTP proxy 來進行 debug，超越了 DevTools 的限制。今日文章由前端早讀課 @huli 分享。身爲每天都要與網頁打交道的前端工程師，熟悉 DevTools 的使用是相當合理的。每當接 API 出問題時，就按下快捷鍵打開 DevTools，切到 Network 分頁，找到紅色的那一行，右鍵複製成 cURL 粘貼到羣裏面，讓後端自己找找問題。但不 ⌘ Read more

必裝的一些 MCP Server 推薦（程序員篇）
玩 MCP 我是認真的，也寫了好幾篇的實操教程，當然了主要是自己的試用體驗分享。使用過程中發現可以用起來了，甚至可以串起來當作工作流的一環了。今天分享一下關於程序員必備的幾個，試着組合起來，提高自己的效率吧。GitHub MCP Server—————–推薦的理由：GitHub MCP Server 能與 GitHub API 實現無縫集成，爲開發者和工具提供高級的自動化和交 ⌘ Read more

A Rust API Inspired by Python, Powered by Serde
Comments ⌘ Read more

Hackers Love Your APIs: How to Defend Against 2025’s Biggest API Threats ⌘ Read more

Is Your App Protected? The Branch API Vulnerability You Need to Know About

Image

$fallback_url is a helpful feature in Branch’s deep linking system — until someone uses it to redirect your users to phishing … ⌘ Read more

現代 JavaScript 異步寫法：不依賴 await，構建高性能異步系統
在 ES6 + 時代，JavaScript 異步編程經歷了重大變革。雖然async/await語法顯著提升了代碼可讀性，但在某些場景下直接操作 Promise 和利用新特性能帶來更精細的控制。1. Promise 鏈式操作fetch(’https://api.example.com/data’)  .then(response =  {    if (!response.ok) throw ne ⌘ Read more

如何在 Go 中設計並公開接口
Go 語言中的接口（interface）是其最具特色的功能之一。與許多其他語言不同，在 Go 中，類型不需要顯式聲明實現某個接口。只要一個類型定義了接口所需的方法，它就自動實現了該接口。然而，編寫良好的接口並不容易。不恰當地暴露寬泛或不必要的接口，容易污染包的 API。本文將解釋現有接口設計準則背後的邏輯，並結合標準庫中的示例進行說明。「接口越大，抽象越弱」大型接口往往難以找到多個實現類型。因此， ⌘ Read more

如何在 Go 中設計並公開接口
Go 語言中的接口（interface）是其最具特色的功能之一。與許多其他語言不同，在 Go 中，類型不需要顯式聲明實現某個接口。只要一個類型定義了接口所需的方法，它就自動實現了該接口。然而，編寫良好的接口並不容易。不恰當地暴露寬泛或不必要的接口，容易污染包的 API。本文將解釋現有接口設計準則背後的邏輯，並結合標準庫中的示例進行說明。「接口越大，抽象越弱」大型接口往往難以找到多個實現類型。因此， ⌘ Read more

Understanding Kubernetes Gateway API: A Modern Approach to Traffic Management
Traffic management in Kubernetes can be complex, especially with modern applications composed of multiple services like frontends, APIs, and backends spread across hybrid and multi-cloud environments. As these environments grow, ensuring secure, efficient, and reliable communication… ⌘ Read more

API Hacking on Mercedes-Benz

Image

How Recon and Persistence Led to a Valid XSS on Mercedes-Benz

Continue reading on InfoSec Write-ups » ⌘ Read more

** From JS File to Jackpot: How I Found API Keys and Secrets Hidden in Production Code**

Image

Hey there!😁

[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/from-js-file-to- … ⌘ Read more

Lab: Finding and exploiting an unused API endpoint

Image

Art of exploiting using an unused API endpoint

[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/lab-finding-and-exploiting-an-unused-api-endpoint-79fa6744f21e?source=rss—-7b72 … ⌘ Read more

@kat@yarn.girlonthemoon.xyz MinIO is a good choice for a self-hosted Object Storage (compatible with S3 APIs) 👌

Replacing API schema coupling with semantics
Comments ⌘ Read more

**Master Spring Boot APIs Like a Pro: Skills That Distinguish Good Developers from Great Ones **

Image

In the fast-moving world of backend development, it’s no longer enough to … ⌘ Read more

GitHub for Beginners: Building a REST API with Copilot
See how you can use GitHub Copilot to build an API.

The post GitHub for Beginners: Building a REST API with Copilot appeared first on The GitHub Blog. ⌘ Read more

4 大類 AI Agent 協議框架全面綜述
對現有的 LLM AI Agent 通信協議進行了系統性的概述，並將其分爲四大類，以幫助用戶和開發者爲特定應用場景選擇最適合的協議。一、AI Agent 協議的發展AI Agent 協議的定義：代理協議是標準化框架，定義了代理之間以及代理與外部系統之間結構化通信的規則、格式和程序。與傳統交互機制（如 API、GUI 或 XML）相比，協議在效率、操作範圍、標準化和 AI 原生性方面具有顯著優勢。代 ⌘ Read more

使用 Go 進行 HTTP 流量重放測試
在 Web 安全測試、API 調試、流量回歸測試中，HTTP 流量重放（HTTP Traffic Replay）是一項重要的技術。它可以幫助我們復現問題、測試系統兼容性、進行安全研究等。在這篇文章中，我們將簡單探討 HTTP 流量重放的原理，並通過 Go 語言實現不同的流量重放方案，同時介紹常見的開源工具。（身爲一個在小公司裏的網安牛馬，總得幹些雜活🐂🐎）HTTP 流量重放的原理HTTP 流量重放 ⌘ Read more

使用 Go 進行 HTTP 流量重放測試
在 Web 安全測試、API 調試、流量回歸測試中，HTTP 流量重放（HTTP Traffic Replay）是一項重要的技術。它可以幫助我們復現問題、測試系統兼容性、進行安全研究等。在這篇文章中，我們將簡單探討 HTTP 流量重放的原理，並通過 Go 語言實現不同的流量重放方案，同時介紹常見的開源工具。（身爲一個在小公司裏的網安牛馬，總得幹些雜活🐂🐎）HTTP 流量重放的原理HTTP 流量重放 ⌘ Read more

Unrestricted Access to All User Information | REST API Oversharing ⌘ Read more

[$] DMA addresses for UIO
The Userspace\
I/O (UIO) subsystem was first added to the kernel by
Hans J. Koch for the 2.6.32 release in 2007. Its purpose is to facilitate
the writing of drivers (mostly) in user space; to that end, it provides
access to a number of resources that user-space code normally cannot touch.
One piece that is missing, though, is DMA addresses. [A proposal to\
fill that gap](https://lwn.net/ml/all/20250410-uio-dma-v … ⌘ Read more

Exploring GitHub CLI: How to interact with GitHub’s GraphQL API endpoint
Discover practical tips and tricks for forming effective GraphQL queries and mutations.

The post Exploring GitHub CLI: How to interact with GitHub’s GraphQL API endpoint appeared first on The GitHub Blog. ⌘ Read more