// Good: choose between two options as appropriate (see below). import * as ng from '@angular/core'; import {Foo} from './foo'; // Only when needed: default imports. import Button from 'Button'; // Sometimes needed to import libraries for their side effects: import 'jasmine'; import '@polymer/paper-button'; Import paths TypeScript code must use paths to import other TypeScript code. Paths may be r
はじめに 対象イベント 読み方、使い方 Remote Code Execution(RCE) 親ディレクトリ指定によるopen_basedirのバイパス PHP-FPMのTCPソケット接続によるopen_basedirとdisable_functionsのバイパス JavaのRuntime.execでシェルを実行 Cross-Site Scripting(XSS) nginx環境でHTTPステータスコードが操作できる場合にCSPヘッダーを無効化 GoogleのClosureLibraryサニタイザーのXSS脆弱性 WebのProxy機能を介したService Workerの登録 括弧を使わないXSS /記号を使用せずに遷移先URLを指定 SOME(Same Origin Method Execution)を利用してdocument.writeを順次実行 SQL Injection MySQ
REST API Design Best Practices Handbook – How to Build a REST API with JavaScript, Node.js, and Express.js
By Jean-Marc Möckel I've created and consumed many API's over the past few years. During that time, I've come across good and bad practices and have experienced nasty situations when consuming and building API's. But there also have been great moments. There are helpful articles online which present many best practices, but many of them lack some practicality in my opinion. Knowing the theory with
Developers are increasingly relying on AI coding assistants to accelerate our daily workflows. These tools can autocomplete functions, suggest bug fixes, and even generate entire modules or MVPs. Yet, as many of us have learned, the quality of the AI’s output depends largely on the quality of the prompt you provide. In other words, prompt engineering has become an essential skill. A poorly phrased
What's New In DevTools (Chrome 94) | Blog | Chrome for Developers
Use DevTools in your preferred language Chrome DevTools now supports more than 80 languages, allowing you to work in your preferred language! Open Settings, then select your preferred language under the Preferences > Language dropdown and reload DevTools. Preferences" width="800" height="494"> Chromium issue: 1163928 New Nest Hub devices in the Device list You can now simulate the dimensions of Ne
With pen and paper, anyone can write a journal entry, draw a diagram, perform a calculation, or sketch a cartoon. Digital tablets like the iPad or reMarkable can adapt pen and paper into the world of digital media. In doing so, they trade away some of paper’s advantages like cheapness and tangibility. In exchange, we get new computational powers like nondestructive editing and ease of transmission
Toggle dark mode What follows is a brain dump of everything I know about compiling Rust to WebAssembly. Enjoy. Some time ago, I wrote a blog post on how to compile C to WebAssembly without Emscripten, i.e. without the default tool that makes that process easy. In Rust, the tool that makes WebAssembly easy is called wasm-bindgen, and we are going to ditch it! At the same time, Rust is a bit differe
Why Rust strings seem hard April 13, 2021 Lately I've been seeing lots of anecdotes from people trying to get into Rust who get really hung up on strings (&str, String, and their relationship). Beyond Rust's usual challenges around ownership, there can be an added layer of frustration because strings are so easy in the great majority of languages. You just add them together, split them, whatever!
WebKit Features in Safari 18.0
ContentsNew in Safari 18Web apps for MacCSSSpatial WebHTMLJavaScriptWeb APICanvasManaged Media SourceWebRTCHTTPSWebGLWeb InspectorPasskeysSafari ExtensionsApple PayDeprecationsBug Fixes and moreUpdating to Safari 18.0Feedback Safari 18.0 is here. Along with iOS 18, iPadOS 18, macOS Sequoia and visionOS 2, today is the day another 53 web platform features, as well as 25 deprecations and 209 resolve
Join a VS Code Dev Days event near you to learn about AI-assisted development in VS Code. Update 1.54.1: The update addresses an issue with an extension dependency. Update 1.54.2: The update addresses these issues. Update 1.54.3: The update addresses this issue. Downloads: Windows: x64 Arm64 | Mac: Universal Intel silicon | Linux: deb rpm tarball Arm snap Welcome to the February 2021 release of Vi
python_modules.pdf
Python3 OpenCV / Pillow / pygame / Eel / PyDub / NumPy / matplotlib / SciPy / SymPy / gmpy2 / hashlib, passlib / Cython / Numba / ctypes / PyInstaller / curses / tqdm / JupyterLab / json / psutil / urllib / zenhan / jaconv Copyright © 2017-2025, Katsunori Nakamura 2025 8 19 Python ‘ .py’ Python Python Windows PSF Python py .py Enter macOS Linux PSF Python python3 .py Enter Anaconda Prompt Python p
The string is arguably the most essential data type in programming — every programming language and software in the world uses strings in one way or another. It enables humans to easily communicate with sophisticated programs and machines. One thing that would help you a lot as a programmer is understanding how to use and manipulate strings so that you can build programs users love. Regular expres
The proposal “Pipe operator (|>) for JavaScript” (by J. S. Choi, James DiGioia, Ron Buckton and Tab Atkins) introduces a new operator. This operator is an idea borrowed from functional programming that makes applying functions more convenient in many cases. This blog post describes how the pipe operator works and what its use cases are (there are more than you might expect!). The two competing pro
WebKit Features in Safari 17.2
ContentsHTMLCSSImages and videoJavaScriptWeb APIWeb AppsWebGLPrivacyWeb InspectorFixes for Interop 2023 and moreUpdating to Safari 17.2Feedback Web technology is constantly moving forward, with both big new features and small subtle adjustments. Nowadays, web developers expect web browsers to update multiple times a year, instead of the once or twice a year typical of the late 2000s — or the once
Jun 10, 2024 by Jen Simmons, Jon Davis, Karl Dubost, Anne van Kesteren, Marcos Cáceres, Ada Rose Canon, Tim Nguyen, Sanjana Aithal, Pascoe, and Garrett Davidson ContentsWebXRCSSWeb apps for MacSafari ExtensionsSpatial mediaHTMLMediaWebRTCPasskeysHTTPSJavaScriptWeb APICanvasWebGLWeb InspectorWKWebViewApple PayDeprecationsBug Fixes and moreHelp us Beta TestFeedback The last year has been a great one
V8’s end-tier optimizing compiler, Turbofan, is famously one of the few large-scale production compilers to use Sea of Nodes (SoN). However, since almost 3 years ago, we’ve started to get rid of Sea of Nodes and fall back to a more traditional Control-Flow Graph (CFG) Intermediate Representation (IR), which we named Turboshaft. By now, the whole JavaScript backend of Turbofan uses Turboshaft inste
I’m a fairly frequent Hacker News lurker, especially when I have some other important task that I’m avoiding. I normally head to the Active page (lots of comments, good for procrastination) and pick a nice long discussion thread to browse. So over time I’ve ended up with a good sense of what topics come up a lot. “The Bay Area is too expensive.” “There are too many JavaScript frameworks.” “Bootcam
ECMAScript proposal: RegExp flag `/v` makes character classes and character class escapes more powerful
ECMAScript proposal: RegExp flag /v makes character classes and character class escapes more powerful In this blog post, we look at the ECMAScript proposal “RegExp v flag with set notation + properties of strings” by Markus Scherer and Mathias Bynens. The new flag /v # The proposed new regular expression flag /v (.unicodeSets) enables three features: Support for multi-code-point graphemes (such a
We've talked quite a bit about linting in the past two posts of this series, so I thought it's time to give eslint the proper limelight it deserves. Overall eslint is so flexible, that you can even swap out the parser for a completely different one. That's not a rare scenario either as with the rise of JSX and TypeScript that is frequently done. Enriched by a healthy ecosystem of plugins and prese
After almost three years since the initial design document and hundreds of CLs in the meantime, the V8 Sandbox — a lightweight, in-process sandbox for V8 — has now progressed to the point where it is no longer considered an experimental security feature. Starting today, the V8 Sandbox is included in Chrome's Vulnerability Reward Program (VRP). While there are still a number of issues to resolve be
prompts.chat
Welcome to the “Awesome ChatGPT Prompts” repository! While this collection was originally created for ChatGPT, these prompts work great with other AI models like Claude, Gemini, Hugging Face Chat, Llama, Mistral, and more. ChatGPT is a web interface created by OpenAI that provides access to their GPT (Generative Pre-trained Transformer) language models. The underlying models, like GPT-4o and GPT-o
Toggle dark mode Add WebAssembly, get performance. Is that how it really works? The incredibly unsatisfying answer is: It depends. It depends on oh-so-many factors, and I’ll be touching on some of them here. Why am I doing this? (You can skip this) I really like AssemblyScript (full disclosure: I am one of their backers). It’s a very young language with a small but passionate team that built a cus
What's New In DevTools (Chrome 89) | Blog | Chrome for Developers
Debugging support for Trusted Types violations Breakpoint on Trusted Type violations You can now set breakpoints and catch exceptions on Trusted Type Violations in the Sources panel. Trusted Types API helps you prevent DOM-based cross-site scripting vulnerabilities. Learn how to write, review and maintain applications free of DOM XSS vulnerabilities with Trusted Types here. In the Sources panel, o
Why SQL template tags are not vulnerable to SQL injection attacksLearn what SQL template tags are, how they work under the hood, and why the are not vulnerable to SQL injection attacks SQL injection is one of the most well-known security vulnerabilities, allowing attackers to manipulate database queries and potentially gain unauthorized access to sensitive data. However, using our serverless drive
A Tour of WebAuthn
This book was distributed at the FIDO Authenticate conference in 2024. Its intended format was as a PDF, which you can find here. The following is the contents of the PDF converted to HTML. 1: Introduction Passwords are rubbish. If you’re reading this book then hopefully you’re already on board with this idea, but let’s recap anyway. The typical practice with passwords is to remember a few differe
// Good: choose between two options as appropriate (see below). import * as ng from '@angular/core'; import {Foo} from './foo'; // Only when needed: default imports. import Button from 'Button'; // Sometimes needed to import libraries for their side effects: import 'jasmine'; import '@polymer/paper-button'; Import paths TypeScript code must use paths to import other TypeScript code. Paths may be r
Ezno in '23
It's been a minute since the previous announcement so I thought would give some updates and share some upcoming problems. This follows the initial announcement and includes some smaller things I shared on Twitter since the announcement post. Never heard of Ezno? It is a parser, partial executor, optimizer and type checker for JavaScript! Read the initial announcement. New changes Classes, getters
Large Text Compression Benchmark Matt Mahoney Last update: July 3, 2025. history This competition ranks lossless data compression programs by the compressed size (including the size of the decompression program) of the first 109 bytes of the XML text dump of the English version of Wikipedia on Mar. 3, 2006. About the test data. The goal of this benchmark is not to find the best overall compressi
What's New In DevTools (Chrome 101) | Blog | Chrome for Developers
Import and export recorded user flows as a JSON file The Recorder panel now supports importing and exporting user flow recordings as a JSON file. This addition makes it easier to share user flows and can be useful for bug reporting. For example, download this JSON file. You can import it with the import button and replay the user flow. Apart from that, you can export the recording as well. After r
Bloom Filters - Much, much more than a space efficient hashmap! | Ben E. C. Boyter
Bloom Filters - Much, much more than a space efficient hashmap! 2020/12/10 (2440 words) A bloom filter is one of those data structures you are probably already aware of, or have at least heard about. For those looking for a simple recap, they are a probabilistic data structure which can be used to determine if something is in a set or not, giving a slight chance of returning a false positive resul
JupyterLab Changelog — JupyterLab 4.5.0a3 documentation
JupyterLab Changelog# v4.4# JupyterLab 4.4 includes a number of new features (described below), bug fixes, and enhancements. This release is compatible with extensions supporting JupyterLab 4.0. Extension authors are encouraged to consult the Extension Migration Guide which lists deprecations and changes to the public API. Code console improvements# The code console prompt can now be positioned on
UPDATED: 2025-02-15: Fixed some bugs in the examples and pointed out that you don't usually just want to panic on memory allocation failure. I've been writing a lot of Rust recently, and as anyone who has learned Rust can tell you, a huge part of the process of learning Rust is learning to work within its restrictive memory model, which forbids many operations that would be perfectly legal in eith
Automated tests are important. Without them, programmers waste a huge amount of time manually checking and fixing their code. Unfortunately, many automated tests also waste a huge amount of time. The easy, obvious way to write tests is to make broad tests that are automated versions of manual tests. But they’re flaky and slow. Folks in the know use mocks and spies (I say “mocks” for short in this
Show navigation This blog post has been authored by José Dapena Paz (Igalia), with contributions from Jason Williams (Bloomberg), Ashley Claymore (Bloomberg), Rob Palmer (Bloomberg), Joyee Cheung (Igalia), and Shu-yu Guo (Google). In this post about V8 heap snapshots, I will talk about some performance problems found by Bloomberg engineers, and how we fixed them to make JavaScript memory analysis
In the previous post, I covered how I reimplemented JSON::Generator::State#configure in Ruby and some other changes. Unfortunately, it didn’t go as well as I initially thought. Mistakes Were Made The default gems that ship with Ruby are automatically copied inside ruby/ruby’s repo. In short, there’s a bot aptly named matzbot, that replicates all the commits from the various ruby/* gems, inside rub
GitHub - ComfyUI-Workflow/awesome-comfyui: A collection of awesome custom nodes for ComfyUI
ComfyUI-Gemini_Flash_2.0_Exp (⭐+172): A ComfyUI custom node that integrates Google's Gemini Flash 2.0 Experimental model, enabling multimodal analysis of text, images, video frames, and audio directly within ComfyUI workflows. ComfyUI-ACE_Plus (⭐+115): Custom nodes for various visual generation and editing tasks using ACE_Plus FFT Model. ComfyUI-Manager (⭐+113): ComfyUI-Manager itself is also a cu
j次のブックマーク
k前のブックマーク
lあとで読む
eコメント一覧を開く
oページを開く
Google TypeScript Style Guide
【2020年】CTF Web問題の攻撃手法まとめ - こんとろーるしーこんとろーるぶい
The Prompt Engineering Playbook for Programmers
Inkbase: Programmable Ink
Rust to WebAssembly the hard way — surma.dev
Why Rust strings seem hard | Brandon's Website
February 2021 (version 1.54)
The ultimate JavaScript regex guide
A pipe operator for JavaScript: introduction and use cases
News from WWDC24: WebKit in Safari 18 beta
Land ahoy: leaving the Sea of Nodes · V8
Hacker News folk wisdom on visual programming
Speeding up the JavaScript ecosystem - eslint
The V8 Sandbox · V8
Is WebAssembly magic performance pixie dust? — surma.dev
Why SQL template tags are not vulnerable to SQL injection attacks - Neon
Google TypeScript Style Guide
Large Text Compression Benchmark
Understanding Memory Management, Part 1: C
James Shore: Testing Without Mocks: A Pattern Language
Speeding up V8 heap snapshots · V8
Optimizing Ruby’s JSON, Part 3