はじめに 対象イベント 読み方、使い方 Remote Code Execution(RCE) 親ディレクトリ指定によるopen_basedirのバイパス PHP-FPMのTCPソケット接続によるopen_basedirとdisable_functionsのバイパス JavaのRuntime.execでシェルを実行 Cross-Site Scripting(XSS) nginx環境でHTTPステータスコードが操作できる場合にCSPヘッダーを無効化 GoogleのClosureLibraryサニタイザーのXSS脆弱性 WebのProxy機能を介したService Workerの登録 括弧を使わないXSS /記号を使用せずに遷移先URLを指定 SOME(Same Origin Method Execution)を利用してdocument.writeを順次実行 SQL Injection MySQ
技術部の笹田（ko1）と遠藤（mame）です。クックパッドで Ruby (MRI: Matz Ruby Implementation、いわゆる ruby コマンド) の開発をしています。お金をもらって Ruby を開発しているのでプロの Ruby コミッタです。 本日 12/25 に、ついに Ruby 3.0.0 がリリースされました。一昨年、昨年に続き、今年も Ruby 3.0 の NEWS.md ファイルの解説をします。NEWS ファイルとは何か、は一昨年の記事を見てください（なお Ruby 3.0.0 から、NEWS.md にファイル名を変えました）。 プロと読み解く Ruby 2.6 NEWS ファイル - クックパッド開発者ブログ プロと読み解くRuby 2.7 NEWS - クックパッド開発者ブログ Ruby 3.0 は、Ruby にとってほぼ 8 年ぶりのメジャーバージョンア
(追記)本記事で使用しているLINE Notifyが2025/3/31にサービス終了します。今後はLINE Messaging APIへ通知するよう変更した以下記事のツールを代わりにご使用ください。 こんにちは、つくぼし(tsukuboshi0755)です! みなさんは、利用中の AWS 料金を逐一把握されていますでしょうか？ リソースの消し忘れ等で、いつのまにか AWS からの請求額がとんでもない事になっていた...という体験談を持つ方もいらっしゃるかと思います。(私もその一人です) 上記の対策として、以下の記事のように、AWS の請求額を毎日通知するシステムを構築し、確認する方法が挙げられます。 こちらのシステムは非常に便利なのですが、 Slack への通知が前提となるため、普段 Slack を利用していない方からすると多少扱いづらいかもしれません。 そこで今回は、上記のシステムを少し
Introducing Amazon Managed Workflows for Apache Airflow (MWAA) | Amazon Web Services
AWS News Blog Introducing Amazon Managed Workflows for Apache Airflow (MWAA) As the volume and complexity of your data processing pipelines increase, you can simplify the overall process by decomposing it into a series of smaller tasks and coordinate the execution of these tasks as part of a workflow. To do so, many developers and data engineers use Apache Airflow, a platform created by the commun
A few months ago, I set myself the challenge of writing a C compiler in 500 lines of Python1, after writing my SDF donut post. How hard could it be? The answer was, pretty hard, even when dropping quite a few features. But it was also pretty interesting, and the result is surprisingly functional and not too hard to understand! There's too much code for me to comprehensively cover in a single blog
4 Pandas Anti-Patterns to Avoid and How to Fix Them
pandas is a powerful data analysis library with a rich API that offers multiple ways to perform any given data manipulation task. Some of these approaches are better than others, and pandas users often learn suboptimal coding practices that become their default workflows. This post highlights four common pandas anti-patterns and outlines a complementary set of techniques that you should use instea
「DeepSeek-R1 の推論を自分のローカル デバイスで再現できるように」「わずか7GBのVRAMでアハ体験を」とのことなので、UnslothのGRPO（Group Relative Policy Optimizatin）トレーニングを試してみます。 今回は Phi-4 (14B)で試してみます。 You can now reproduce DeepSeek-R1's reasoning on your own local device! Experience the "Aha" moment with just 7GB VRAM. Unsloth reduces GRPO training memory use by 80%. 15GB VRAM can transform Llama-3.1 (8B) & Phi-4 (14B) into reasoning models. Blo
Parsing SQL - Strumenta
The code for this tutorial is on GitHub: parsing-sql SQL is a language to handle data in a relational database. If you worked with data you have probably worked with SQL. In this article we will talk about parsing SQL. It is in the same league of HTML: maybe you never learned it formally but you kind of know how to use it. That is great because if you know SQL, you know how to handle data. However
Over the course of my Spring 2020 semester at Harvey Mudd College, I developed a self-hosting compiler entirely from scratch. This article walks through many interesting parts of the project. It’s laid out so you can just read from beginning to end, but if you’re more interested in a particular topic, feel free to jump there. Or, take a look at the project on GitHub. Table of contents What the pro
Lately I’ve been messing around with Python 3.12, discovering new features around typing and pattern matching. Combined with dataclasses, they provide support for a style of programming that I’ve employed in Kotlin and Typescript at work. That style in turn is based on what I’d do in OCaml or Haskell, like modelling data with algebraic data types. However, the more advanced concepts from Haskell —
Python is one of the most widely adopted programming languages in the world. Yet, because of it’s ease and simplicity to just “get something working”, it’s also one of the most underappreciated. If you search for Top 10 Advanced Python Tricks on Google or any other search engine, you’ll find tons of blogs or LinkedIn articles going over trivial (but still useful) things like generators or tuples.
python_modules.pdf
Python3 OpenCV / Pillow / pygame / Eel / PyDub / NumPy / matplotlib / SciPy / SymPy / gmpy2 / hashlib, passlib / Cython / Numba / ctypes / PyInstaller / curses / tqdm / JupyterLab / json / psutil / urllib / zenhan / jaconv Copyright © 2017-2025, Katsunori Nakamura 2025 8 19 Python ‘ .py’ Python Python Windows PSF Python py .py Enter macOS Linux PSF Python python3 .py Enter Anaconda Prompt Python p
Lean for JavaScript DevelopersSeptember 2, 2025 This is my opinionated syntax primer for the Lean programming language. It is far from complete and may contain inaccuracies (I’m still learning Lean myself) but this is how I wish I was introduced to it, and what I wish was clarified. Why Lean? This post assumes you’re already eager to learn a bit of Lean. For motivation, I humbly submit to you two
This year’s Advent of Code has been brutal (compare the stats of 2023 with that of 2022, especially day 1 part 1 vs. day 1 part 2). It included a problem to solve with dynamic programming as soon as day 12, which discouraged some people I know. This specific problem was particularly gnarly for Advent of Code, with multiple special cases to take into account, making it basically intractable if you
In 2006 Microsoft conducted a customer survey to find what new features users want in new versions of Microsoft Office. To their surprise, more than 90% of what users asked for already existed, they just didn't know about it. To address the "discoverability" issue, they came up with the "Ribbon UI" that we know from Microsoft Office products today. Office is not unique in this sense. Most of us ar
For demonstration purposes, we'll fine-tune the multilingual version of the small checkpoint with 244M params (~= 1GB). As for our data, we'll train and evaluate our system on a low-resource language taken from the Common Voice dataset. We'll show that with as little as 8 hours of fine-tuning data, we can achieve strong performance in this language. 1{}^11 The name Whisper follows from the acronym
Writing Pythonic Rust
Over the past several weeks I have been attempting to reimplement the API of an existing python library as a wrapper for an equivalent library in Rust. tl;dr: this ended up being much harder than I expected it to be, partly because of important differences in the behaviour of the two languages, and partly because of the (self-imposed) obligation to match an existing (idiomatic) python API. Motivat
Announcing DuckDB 1.3.0
To install the new version, please visit the installation guide. Note that it can take a few hours to days to release some client libraries (e.g., Go, R, Java) and extensions (e.g., the UI) due to the extra changes and review rounds required. We are proud to release DuckDB 1.3.0. This release of DuckDB is named “Ossivalis” after Bucephala Ossivalis, an ancestor of the Goldeneye duck that lived mil
Type Parameters Proposal
Ian Lance Taylor Robert Griesemer August 20, 2021 StatusThis is the design for adding generic programming using type parameters to the Go language. This design has been proposed and accepted as a future language change. We currently expect that this change will be available in the Go 1.18 release in early 2022. AbstractWe suggest extending the Go language to add optional type parameters to type an
For almost a complete decade—starting with discovering Haskell in about 2009 and right up until switching to a job where I used primarily Ruby and C++ in about 2019—I would have called myself first and foremost a Haskell programmer. Not necessarily a dogmatic Haskeller! I was—and still am—proudly a polyglot who bounces between languages depending on the needs of the project. However, Haskell was m
Plan 9 Desktop Guide
PLAN 9 DESKTOP GUIDE INDEX What is Plan 9? Limitations and Workarounds Connecting to Other Systems VNC RDP SSH 9P Other methods Porting Applications Emulating other Operating Systems Virtualizing other Operating Systems Basics Window Management Copy Pasting Essential Programs Manipulating Text in the Terminal Acme - The Do It All Application Multiple Workspaces Tiling Windows Plumbing System Admin
Large Text Compression Benchmark Matt Mahoney Last update: July 3, 2025. history This competition ranks lossless data compression programs by the compressed size (including the size of the decompression program) of the first 109 bytes of the XML text dump of the English version of Wikipedia on Mar. 3, 2006. About the test data. The goal of this benchmark is not to find the best overall compressi
Cloud9 で SAM を利用し AWS サービス毎の請求額を毎日 Slack に通知する | DevelopersIO
Cloud9 を利用して AWS のサービス毎の料金を毎日 Slack に通知する仕組みを作成しました。 コーヒーが好きな emi です。 AWSサービス毎の請求額を毎日 Slack に通知するため、以下のブログ AWSサービス毎の請求額を毎日Slackに通知してみた を見ながら設定しようとしたのですが、手元の Windows 11 端末に AWS CLI、AWS SAM CLI、Python などの開発環境を整えるのが面倒…！！と思いました。 そこで、AWS Cloud9 を使って手軽に一時的な開発環境を構築し、AWS Serverless Application Model (SAM) でサーバレス通知システムを構築しました。 AWS Serverless Application Model (SAM) とは AWS SAM は、サーバーレスアプリケーション構築用のオープンソースフレー
While getting my degree in Physics, I had to take classes in both MatLab and Python for scientific computing. I preferred python, where we used the SciPy and NumPy packages. In fact, I used those packages again (along with matplotlib) in an undergraduate research project simulating bacteria films. There's a catch: I was also pursuing a degree in Computer Science, and Python just wasn't fast enough
July 13, 2022 Six Programming Languages I'd Like to See A few weird ideas for programming languages I came up with that it'd be "really" "cool" if someone made (wink) I got 1,000 words into "what, exactly, is software complexity" before remembering that this is supposed to be less effort than the blog. So instead I'm going to list some ideas I had for programming languages. I think all of these ar
I find blockchain fascinating because it extends open source software development to open source + state. This seems to be a genuine/exciting innovation in computing paradigms; We don’t just get to share code, we get to share a running computer, and anyone anywhere can use it in an open and permissionless manner. The seeds of this revolution arguably began with Bitcoin, so I became curious to dril
地面を見下ろす少年の足蹴にされる私
Contracts提案（P2900R14）がC++26に向けて採択され、C++26では契約プログラミング機能を言語サポートの下で実践できるようになります。この記事は、その契約プログラミング機能の一部として導入されている違反ハンドラというものについてのお話です。 契約プログラミング機能における違反ハンドラの概要 ユーザー定義違反ハンドラ std::contracts::contract_violation より一般的な利用 外部ツールの共通コールバック機構として 実行時エラーハンドリングのコールバック機能として（P3290R2） プロファイル機能の実行時検査におけるコールバックとして（P3081R0） 未定義動作の実行時ハンドリング機能として（P3100R0, P3229R1, P3205R0） 参考文献 契約プログラミング機能における違反ハンドラの概要 C++26の契約プログラミング機能は
こちらはGaudiy アドベントカレンダー 202420 日目の記事です。社内のことを書こうと思ったのですが間に合わなかったので、今回は自分が調査したサービスについて紹介しようと思います。 概要 OpenAPI から数種類のプログラミング言語の SDK が生成できるStainlessの紹介と、実際にデモで使ってみた手順や感想を述べます。 導入 弊社のようなプラットフォームを提供する会社では、サービスの API や SDK を提供するケースは多いかと思います。しかし、多言語の SDK を開発・運用することは簡単ではありません。 例えば Node.js の SDK を作る必要が出てきたとき、必要なセットアップはいくつか存在します。 コード 環境構築 TypeScript 整備 使用するライブラリの選定 ESlint や Prittier 等のツール npm package の設定 CICD の
Reindex, Transform, and Aggregate datasets using pandas Library
Most of the time, the dataset we will get from the business will be dirty and cannot be used straight forward to train machine learning models. Therefore, we must treat the dataset and bring it to the desired form to input it into an algorithm. This tutorial discusses reindexing, transforming, and aggregating datasets in Pandas. What are Reindexing, Transforming, and Aggregating?Reindexing, transf
GTF :: Why Haskell?
“Impractical”, “academic”, “niche”. These are a few of the reactions I get when someone discovers that my favourite programming language is Haskell, and not only my favourite in some sort of intellectually-masturbatory way, but favourite for building things, real things, mostly involving web servers. Hobby projects would be one thing, but it gets worse: I have actual teams at Converge working in H
Last month the V8 team published an excellent blog post on what they call the V8 Sandbox. This isn’t a sandbox for your JavaScript code — it’s intended to mitigate browser exploits caused by bugs in the JIT compiler itself. That’s important work because they report that most Chrome exploits start with a V8 memory safety bug. V8 is written in C++, so it may seem like these are the sort of bugs you’
How to install OpenCV 4.10 with CUDA 12 in Ubuntu 24.04
Install_OpenCV4_CUDA12.6_CUDNN8.9.md Install OpenCV 4.10 with CUDA 12.6 and CUDNN 8.9 in Ubuntu 24.04 First of all install update and upgrade your system: $ sudo apt update $ sudo apt upgrade Then, install required libraries: Generic tools: $ sudo apt install build-essential cmake pkg-config unzip yasm git checkinstall Python VirtualEnvironments with VirtualenvWrapper (Optional) Install PIPX: ----
GitHub - ComfyUI-Workflow/awesome-comfyui: A collection of awesome custom nodes for ComfyUI
ComfyUI-Gemini_Flash_2.0_Exp (⭐+172): A ComfyUI custom node that integrates Google's Gemini Flash 2.0 Experimental model, enabling multimodal analysis of text, images, video frames, and audio directly within ComfyUI workflows. ComfyUI-ACE_Plus (⭐+115): Custom nodes for various visual generation and editing tasks using ACE_Plus FFT Model. ComfyUI-Manager (⭐+113): ComfyUI-Manager itself is also a cu
Version 1.0
Version 1.0# For a short description of the main highlights of the release, please refer to Release Highlights for scikit-learn 1.0. Legend for changelogs Major Feature something big that you couldn’t do before. Feature something that you couldn’t do before. Efficiency an existing feature now may not require as much computation or memory. Enhancement a miscellaneous minor improvement. Fix somethin
j次のブックマーク
k前のブックマーク
lあとで読む
eコメント一覧を開く
oページを開く
【2020年】CTF Web問題の攻撃手法まとめ - こんとろーるしーこんとろーるぶい
プロと読み解く Ruby 3.0 NEWS - クックパッド開発者ブログ
AWSサービス毎の請求額を毎日LINEに通知してみた | DevelopersIO
Writing a C compiler in 500 lines of Python
WSL2でunslothのGPROトレーニングを試してみる｜noguchi-shoji
Kalyn: a self-hosting compiler for x86-64
Statically Typed Functional Programming with Python 3.12
14 Advanced Python Features
Lean for JavaScript Developers — overreacted
Dynamic Programming is not Black Magic - Quentin Santos
Lesser Known PostgreSQL Features
Fine-Tune Whisper For Multilingual ASR with 🤗 Transformers
Leaving Haskell behind
Large Text Compression Benchmark
Scientific Computing in Rust - aftix's dominion
Six Programming Languages I'd Like to See
A from-scratch tour of Bitcoin in Python
爆速で多言語SDKをリリースする「Stainless」の紹介
Writing Truly Memory Safe JIT Compilers