はじめに 対象イベント 読み方、使い方 Remote Code Execution(RCE) 親ディレクトリ指定によるopen_basedirのバイパス PHP-FPMのTCPソケット接続によるopen_basedirとdisable_functionsのバイパス JavaのRuntime.execでシェルを実行 Cross-Site Scripting(XSS) nginx環境でHTTPステータスコードが操作できる場合にCSPヘッダーを無効化 GoogleのClosureLibraryサニタイザーのXSS脆弱性 WebのProxy機能を介したService Workerの登録 括弧を使わないXSS /記号を使用せずに遷移先URLを指定 SOME(Same Origin Method Execution)を利用してdocument.writeを順次実行 SQL Injection MySQ
Software Design連載 2022年1月号 運用監視の解像度アップとサービス横断的なログ基盤の整備 - MonotaRO Tech Blog
こんにちは。中山(id:yoichi22) です Software Designに連載させていただいております「Pythonモダン化計画」では、モノタロウの社内事例から読者の皆様のお役に立ちそうな取り組みを紹介させていただいています。のですが、社内でも隣のチームがやってた取り組みを記事で初めて知ることもあって、私も読者として楽しませてもらっています。隣の執筆者さんありがとうございます。 今回は、運用にまつわる監視とログの話題です。本記事の初出は、Software Design2022年1月号「Pythonモダン化計画（第6回）」になります。過去の連載記事は以下を参照ください。 第1回 Software Design連載 2021年8月号 Python製のレガシー＆大規模システムをどうリファクタリングするか 第2回 Software Design連載 2021年9月号 「テストが無い」からの
GraphQL is an incredible piece of technology that has captured a lot of mindshare since I first started slinging it in production in 2018. You won’t have to look far back on this (rather inactive) blog to see I have previously championed this technology. After building many a React SPA on top of a hodge podge of untyped JSON REST APIs, I found GraphQL a breath of fresh air. I was truly a GraphQL h
API シナリオテストツール Postman・Tavern・runn 徹底比較 – 私が runn を選んだ理由 - TechDoctor開発者Blog
はじめに はじめまして、テックドクターでバックエンドエンジニアをしている筧と申します。 最近、弊社では API の品質を担保するために「API シナリオテスト」をプロダクトに導入しました。今回は、この API シナリオテストのツールである Postman(+Newman)、Tavern そして runn を比較し、最終的に runn を選んだ理由をご紹介します。 API シナリオテストとは？ API シナリオテストとはなんでしょうか？ 開発におけるテストといえば、ユニットテストや結合テスト、API テストや E2E テストなどをよく耳にします。しかしAPI シナリオテストという言葉はあまり聞き馴染みがないという方も多いかもしれません。 API シナリオテストは API テストの一種で、複数の API を連鎖的に呼び出して実行するテストです。以下の特徴を持っています。 複数の API を順序
gistfile1.txt �t�˪� p�#̪� You are ChatGPT, a large language model based on the GPT-5 model and trained by OpenAI. Knowledge cutoff: 2024-06 Current date: 2025-08-08 Image input capabilities: Enabled Personality: v2 Do not reproduce song lyrics or any other copyrighted material, even if asked. You're an insightful, encouraging assistant who combines meticulous clarity with genuine enthusiasm and ge
Developers are increasingly relying on AI coding assistants to accelerate our daily workflows. These tools can autocomplete functions, suggest bug fixes, and even generate entire modules or MVPs. Yet, as many of us have learned, the quality of the AI’s output depends largely on the quality of the prompt you provide. In other words, prompt engineering has become an essential skill. A poorly phrased
AIエージェントのUXを進化させる「A2UI」でアプリを構築 - Taste of Tech Topics
こんにちは。大塚です。 普段は生成AIを利用したサービスの開発に携わっているのですが、直近の仕事では、数理最適化の手法を扱う機会がありました。 実は、大学の授業で数理最適化をかじっており、教授がよく 「人の勘や経験に頼っている部分を数式に落とし込むことで、合理的な意思決定ができるようにしよう。」 といっていたことを思い出しました。 まさに今、それを仕事で実践できており、面白くなってきました。 さて、今回のテーマは最適化ではなく、AIエージェントのUIについてです。 現在の生成AIアプリのUIといえば、「チャット」形式がほとんどの状況だと思いますが、チャットのアプリは汎用的な一方で、入力を制御したり、画像や動画の表示が難しかったりと、限界を感じることってありませんか？ そんな悩みを解決してくれる、「A2UI（Agent to UI）」という、AIエージェント用のUIプロトコルが、2025年1
GitHub - modelcontextprotocol/servers: Model Context Protocol Servers
Official integrations are maintained by companies building production ready MCP servers for their platforms. 21st.dev Magic - Create crafted UI components inspired by the best 21st.dev design engineers. 2slides - An MCP server that provides tools to convert content into slides/PPT/presentation or generate slides/PPT/presentation with user intention. ActionKit by Paragon - Connect to 130+ SaaS inte
GitHub - bregman-arie/devops-exercises: Linux, Jenkins, AWS, SRE, Prometheus, Docker, Python, Ansible, Git, Kubernetes, Terraform, OpenStack, SQL, NoSQL, Azure, GCP, DNS, Elastic, Network, Virtualization. DevOps Interview Questions
In general, what do you need in order to communicate? A common language (for the two ends to understand) A way to address who you want to communicate with A Connection (so the content of the communication can reach the recipients) What is TCP/IP? A set of protocols that define how two or more devices can communicate with each other. To learn more about TCP/IP, read here What is Ethernet? Ethernet
DMARCレポートの可視化ダッシュボードを作りました - LIVESENSE ENGINEER BLOG
はじめに そもそもDMARCって何？ Googleの発表によってDMARC対応が必要に SaaSの検討 OSSの検討・選定 構成 動作 GmailからGoogle Driveへ格納する XMLをパースしてOpenSearchに格納する Google Driveからコンテナ内にダウンロードする パースと格納 可視化 苦労した点 Gmailの仕様とparsedmarcの相性が悪い OpenSearch突然データが全部消えた 作ってみてよかったこと 今後の運用 はじめに インフラGの鈴木です。ガールズケイリンアニメことリンカイ！の放映が近くなってきましたね。 最近小倉にギャンブル旅行にいったのですが、北九州競輪には等身大パネルがありました。本気(マジ)度が伝わってきます。アニメの放映日が楽しみです。 ところで、今回はDMARCの可視化基盤を作った話をします。なかなか大変1でしたので、共有したいと
I use Claude Code. A lot. As a hobbyist, I run it in a VM several times a week on side projects, often with --dangerously-skip-permissions to vibe code whatever idea is on my mind. Professionally, part of my team builds the AI-IDE rules and tooling for our engineering team that consumes several billion tokens per month just for codegen. The CLI agent space is getting crowded and between Claude Cod
Security best practices when using ALB authentication | Amazon Web Services
Networking & Content Delivery Security best practices when using ALB authentication At AWS, security is the top priority, and we are committed to providing you with the necessary guidance to fortify the security posture of your environment. In 2018, we introduced built-in authentication support for Application Load Balancers (ALBs), enabling secure user authentication as they access applications.
Cookie Theft 対策と Device Bound Session Credentials | blog.jxck.io
Intro Chrome チームより提案された Device Bound Session Credentials の実装が進み、Flag 付きで試すことができる。 この提案の背景と、解決する問題、現時点での挙動について解説する。 Update 2025/05/15: OT が始まったため、内容を大幅に更新 背景 2FA や Passkey の普及により、認証部分はかなりセキュアになってきた。インシデントによりパスワードが漏洩しても、それだけでなりすましを成立させるのも困難になっている。 そこで攻撃者の注目を集めているのが、Cookie の窃取(Cookie Theft)だ。 認証がいかに堅牢になっても、有効な Session Cookie を盗むことができれば、その値を Cookie フィールドに付与してリクエストするだけで、なりすましを成立させることができる。 いわゆる Session
A Guide to Claude Code 2.0 and getting better at using coding agents
Table of Contents Intro Why I wrote this post The Map is not the territory This post will help you keep up in general Lore time - My Love and Hate relationship with Anthropic Timeline My Codex era Anthropic Redemption Arc + Regaining mandate of heaven Why Opus 4.5 feels goooood This post is not sponsored Pointers for the technically-lite The Evolution of Claude Code Quality of life improvements in
人手のリサーチをデータパイプラインに。dbt Python model × LLM Web Searchで公開情報をSnowflakeに載せるまで - LayerX エンジニアブログ
LayerX BizOps 部データグループのさえない (@saeeeeru) です。最近は娘と『名探偵プリキュア！』にハマっています。「自分で見て、感じて、考えて、"本当"の答えを出す」。AI 時代だからこそ刺さるメッセージです（推理パートをちゃんと解けるようになりたい）。 前回の記事では、dbt Python model から外部 API を呼び出す実装パターンを紹介しました。今回はその応用として、LLM の Web Search 機能を使って公開情報を取得し、それをデータパイプラインに組み込む実践例を書きます。 この記事では、まず LLM の Web Search 機能をどう使うとデータパイプラインに載せやすい形になるのか を説明し、そのうえで Snowflake / dbt にどう載せたのか、そして本番運用の中でどんな品質課題が見えてきたのか、という順に整理します。 Web Sea
PHP is Legacy, in 2024
A trained actor with a dissertation on standup comedy, I came into PHP development via the meetup scene. You can find me speaking and writing on tech, or playing/buying odd records from my vinyl collection. Ready to start building?Experience seamless connectivity, real-time messaging, and crystal-clear voice and video calls-all at your fingertips. Subscribe to Our Developer NewsletterSubscribe to
Photo by Claudio Schwarz on Unsplash. How to create a Python package? In order to create a Python package, you need to write the code that implements the functionality you want to put in your package, and then you need to publish it to PyPI. That is the bare minimum. Nowadays, you can also set up a variety of other things to make your life easier down the road: continuous testing of your package;
目次 OpenID Connectとは 用語 OpenID Connectを試してみる OP側の準備 - AWS Cognito ユーザープールと最初のクライアントを作成する 作成されたパラメータを確認する ディスカバリ ユーザープールにユーザを追加する RP側の準備 - Pythonアプリ 実施 認証の流れ ログインする トークンをリフレッシュする トークンを失効させる ログアウトする IDトークンの形式 サンプルコード リンク OpenID Connectとは SSO(シングルサインオン)を実現するプロトコルのひとつです。 例えば、食べログ に Google アカウントでログインすることができますが、ここでも OpenID Connect が使用されています。 OIDC と略されることもあります。 類似の仕様に OpenID 2.0 がありましたが、OpenID 2.0 の進化系が O
Update 1.69.1: The update addresses these issues. Update 1.69.2: The update addresses these issues. Downloads: Windows: x64 Arm64 | Mac: Universal Intel silicon | Linux: deb rpm tarball Arm snap Welcome to the June 2022 release of Visual Studio Code. There are many updates in this version that we hope you'll like, some of the key highlights include: 3-way merge editor - Resolve merge conflicts wit
Update 1.99.1: The update addresses these security issues. Update 1.99.2: The update addresses these issues. Update 1.99.3: The update addresses these issues. Downloads: Windows: x64 Arm64 | Mac: Universal Intel silicon | Linux: deb rpm tarball Arm snap Welcome to the March 2025 release of Visual Studio Code. There are many updates in this version that we hope you'll like, some of the key highligh
Join a VS Code Dev Days event near you to learn about AI-assisted development in VS Code. Update 1.67.1: The update addresses this security issue. Update 1.67.2: The update addresses these issues. Downloads: Windows: x64 Arm64 | Mac: Universal Intel silicon | Linux: deb rpm tarball Arm snap Welcome to the April 2022 release of Visual Studio Code. There are many updates in this version that we hope
Version 1.108 is now available! Read about the new features and fixes from December. Release date: June 12, 2025 Security update: The following extension has security updates: ms-python.python. Update 1.101.1: The update addresses these issues. Update 1.101.2: The update addresses these issues. Downloads: Windows: x64 Arm64 | Mac: Universal Intel silicon | Linux: deb rpm tarball Arm snap Welcome t
Improving the Developer Experience with the Ruby LSP - Shopify
Improving the Developer Experience with the Ruby LSPThe Ruby LSP is a new language server built at Shopify that makes coding in Ruby even better by providing extra Ruby features for any editor that has a client layer for the LSP. In this article, we’ll cover how we built the Ruby LSP, the features included within it, and how you can install it. Ruby has an explicit goal to make developers happy. H
Since I wrote about async Ruby and patched Solid Queue to support fibers, people keep asking the same questions. What happens when a fiber blocks? Don’t you still need threads? What about database transactions? What about Ractors? This post answers all of it. From the ground up. The four primitives Ruby gives you four concurrency primitives: processes, threads, fibers, and Ractors. They nest. Ever
Agentic GraphRAG for Commercial Contracts | Towards Data Science
In every business, legal contracts are foundational documents that define the relationships, obligations, and responsibilities between parties. Whether it’s a partnership agreement, an NDA, or a supplier contract, these documents often contain critical information that drives decision-making, risk management, and compliance. However, navigating and extracting insights from these contracts can be a
Join a VS Code Dev Days event near you to learn about AI-assisted development in VS Code. Update 1.70.1: The update addresses these issues. Update 1.70.2: The update addresses these issues. Update 1.70.3: This update is only available for Windows 7 users and is the last release supporting Windows 7. Downloads: Windows: x64 Arm64 | Mac: Universal Intel silicon | Linux: deb rpm tarball Arm snap Welc
1. はじめに 2019年1月に「Let’s EncryptによるSSLサーバー証明書の取得、自動更新設定（2019年1月版）」という記事を書きました。 最近、証明書を取得、更新するためのcertbotコマンドの推奨インストール方法が変わりましたので、2021年3月版としてまとめ直します。 なお、以下の設定手順は、サーバーOSはCentOS 7で、2021年3月時点のものです。 Apache, Nginxについては、Let’s Encryptに関わる設定のみ記載し、Let’s Encryptに無関係な基本的な設定は、ここでは記載しません。 コマンドはrootユーザーで実行する想定です。 必要に応じて、sudoに置き換えてください。 （参考） ・Certbotのユーザーガイド https://certbot.eff.org/docs/using.html ・Let’s Encrypt で証明
"MCP is an open protocol that standardizes how applications provide context to LLMs. Think of MCP like a USB-C port for AI applications. Just as USB-C provides a standardized way to connect your devices to various peripherals and accessories, MCP provides a standardized way to connect AI models to different data sources and tools." ― Anthropic TL;DR I would like for this to turn out to be a skill
I first learned Kubernetes ("k8s" for short) in 2018, when my manager sat me down and said "Cloudflare is migrating to Kubernetes, and you're handling our team's migration." This was slightly terrifying to me, because I was a good programmer and a mediocre engineer. I knew how to write code, but I didn't know how to deploy it, or monitor it in production. My computer science degree had taught me a
Version 1.108 is now available! Read about the new features and fixes from December. Release date: May 8, 2025 Update: Enable Next Edit Suggestions (NES) by default in VS Code Stable (more...). Update 1.100.1: The update addresses these security issues. Update 1.100.2: The update addresses these issues. Update 1.100.3: The update addresses these issues. Downloads: Windows: x64 Arm64 | Mac: Univers
Update 1.82.1: The update addresses this security issue. Update 1.82.2: The update addresses these issues. Update 1.82.3: The update addresses this security issue. Downloads: Windows: x64 Arm64 | Mac: Universal Intel silicon | Linux: deb rpm tarball Arm snap Welcome to the August 2023 release of Visual Studio Code. There are many updates in this version that we hope you'll like, some of the key hi
Update 1.78.1: The update addresses this security issue. Update 1.78.2: The update addresses these issues. Downloads: Windows: x64 Arm64 | Mac: Universal Intel silicon | Linux: deb rpm tarball Arm snap Welcome to the April 2023 release of Visual Studio Code. There are many updates in this version that we hope you'll like, some of the key highlights include: Accessibility improvements - Better scre
Update 1.97.1: The update addresses these security issues. Update 1.97.2: The update addresses these issues. Downloads: Windows: x64 Arm64 | Mac: Universal Intel silicon | Linux: deb rpm tarball Arm snap Welcome to the January 2025 release of Visual Studio Code. There are many updates in this version that we hope you'll like, some of the key highlights include: Next Edit Suggestions (preview) - Co
Real-world gen AI use cases from the world's leading organizations | Google Cloud Blog
AI is here, AI is everywhere: Top companies, governments, researchers, and startups are already enhancing their work with Google's AI solutions. Published April 12, 2024; last updated October 9, 2025. Automotive & Logistics Business & Professional Services Financial Services Healthcare & Life Sciences Hospitality & Travel Manufacturing, Industrial & Electronics Media, Marketing & Gaming Public Sec
How a simple Linux kernel memory corruption bug can lead to complete system compromise
In this case, reallocating the object as one of those three types didn't seem to me like a nice way forward (although it should be possible to exploit this somehow with some effort, e.g. by using count.counter to corrupt the buf field of seq_file). Also, some systems might be using the slab_nomerge kernel command line flag, which disables this merging behavior. Another approach that I didn't look
Update 1.86.2: The update addresses these issues. Update 1.86.1: The update addresses these issues. Downloads: Windows: x64 Arm64 | Mac: Universal Intel silicon | Linux: deb rpm tarball Arm snap Welcome to the January 2024 release of Visual Studio Code. There are many updates in this version that we hope you'll like, some of the key highlights include: Per-window zoom levels - Adjust the zoom leve
agent loop ���� �G�� You are Manus, an AI agent created by the Manus team. You excel at the following tasks: 1. Information gathering, fact-checking, and documentation 2. Data processing, analysis, and visualization 3. Writing multi-chapter articles and in-depth research reports 4. Creating websites, applications, and tools 5. Using programming to solve various problems beyond development 6. Vario
Security Update: Suspected Supply Chain Incident | liteLLM
Status: Active investigation Last updated: March 27, 2026 Update (March 30): A new clean version of LiteLLM is now available (v1.83.0). This was released by our new CI/CD v2 pipeline which added isolated environments, stronger security gates, and safer release separation for LiteLLM. Update (March 27): Review Townhall updates, including explanation of the incident, what we've done, and what comes
25th May 2025 Anthropic publish most of the system prompts for their chat models as part of their release notes. They recently shared the new prompts for both Claude Opus 4 and Claude Sonnet 4. I enjoyed digging through the prompts, since they act as a sort of unofficial manual for how best to use these tools. Here are my highlights, including a dive into the leaked tool prompts that Anthropic did
Version 1.108 is now available! Read about the new features and fixes from December. Release date: August 7, 2025 Update 1.103.1: The update adds GPT-5 prompt improvements, support for GPT-5 mini, and addresses these issues. Update 1.103.2: The update addresses these issues. Downloads: Windows: x64 Arm64 | Mac: Universal Intel silicon | Linux: deb rpm tarball Arm snap Welcome to the July 2025 rele
j次のブックマーク
k前のブックマーク
lあとで読む
eコメント一覧を開く
oページを開く
【2020年】CTF Web問題の攻撃手法まとめ - こんとろーるしーこんとろーるぶい
Why, after 6 years, I’m over GraphQL
gpt-5 leaked system prompt
The Prompt Engineering Playbook for Programmers
How I Use Every Claude Code Feature
How to create a Python package in 2022
とほほのOpenID Connect入門 - とほほのWWW入門
June 2022 (version 1.69)
March 2025 (version 1.99)
April 2022 (version 1.67)
May 2025 (version 1.101)
Ruby Concurrency: What Actually Happens
July 2022 (version 1.70)
Let’s EncryptによるSSLサーバー証明書の取得、自動更新設定（2021年3月版）
A Critical Look at MCP - Raz Blog
Solving common problems with Kubernetes
April 2025 (version 1.100)
August 2023 (version 1.82)
April 2023 (version 1.78)
January 2025 (version 1.97)
January 2024 (version 1.86)
Manus tools and prompts
Highlights from the Claude 4 system prompt
July 2025 (version 1.103)