👋 About: Security Research、WAF Attack and Defense、Code Review、AI Hacker、ENTJ-A 🔭 CTFer: @R3kapig(Member) ⭐️ Github: github.com/Y4tacker

Joined November 2021
18 Photos and videos
唉人才,我绕过了补丁,然后提交后告诉我"尽管利用技术存在差异,但本质上属于同一漏洞。根据我们的政策,我们仅认可同一问题的首位报告者,因此此处不再单独致谢"
5
49
6,526
学习!
blog.huli.tw/2026/05/25/dive… 由於最近供應鏈攻擊實在太多了,只好把拖稿很久的主題優先寫完,再回頭研究了一下不曾理解過的安裝套件流程以及各家對於供應鏈攻擊的防禦(懶得研究 yarn,抱歉了) 只要把一些參數設定好至少能擋掉大部分的,或是裝最新版 pnpm,預設就幫你擋掉,想更安全再裝個 sfw
18
5,843
卧槽 情感陪伴 自我安慰!
Cat translator app is doing $300K on the App Store Dog translator is doing $60K AI collar that translates barks into sentences just got 10K pre-orders at $118 People really want to talk to their pets
782
纯jb扯淡,就是借助middleware的灵活性把一些流程给打通了,只是能用
while exploring harnesses, i came across my first and favourite agent orchestration framework @LangChain has launched deep-agents last year. it’s a wonderful harness, that has a lot of tools: - write_todos - ls, edit_file, read_file, write_file - task (specialized subagents) a proper long term memory. you are the one who declares the permissions. human in the loop (very important). you should use it when the task is too big to fit in one prompt - something that requires extreme agency, planning, parallelism, or memory across steps. something like “research this codebase and write a PR” - that’s deep agents territory. in short, deep agents = LLM a plan a desk a team guardrails. exactly the definition of harness i explained in the article below. do check it out. great work @hwchase17 🔥
1
1,057
这个吃相还是比较难看的cursor💦
1
934
挺骚的反着来用hh
Apr 23
HaEValidator 验证器更新:新增OpenAIPrivacyFilter验证器,基于 OpenAI Privacy Filter 模型的隐私数据检测,按标签类型映射置信度。OpenAI Privacy Filter 模型总参数量1.5B,活跃参数量50M(运行快、环境要求低、配置简单),十分适合HaE各版本所使用的验证器场景,强烈推荐使用。功能建议来自:@洺熙 @冰淇霖。 github.com/gh0stkey/HaEValid… OpenAI Privacy Filter 模型快速安装与验证器配置方法: 1. 电脑所需运行环境:uv、python >= 3.10.0 2. 克隆仓库:git clone github.com/openai/privacy-fi… 3. 基于CPU运行(初次使用需要下载模型):uv sync && uv pip install "httpx[socks]" && uv run opf --device cpu 'password: 123' 4. 验证器Command字段填入:/路径/privacy-filter/.venv/bin/python3 /路径/HaEValidator/validator/OPF.py
4
1,483
今天a➗用实践告诉大家又活了,通过toolsearch按需加载解决,我有个想法实际上mcp现在的问题都可以解决,tools和skills完全可以做到在mcp中的共存,其实也就是一直没用到的resources的api可以用来暴露skills去解决一些内容分发,当然可能不是那么完美 claude.com/blog/building-age…
4
828
突然想起来我还有个google号很久没用了草
We are launching two powerful updates to Deep Research in the Gemini API, now with better quality, MCP support, and native chart/infographics generation. Use Deep Research when you want speed and efficiency, and use Max when you want the highest quality context gathering & synthesis using extended test-time compute — achieving 93.3% on DeepSearchQA and 54.6% on HLE.
638
😓缺算力了吧
Anthropic just pulled Claude Code from the Pro plan. Pro users wanting it need Max now. $100/month minimum. 5x jump. I'm on Max 20x so I'm fine. Flagging for anyone on Pro who's about to find out. No announcement. Just a pricing page edit.
1
667
已经活成同时拥有gpt claude max的形状了
Apr 9
We’re updating our ChatGPT Pro and Plus subscriptions to better support the growing use of Codex. We’re introducing a new $100/month Pro tier. This new tier offers 5x more Codex usage than Plus and is best for longer, high-effort Codex sessions. In ChatGPT, this new Pro tier still offers access to all Pro features, including the exclusive Pro model and unlimited access to Instant and Thinking models. To celebrate the launch, we’re increasing Codex usage for a limited time through May 31st so that Pro $100 subscribers get up to 10x usage of ChatGPT Plus on Codex to build your most ambitious ideas.
5
867
😂
EXCLUSIVE: OpenAI, Anthropic and Google are working together to clamp down on Chinese competitors copying their AI models bloomberg.com/news/articles/…
1
587
Y4tacker retweeted
Maybe I'm missing something, but "harness engineering" might be doing more harm than good. I've read a couple of posts on harness engineering, filesystem memory, subagent architecture. All real, all important. I've learned a lot from them. But I keep coming back to this: the framing of Agent = Model Harness undersells the actual engineering involved. And as far as I can tell, none of the major agent products work this way. Claude, ChatGPT, Devin. These are all systems. They handle authentication, multi-tenancy, deployment, observability, cost controls, state management across sessions and users, RBAC, resource isolation. The "harness" is a subset of the engineering involved in building these products. A better framing might be Agent = Model System. This makes sense because you can't serve a raw API call to users. You need the system around it to turn the model into a product. You could argue Agent = Model Harness System, and that's fair. But at that point the harness is just a component of the system. Treat it as one. My concern is that when we center the conversation on harness engineering, we train developers to think about the 30% that touches the model and ignore the 70% that makes the thing actually work in the real world. When we look at the problem through the lens of the 30%, we end up with things like virtualized file systems which are solving problems that shouldn't exist in the first place. At best, the harness wraps the model. The system is the product. And there's a reason the consensus is that model progress will eventually swallow the harness. Because the harness is a thin layer. The system is not. The system is the product, and that's what developers should be focusing on. Another reason to take harness engineering with a grain of salt: it's shaped by coding agents. Coding agents are a very specific form factor which itself is evolving rapidly. Single user. Running in a terminal. Local filesystem. The patterns that emerge from this form factor are useful for this form factor. And I worry that generalizing them to broader agentic systems is damaging to the ecosystem as a whole. Here's what I mean. And notice a pattern: many of these are solutions to problems that shouldn't exist in the first place if you start with the right system design. 1. Filesystems for memory and storage Harness engineering recommends patterns like AGENTS.md files for memory. This works when one developer is running one agent on their laptop. It falls apart the moment you need a real product. There's a reason databases exist. Files don't support concurrent access. They don't support querying. They don't support access control. A filesystem as your memory layer is a single-user solution presented as architecture. And now I'm seeing people build "virtualized file systems" that wrap databases into filesystem-like structures to patch over these limitations. At that point, just expose the database. You get SQL as a first-class interface, proper access control, and durable storage without the abstraction gymnastics. And you know what, LLMs are even better at SQL than they are at cat and bash. 2. No multi-tenancy or RBAC How do 50 engineers on a team share an agent securely? How do you control which users can trigger which actions? That's multi-tenancy, authorization, and access control. No filesystem pattern solves this. You need real RBAC. 3. No resource isolation How do you stop one tenant's runaway agent from burning through your entire token budget? That's resource isolation. It lives at the system level. A harness has no concept of it. I hear people recommending sandboxes scoped to individual users and it makes 0 sense to me because your costs will eat you alive. Btw these problems aren't new. They're the same problems we've been solving in software engineering for decades. The instinct to create new terminology comes from a good place. "Harness engineering", "Scaffolding”, "Context engineering". People want to name the new discipline. But every time we mint a new term for a subset of systems engineering, I think we make it harder for developers to recognize that the patterns they need already exist and we shouldn't re-invent the wheel. All problems that harness engineering solves, you can solve with systems engineering. Maybe I'm wrong about this, but I'm just seeing harness engineering create more issues than it solves (virtualized file systems???) If we want developers to successfully build agentic products, we should encourage them to think in systems. The solutions already exist. We should use them. Again, maybe I'm missing something. I'll keep an open mind as I learn more. And maybe the answer is simply that harness engineering applies to coding agents and not to broader agentic products, which makes perfect sense. TLDR: Agent = Model Harness undersells the real problem. Harness engineering is shaped by coding agents (single user, terminal, local filesystem) and ignores the 70% that makes agents work in production: multi-tenancy, RBAC, approval flows, audit logs, resource isolation, durable storage. These are systems engineering problems.
49
44
408
55,133
又发重复文,上次拿这个理念讲越狱。。。
New Anthropic research: Emotion concepts and their function in a large language model. All LLMs sometimes act like they have emotions. But why? We found internal representations of emotion concepts that can drive Claude’s behavior, sometimes in surprising ways.
1
1
846
666
Yuanzhen Xu will present at TyphoonCon 2026! Join us as we expose hidden attack paths in ClickHouse - from JDBC components to memshell and RASP evasion: typhooncon.com/2026-agenda/
1
1
11
1,994
何意味。。。
Mar 21
Huawei Unveils 950PR AI Chip...delivering performance 2.87x that of the H20 At the Ascend AI Partner Summit held during the "Huawei China Partner Conference 2026" on March 20, Ma Haixu, Huawei Vice President and President of ICT Portfolio Management & Solutions, officially announced the launch of the Atlas 350 accelerator card. The release follows the roadmap previewed at Huawei Connect 2025 last September. According to the Shanghai Securities News, the Atlas 350 delivers single-card compute performance of 2.87x that of NVIDIA's H20, making it currently the only product in China to support FP4 low-precision inference. HBM capacity stands at 112GB — 1.16x that of the H20 — while multimodal generation throughput improves by 60%. Memory access granularity has been reduced from 512 bytes to 128 bytes, delivering a 4x improvement in memory access efficiency for small operators. The card offers 1.56 PFLOPS at FP4 precision, 1.4 TB/s of memory bandwidth, and a TDP of 600W — 1.5x that of the H20.
1
737

You can use Google's NotebookLM to bypass Medium, NYT and most of the journals" paywalls .. You're welcome
3
999
"它无法执行任何工具调用,并且输出只有一轮,但包含了您对话的全部上下文",开始挤牙膏了😆
Mar 10
We just added /btw to Claude Code! Use it to have side chain conversations while Claude is working.
810
让我看看Qclaw怎么个事?电脑管家出品。。。
4
5
1,755
体验了几天鉴定为垃圾 pass
297