GitHub热门项目 | A Simple and Universal Swarm Intelligence Engine, Predicting Anything. 简洁通用的群体智能引擎，预测万物 | Stars: 64,478 | 324 stars today | 语言: Python

Never underestimate the power that a cheap tablet holds over a kid under six. The Skylight Buddy is a device with one job: to be a cute little guy that helps your kid track routines and chores. It's $139.99, plus an optional subscription. And to my surprise, even though it offers a pretty limited set […]

An autonomous research agent ended up with more merged leaderboard records than any individual human contributor in OpenAI's spring hiring competition, Parameter Golf. 7 of the 47 merged records came from a single agent: more than 2x the next-best human (3 records). The agent ran autonomously for 22 consecutive days. Records are public at github.com/openai/parameter-golf. Disclosure since this is r/ML and it matters: I'm at Weco, we built the agent. Not stealth-launching but sharing the results. The more interesting finding, to us, is the collaboration. Aiden's records were also the most-cited on the leaderboard, 435 citations into its PRs, with human researchers using its work as the base for their own subsequent submissions. At one point Aiden plateaued for 5 days. A human contributor shipped a clever new tokenizer on top of Aiden's last record PR. Aiden then fused the human's tokenizer with components it had built during the plateau, and shipped the biggest jump in val_bpb of the entire competition. Async human-agent collaboration, neither directly aware of the other. Setup: Parameter Golf was OpenAI's 44-day public ML hiring competition this spring. 1,016 researchers entered, 2,048 PRs filed, every submission reviewed and reproduced by OpenAI engineers. Only 47 became leaderboard records. Aiden ran on a single GPU node, used under 4% of the visible compute available, and still produced 15% of the official records. 28% submission acceptance rate, roughly 6x the community rate. Most submissions added signal to the public stream rather than flooding it. Mechanism: built on AIDE: open-source tree-search for ML metric optimization. The loop reads each new upstream PR, decomposes techniques into components, drops anything that breaks the rule stack (16MB / 10-min / legal-eval), and recomposes the legal residue with its own deltas. Often shipped before reviewers had ruled on the upstream PR. Hedges to be explicit about: This is #1 by volume of merged records and PR h-i

https://lsc-pagepro.mydigitalpublication.com/publication/?i=... PDF: https://cdn.coverstand.com/61061/865273/2c88ea662e2b57478723... (article is on page 62) Related: https://www.404media.co/the-u-s-military-quietly-turned-gps-...

Just wanted to share my journey after 3.5 years of building a live web analytics tool from scratch, and without AI: WireBoard.io As a web publisher for the last 15 years, I used UA (before GA4) and then Chartbeat. I always loved real-time. At the beginning of the internet I spent my time on IRC, which was great and a huge change from newsgroups and forums. A few years later, Chartbeat was changing its customer base and focusing on big news publishers, and my workflow was about to change with it. I loved being able to watch my traffic live and spot anything unusual, day by day, compared to the same day the previous week. So I decided to replace it with my own product, but with the things their tool was missing. I spent about 8 months thinking it through and sketching different architectures to handle the load and the logic of the data processing pipeline. Then I learned to code in Go (which was surprisingly easy) and built an MVP. After some iterations, I worked on the frontend (Laravel + React) and kept improving the product based on user feedback. The features I couldn't find anywhere else: Truly real-time data via streaming instead of polling. Merging data from different websites into one chart, so I can see at a glance whether traffic is unusual "today" compared to last week. A flexible dashboard, arranged like widgets on a phone. I mostly worked on this quietly and didn't talk about it much on social media or anywhere else, since I'm a dev and not a marketer. This is my biggest project, and I've enjoyed the long journey. All of this happened before the AI era, which turned out to be good timing: I can work on the codebase knowing exactly what does what and where. Over the last 6 months I've experimented with using Claude on some parts of the project (only the frontend), but in limited areas: Performance improvements (useMemo, etc.) Security reviews (not strictly needed, but reassuring when it confirms what I expected) CMS (blog section) The tech stack: Data proc

TL;DR: Non-human identities (service accounts, API keys, workload identities, certificates, OAuth apps, machine-to-machine access) now outnumber humans over 1:1 in most cloud-native orgs. The biggest security risks are unmanaged lifecycle, overprivileged access, and exposed credentials across SDLC and cloud environments, not just secret storage. The best NHI security tools in 2026 fall into four major categories: Secrets Detection and Exposure Prevention NHI Lifecycle and Governance Platforms Machine Identity and Certificate Management Vault and Authorization Extensions Most enterprises require layered coverage across detection, governance, and lifecycle automation. Adopting this multi-layered strategy enables organizations not only to find leaks but also to close the structural gaps that allow them to occur. Why Non-Human Identities Are the Fastest-Growing Attack Surface in 2026 In 2026, attackers rarely try to " hack passwords ". Instead, they exploit the massive, often unmonitored web of non-human identities (NHIs) that power modern automation. They specifically look for hardcoded API keys, overprivileged service accounts, stale OAuth tokens, misconfigured workload identities, unrotated certificates, and shadow SaaS integrations that slip through the cracks of traditional security programs. This is a problem because machine identities far outnumber human users. However, most security programs rely on frameworks designed for human-centric access. IAM Strategy for CISOs: Securing Non-Human Identities Thankfully, top non-human identity protection tools help secure this critical attack surface. By understanding the categories of enterprise NHI security solutions, you can build a strategy that provides complete visibility and robust security controls across your entire infrastructure. What Do Non-Human Identities (NHIs) Include Today? Non-human identities are the digital identities used by machines, services, and applications to authenticate and communicate with other

AI medicine-awareness bot worked — but only in English, the one language most of the people I built it for can't read. Here's the problem, the one-day sprint to fix it, and how GitHub Copilot got me through it. GitHub Finish-Up-A-Thon submission. I shipped this project months ago, but it was never truly finished — it was missing the one feature that decided whether a real person in my own community could use it. This challenge was the push that made me sit down and close that gap in a single night. The problem we face In India, you can walk into most pharmacies and buy prescription drugs without a prescription. We've quietly normalized something genuinely dangerous, and the research is blunt about it. A simulated-patient study in Bengaluru sent two researchers into 261 pharmacies with fake symptoms. Antibiotics were handed over without any prescription at roughly two-thirds (66.7%) of them. Not a single pharmacy warned about side effects. Only about one in five even mentioned that a doctor's prescription was needed. The "guidance" most people walked out with was "take it twice a day" — and nothing else. ( study ) Here is the part that kept me up at night: it's not because people are careless. The shopkeeper isn't a doctor. The label is printed in tiny English. A proper consultation costs time and money many families simply don't have. So people take what they're handed — and hope it's fine. Why it's important This isn't a small inconvenience. Taking the wrong medicine, or the right medicine the wrong way, is one of the biggest drivers of antibiotic resistance — the slow disaster where medicines stop working. The landmark 2019 Lancet GRAM study estimated 1.27 million deaths worldwide were directly attributable to drug-resistant infections in a single year. In India alone, an estimated 297,000 deaths were directly attributable to AMR, and about 1.04 million were associated with it. ( Lancet GRAM 2019 , India figures ) I'm not a doctor and I can't change how medicines

If you've ever built an Electron app that needs a backend, you know the problem. You want something lightweight, something that runs on Node, something where you don't spend three hours configuring Swagger, and something that doesn't make you feel like you're setting up a microservices architecture just to expose two endpoints to your own desktop UI. I've shipped Electron apps with Express. I've tried Fastify. Both work, but they leave you doing a lot of plumbing yourself. Then I found DaloyJS , and honestly, it clicked. The Electron Backend Problem Here's the thing about Electron: your renderer process is basically a browser, and your main process is a Node.js server. When you need data from external APIs, or you need a clean layer between your UI and your business logic, you want a BFF, a Backend for Frontend. A thin server that composes upstream calls, holds the session, and returns exactly the shape your UI needs. DaloyJS was built for this role. The docs even say so plainly: typed upstream client, fetchGuard for safe egress, session handling, and edge runtime support. That combination is exactly the BFF toolkit. Contract-First Means Less Glue The killer feature for desktop apps is contract-first routing. You define a route once, and DaloyJS gives you validation, OpenAPI 3.1 docs, and a typed in-process client all from the same source. No stale spec files. No writing types by hand. Here's what a basic Electron BFF route looks like: import { z } from " zod " ; import { App , requestId , secureHeaders , rateLimit } from " @daloyjs/core " ; import { serve } from " @daloyjs/core/node " ; const app = new App ({ bodyLimitBytes : 1 << 20 , requestTimeoutMs : 5 _000 , docs : true , // auto-mounts /docs and /openapi.json }); app . use ( requestId ()); app . use ( secureHeaders ()); app . use ( rateLimit ({ windowMs : 60 _000 , max : 120 })); app . route ({ method : " GET " , path : " /settings/:userId " , operationId : " getUserSettings " , request : { params : z . objec

Sylwia Laskowska's webMCP article is clever, funny, and genuinely enjoyable—and she's explicit that it's experimental, not a production recommendation. This isn't a rebuttal. It's a reframing: the same demo, viewed through the lens of risk surfaces and governance. My concern isn't with her intent — it's with how easily newcomers building client systems may misread a playful demo as a pattern to copy. I. The Demo Was Funny Because the Risk Is Real In Sylwia's article, she writes: webMCP allows websites to expose structured information about available actions… Those "actions" aren't descriptive hints. They are callable functions wired directly into application logic. In her demo, those actions include: hire_employee fire_employee rewriteInRust pivotToAgents It's hilarious in a toy app. It's catastrophic in a real one. The humor works precisely because the underlying risk is real. II. The Hidden Assumption: Exposing Actions Is Neutral webMCP is framed as "like accessibility metadata." But accessibility metadata is descriptive. webMCP metadata is executable. That's the conceptual inversion most newcomers will miss. III. Structural Vulnerability #1: Unbounded Action Surface If a tool exists, an agent can call it. There is no: permission model capability scoping rate limiting intent validation safety envelope Sylwia jokes: "someone will definitely give an agent access to fireEmployee(), the agent will lay off the entire company…" This is not a hypothetical. It is the exact failure mode. IV. Structural Vulnerability #2: Agent Overreach Her CEO sim demonstrates the problem perfectly: the agent selected the appropriate tools and immediately got to work. Agents act with high confidence even when their world model is incomplete. webMCP gives them direct levers into application state. This is the same overreach problem MCP has—just moved into the browser. V. Structural Vulnerability #3: Protocol Brittleness webMCP relies on human-authored descriptions: html<form mcp-name="creat

There are more IoT protocols out there than most teams will ever need. That sounds overwhelming until you realize most connected products only use two or three; one for local communication, one for cloud connectivity, and sometimes one for device management. The problem is not the number of options. The problem is that the protocol you pick at the design stage gets baked into your firmware, your cloud pipeline, and your data model. Change it later and you are rewriting half of your stack. Here is a practical breakdown of the protocols that matter for most developers building connected products today. The Three Layers You Are Choosing Across IoT protocols sit in three distinct layers, and you typically pick one from each: Application Layer → MQTT, CoAP, HTTP, AMQP (how data reaches your cloud) Network Layer → LoRaWAN, NB-IoT, LTE-M, Wi-Fi, BLE (how data travels physically) Industrial Layer → Modbus, OPC UA, Profinet (machine-to-machine on the factory floor) A soil moisture sensor on a farm might use LoRaWAN at the network layer to push data 10 kilometers to a gateway and MQTT at the application layer to deliver that data to a cloud dashboard. Two protocols, two layers, one product. The Big Three for Cloud Connectivity MQTT - The Default for a Reason Publish-subscribe model. Lightweight. Three QoS levels for delivery guarantees. Run over TCP with TLS encryption. Roughly 70% of cloud-connected IoT deployments use MQTT today. A basic publish looks like this: import paho.mqtt.client as mqtt client = mqtt.Client(mqtt.CallbackAPIVersion.VERSION2) client.tls_set() client.connect("broker.example.com", 8883) client.publish("sensors/temperature", '{"value": 23.5, "unit": "C"}') Use when: You need real-time telemetry, bidirectional device control, or guaranteed message delivery across unreliable networks. HTTP - Not for Telemetry, But Still Essential Too heavy for continuous sensor data. But it is the standard for OTA firmware updates, cloud API integrations, and management das

The dangerous part of web extraction is not the error. The dangerous part is a clean JSON response that looks correct and is not. If an AI agent uses that output, the mistake does not stay inside a scraper. It moves into a report, a lead list, a price alert, a CRM update, or an automated decision. So before you trust any web extraction API in an agent workflow, test whether it fails honestly. Here is the checklist I use. 1. Test a real page, not a demo page Demo pages are usually polite little museum exhibits. Use pages that behave like the actual internet: a JavaScript-heavy product page a search results page a page with missing fields a login-gated page a blocked or rate-limited page a thin page that has layout but little useful content If the tool only looks good on clean static pages, you have not learned much. 2. Check whether the API separates fetch success from extraction success A page can return HTTP 200 and still be useless. Common examples: the final page is a login screen the visible content is a bot challenge the useful data loads after hydration and never appeared in the fetch the page contains a generic country selector instead of the product the source has navigation text but no actual item data The extractor should not treat these as success just because the request completed. A better response says something like: { "status" : "failed" , "failure_type" : "login_required" , "extracted" : null , "next_step" : "Use a public URL, authorised access, or sample content." } That is boring. Boring is good here. Boring means the agent can stop safely. 3. Ask for fields that are not on the page This is the easiest lie detector. Ask the extractor for something impossible: Extract the product name, price, stock status, warranty length, CEO name, office address, and refund policy. If the page only contains product name and price, the API should say the other fields are missing or low confidence. It should not politely invent them because the schema asked nicely.

I Built a Python Package to Fix SSE Resumability in the MCP SDK Your MCP server crashed. Your client reconnected. Every event from that session? Gone. The Gap The Model Context Protocol Python SDK ships with a built-in EventStore that powers SSE stream resumability — when a client reconnects with a Last-Event-ID header, the server replays the events it missed. This works great in development. The catch: that store lives entirely in memory. Restart the process, roll a new deployment, or — in a multi-worker setup — have the reconnecting client land on a different pod, and the session is gone. The store was local to the process that died. Resumability silently returns nothing. This isn't a bug in the SDK. It's a scope decision — the in-memory store is a correct, useful default for single-process development. But the moment you deploy to production, you need something durable. That's the gap mcp-persist fills. What It Does mcp-persist adds three drop-in EventStore backends — SQLite , Redis , and PostgreSQL — that survive process restarts and work across multi-worker deployments. Pick the one that fits your infrastructure; the API is identical across all three. pip install "mcp-persist[sqlite]" # no external service needed pip install "mcp-persist[redis]" # for multi-worker deployments pip install "mcp-persist[postgres]" # for teams already running Postgres The Two-Line Setup Wiring resumability by hand is tedious — you need a store, a StreamableHTTPSessionManager , a Starlette lifespan to open and close both, and a Mount . The with_persistence() helper collapses all of that. Pass your FastMCP instance, get back a runnable ASGI app: import uvicorn from mcp.server.fastmcp import FastMCP from mcp_persist import with_persistence mcp = FastMCP ( name = " MyServer " ) app = with_persistence ( mcp , backend = " sqlite " , url = " events.db " , ttl = 3600 ) uvicorn . run ( app , host = " 127.0.0.1 " , port = 8000 ) # MCP endpoint at /mcp Switching to Redis is a one-word change:

TL;DR I built AutoMaintainer , a multi-agent AI system that transforms GitHub issues into production-ready pull requests during the Qwen Cloud AI Hackathon. It coordinates specialized agents (Issue Analyst, Developer, QA, Security, Documentation, Reviewer) to solve problems like a real engineering team—all while keeping humans in control. Here's what I learned. The Problem Open-source maintainers face a brutal reality: 📚 Overwhelming issue backlogs 🔄 Repetitive bug fixes and documentation gaps ⏱️ Code review bottlenecks 😴 Burnout from handling everything solo Existing AI tools help write code, but they don't orchestrate the entire workflow: planning, development, testing, security review, documentation, and human approval. What if we could build an AI engineering team that collaborates like real developers? The Solution: AutoMaintainer AutoMaintainer is a multi-agent orchestration system that mirrors a real software company: Issue Analyst – Reads GitHub issues, extracts requirements, assesses severity Architect – Analyzes repo structure, designs the implementation approach Developer – Writes code, updates files, creates new modules QA Tester – Generates tests, validates fixes, checks edge cases Security Agent – Scans for vulnerabilities, prevents dangerous patterns Documentation – Updates changelogs, PR summaries, release notes Reviewer – Scores code quality, recommends improvements Human Approval Gateway – Final human review before merge The result? A pull request that's analyzed, built, tested, secured, documented, and reviewed—all before a human ever sees it. Tech Stack Frontend Next.js – React framework for the dashboard UI Tailwind CSS – Rapid, utility-first styling TypeScript – Type safety for the frontend layer Backend FastAPI (Python) – Lightweight, async-first API Qwen-compatible LLM API – AI model integration for all agents SQLite + Async (aiosqlite) – Persistent pipeline and memory storage Redis-ready architecture – Prepared for distributed queuing Integr

Introduction Website hosting has been greatly improved through the use of cloud computing. This has made it easier for individuals as well as businesses to access, scale, and use hosting services at a reasonable price. One of the easiest and most efficient methods that developers may use to host a static site on Microsoft Azure is the Static Website Hosting option offered by Azure Blob Storage, which allows developers to upload their static files without the need for a traditional web or virtual server (i.e., HTML, CSS, JavaScript, and media files). In this project, I will download a free static website template from Tooplate, customize the downloaded version using Visual Studio Code (VS Code), and then deploy the new version to Azure Blob Storage for public viewing. This will involve editing all content, images, styles, and branding so that the template reflects how I want it to look when it is completed. To develop my own static website using Azure Blob Storage, I will first navigate to Tooplate and browse the templates available for modification (or further development). After deciding which template is most suitable, I will download the ZIP package of the template and extract it onto my local computer's disk drive. Then, I will open the ZIP file's contents using VS Code to customize all aspects of the website prior to publishing. After customizing the template, we will create an Azure storage account, enable Static Website Hosting, upload the customized/static website files to the Azure Blob Storage $web container, and then publish the created static website into the cloud. Project Objectives .Download a free static website template from Tooplate. .Go to VS code and edit the downloaded template from there .Create a Resources Group .Create an Azure Storage Account. .Enable Azure Static Website Hosting. .Upload website files to Azure Blob Storage. .Deploy and access the website through Azure's public endpoint. .Document the deployment process. Prerequisites Before

Hi everyone, Kacper and Filip from Software Mansion here. This week, TanStack Start is once again in the spotlight. The React Compiler in Rust is on its way. React Router and Remix shipped important security patches – update immediately. There's also a fresh batch of releases from TanStack Form, XState Store, shadcn, React Aria, and more. On the React Native side, this week was dominated by App.js Conf 2026 in Kraków. Gesture Handler 3.0, Swift Package Manager support for React Native, and Legend List 3.0 were among the highlights, alongside Expo announcements like EAS Observe. Let's go! 💡 Subscribe to the official newsletter to receive an email every week! 💸 Sponsor Atomic CRM: The Open-Source CRM Toolkit for Developers Stop struggling with locked-in CRMs and expensive seats. Atomic CRM gives you the power of a professional CRM with the total freedom of open-source. It’s the only toolkit that combines a high-end user experience with data sovereignty. No more lock-in, no more "renting" your contacts. Everything you need is already there: Native Mobile App for on-the-go access. Intuitive Kanban Boards for pipeline management. Built-in Email Tracking to stay on top of leads. Free SSO for seamless team integration. MCP Server Integration for productivity gains. Why settle for a black box SaaS when you can own the entire platform? Deploy Atomic CRM on your own infrastructure in minutes and regain control over your most valuable asset: your data. ⚛️ React TanStack Start Gaining Momentum: 📜 TanStack Start Adds First-Class Rsbuild Support - TanStack Start now supports Rsbuild / Rspack alongside Vite via a new plugin adapter, covering SSR, streaming, HMR, Server Functions, and RSC. 📜 Lovable - Building apps using TanStack Start - The AI App builder is now using TanStack Start with SSR by default for all new projects. 📜 The Conductor Rewrite: What They Changed to Make It Fast - Migrating their Tauri desktop app from React Router to TanStack Router significantly reduced re-re

I build RESTful APIs for a living. I've designed event-driven architectures, set up CI/CD pipelines, containerized applications on Azure, mentored junior developers. 7 years of this. Then I opened LeetCode and stared at a medium problem for 45 minutes and closed the tab. Working as a backend engineer for this long means you just never touch advanced DSA. My day to day is .NET, Azure, SQL, clean architecture. EF Core handles the data layer, Azure handles the scaling. I haven't needed to implement a graph traversal or think about tree balancing since university. So when I decided to start interviewing at bigger companies I figured I just needed a quick refresher. I studied this stuff in college. It would come back. It didn't. 7 years is a long time and most of it was gone. What I Tried I went through the usual options. LeetCode grinding. Jumping into random problems with no structure just kept reminding me how much I'd forgotten without actually helping me relearn any of it. YouTube. Watched hours of Abdul Bari, freeCodeCamp, various bootcamp videos. I'd finish a video convinced I understood it, then open my editor and draw a complete blank. Watching someone solve a problem and solving it yourself are not the same thing at all. Books. CLRS is great if your fundamentals are still intact. Mine weren't. None of these were bad resources. The problem was I kept jumping between them with no thread connecting them. A video here, a problem there, a random chapter somewhere else. After years away from this stuff I needed to go back to basics and build up properly, and nothing was set up for that. What Actually Helped Eventually I just mapped out what a proper learning order looked like and started going through it myself. Big O → Arrays → HashMaps → Linked Lists → Stacks & Queues → Recursion → Trees → Graphs → Dynamic Programming For me, order mattered. Going back to Big O first made Arrays click properly. Arrays made HashMaps make sense again. I couldn't get Trees to stick un