标签：#Python

security #api #webdev #discuss The chat went live at 2 PM. By 2:14 it was a war zone. I thought adding real-time chat to my dev blog would spark pair-programming threads. Instead, bots flooded it with phishing links and slurs. One bot even dropped an oddly specific threat about my home city. I flipped on request logging. In the next 24 hours it logged 52 distinct attacker hostnames. IP bans did nothing. They came back from new IPs, new ASNs, new registrars. IP bans felt like swatting flies. I wanted to know what these domains actually were. That's when I started bulk-WHOISing every domain they posted. What 52 hostile domains actually look like I wrote a small Python runner. Feed it a list of hostnames and it spits out JSON. The first version used public RDAP servers directly. Public RDAP servers were slow, rate-limited, and ccTLDs broke them. I wanted DNS, SSL, subdomains, email history, and takeover risk in the same response. I landed on the enrichment endpoint at RapidAPI and put the script on GitHub . import json , time , sys , os from urllib.parse import quote import requests RAPIDAPI_KEY = os . environ . get ( " RAPIDAPI_KEY " , "" ) BASE_URL = " https://domain-whois2.p.rapidapi.com/whois " HEADERS = { " X-RapidAPI-Key " : RAPIDAPI_KEY , " X-RapidAPI-Host " : " domain-whois2.p.rapidapi.com " } def lookup ( domain : str ): url = f " { BASE_URL } ?domain= { quote ( domain ) } " try : r = requests . get ( url , headers = HEADERS , timeout = 20 ) r . raise_for_status () return r . json () except requests . exceptions . Timeout : return { " domain " : domain , " error " : " timeout " } except requests . exceptions . HTTPError as e : return { " domain " : domain , " error " : f " http { e . response . status_code } " } except Exception as e : return { " domain " : domain , " error " : str ( e )} def batch ( domains , delay = 0.6 ): results = [] for d in domains : print ( f " [*] { d } " , file = sys . stderr ) results . append ( lookup ( d )) time . sleep ( delay ) r

GitHub热门项目 | Open Source HR and Payroll Software | Stars: 8,505 | 130 stars today | 语言: Python

GitHub热门项目 | AutoGPT is the vision of accessible AI for everyone, to use and to build on. Our mission is to provide the tools, so that you can focus on what matters. | Stars: 185,866 | 28 stars today | 语言: Python

GitHub热门项目 | The authentication glue you need. | Stars: 22,836 | 123 stars today | 语言: Python

Multi-agent examples often jump straight to models, tools, and production claims. That makes it difficult to see what the protocol is doing. Before adding an LLM, it is useful to watch a small system discover specialists, delegate a task, and return a result that you can inspect. This tutorial uses A2A Orchestration Lab , an open-source Python project by Fernando Paladini. It starts three local agents: an orchestrator, a researcher, and a writer. The researcher and writer are deterministic stubs, so the example isolates the Agent2Agent (A2A) communication flow from model behavior. The result is a runnable research-to-write pipeline that helps explain where A2A fits next to the Model Context Protocol (MCP). TL;DR Install the lab with uv , run its demo command, and inspect the three local Agent Cards and the delegated result. The project is a learning lab, not a production runtime. That is a feature for this tutorial because every moving part remains visible. Prerequisites You need: Python 3.12 or newer. uv for environment and dependency management. A terminal with network access for the initial dependency download. The repository declares version 0.1.0 , requires Python >=3.12 , and depends on the A2A Python SDK, httpx , and uvicorn . It is licensed under MIT. Create and run the lab Clone the public repository and let uv create the environment from the locked dependencies: git clone https://github.com/paladini/a2a-orchestration-lab.git cd a2a-orchestration-lab uv sync Run the bundled end-to-end demo: uv run a2a-lab demo "Explain A2A and how it relates to MCP" The CLI starts the three agents as subprocesses, waits for their Agent Cards, sends a message to the orchestrator, prints the response, and terminates the child processes. The default prompt is the same explanation used by the repository README, but using your own prompt makes the delegation easier to recognize. On a successful run, the output contains sections similar to these: [demo] asking orchestrator: 'Expl

Lucian Ghinda published a post arguing you should tell your coding agent to write its throwaway scripts in Ruby. Here is the block he tells you to paste into your agent's instruction file, in full: ## Scripts Write throwaway and utility scripts (data munging, one-off migrations, file renames, glue code) in Ruby, even in projects written in another language. If it needs a pipe, a loop, a conditional, or more than one line, it is a script: write it in Ruby, not Python, Node, or bash. Single self-contained commands ( `grep` , `git status` ) are fine as-is. Use only the Ruby standard library. If a gem would clearly save significant effort, stop and ask before using it. Put temporary scripts in a scratch or temp directory, not the repo root, and delete them when done unless asked to keep them. I pasted it into my global CLAUDE.md the same evening. His argument is about review: he reads Ruby daily, so when the agent writes Ruby he stays a reviewer instead of nodding at a diff. He gives three reasons and not one of them is cost. So I went looking for the number he left out. "Does the rule save tokens" only means something against what the agent writes otherwise, so the first thing I had to do was take the block back out of my global config. An agent that already carries the rule cannot tell you what it would do without it. Measuring an agent without your config in the room Every arm below runs through claude --safe-mode on Claude Opus 5, which loads no CLAUDE.md , no skills, no plugins and no hooks. Two arms deliberately skip that flag, and I name them where they appear: they are the ones that measure what my own setup does to the result. It is worth knowing that my global config alone still carries a line telling the agent to write the minimum code that does the job, and another preferring bun over node. Four tasks, one for each kind of script the rule names: munge a log, rename a key across a tree of config files, renumber a pile of screenshots, turn one CSV into another

The one-second decision no one is helping your agent make Here's a scenario that is no longer hypothetical. Your autonomous agent is working through a task. It hits a paid API — an HTTP 402 Payment Required with a price in USDC. It signs a stablecoin authorization, pays, and continues. No credit card form, no invoice, no human. Roughly one second, start to finish. This is x402, the protocol that finally gave the dormant HTTP 402 status code a job. And it works: by mid-2026, on-chain trackers counted over 165 million cumulative x402 transactions across ~69,000 active agents. Coinbase, Cloudflare, Stripe, Visa, Google, AWS, and Circle are all in. The rail is real and it is fast. But look again at that one-second decision. Your agent just paid a counterparty it may know nothing about. And here is the uncomfortable detail buried in the spec: x402 has no notion of identity, reputation, or trust — by design. As one recent analysis put it, a payment rail that asks nothing about the payer is the easiest possible rail to implement. That was the right call for adoption. It also means the entire question of "should I trust this counterparty?" is left to you, the developer. At human speed, we close that gap by reflex — we notice when a file doesn't download, when an API 500s after charging us, when the thing we bought isn't what was advertised. We dispute, we leave a review, we don't come back. Your agent has none of those reflexes. It pays, gets a response, and moves on. And if the same bad endpoint burns a hundred agents in a row, each one pays anyway, because there's no shared memory of the failure. At machine speed and machine scale, that silent gap isn't an annoyance. It's a tax on every agent that transacts without a defense. The gap has numbers, and they're bad Two data points make this concrete. First, the volume everyone cites hides a caveat. Of those 165M+ transactions, independent reads suggest roughly half looks like testing rather than genuine commerce. The rail is

The problem I was running a multi-agent pipeline and one of my agents silently failed. The only alert I got said "daily loss limit reached" — completely misleading. The real cause was a missing file the agent never reported. I had zero visibility into what any agent had actually done. What I built AgentLens — a Python SDK for AI agent governance. Three modules: Audit trail — every LLM call and tool use logged to SQLite automatically Authorization — policy-based gates so agents can only call what you've approved Anomaly detection — baseline + threshold config, alerts when behavior drifts One-line integration Drop-in for Anthropic: python from agentlens.integrations.anthropic import TracedAnthropic client = TracedAnthropic(agent_id="my-agent") response = client.messages.create(...) # auto-traced

A publishing bot that depends on one LLM provider has a boring failure mode: the workflow is green, but nothing gets published. I hit that during cycle #1287. The dev.to key was present, the command was read, and the article module simply returned no action after generation failed with LLM unavailable . That is the kind of failure that looks harmless in CI and expensive in a content pipeline. The fix is not more optimism. The fix is a fallback path that produces a plain, useful, bounded article without calling another model. The Failure Mode Most automation code treats content generation and content publishing as one step. That is convenient until the generator fails after the scheduler, secrets, and publishing client have all done their jobs. Separate Generation From Delivery The publishing client should not care whether an article came from an LLM, a template, or a human-reviewed draft. Give it a strict article object and keep the fallback close to the generation boundary. Make the Fallback Honest A fallback article should not pretend it has fresh benchmarks, citations, or provider-specific pricing. It should explain the operational lesson in front of it. Key Takeaways Treat article generation and article publishing as separate failure domains. Return a fallback article when LLM generation fails instead of returning an empty action list. Keep fallback content honest: no invented benchmarks, prices, or citations. Record the original error type so a successful publish does not hide provider trouble. Prefer deterministic recovery for unattended workflows that are expected to produce public output. Next Steps This fallback article is a temporary solution. The long-term strategy is to: Implement a multi-LLM provider system that can switch automatically Add a quota monitoring dashboard to track usage across providers Create a content buffer that stores pre-generated articles for emergencies

Why I'm Prioritizing Automation in My Stack and Business Strategy As a full-stack developer working with JavaScript, Python, and Supabase, and simultaneously building out Delight Softwares Inc. and Softchic, efficiency isn't a luxury – it's a core requirement. My journey involves balancing academic pursuits with real-world tech solutions, especially for the Nigerian market. This dual role has highlighted a critical need: intelligent automation . I'm currently in the strategic planning phase of deeply integrating automation across my development and business operations. This isn't just about saving time; it's about building scalable, resilient systems that allow me to focus on innovation rather than repetition. The Vision: Where Automation Fits In Development Workflow Optimization: CI/CD Pipelines: As I delve deeper into backend development and complex Next.js applications, automating testing, building, and deployment processes becomes non-negotiable. Imagine pushing code and having tests run, builds deployed to staging, and even production updates handled with minimal manual intervention. This frees up precious time for architecting robust database logic and crafting intricate APIs. Local Environment Setup: Scripting initial project setups, dependency installations, and database seeding can save hours per project. Tools like npm scripts or simple Python automation can standardize this. Code Quality & Linting: Automated pre-commit hooks or CI checks using tools like ESLint for JavaScript/TypeScript and Black/Flake8 for Python ensure consistent code quality without constant manual review. Business Operations & Growth: Market Intelligence Automation: For Softchic, understanding market trends for website templates is crucial. Automating data collection from various sources using Python scripts can provide invaluable insights for product development and pricing strategies. Content & Marketing Streamlining: While creativity is human-driven, the distribution of promotional

Casi todo bot de trading tiene una línea que decide cuánto comprar . Suele parecer trivial: si arriesgo el 1% de mi saldo y mi stop está a 1000 dólares de distancia, la cantidad sale de una división. El cálculo es de primaria. Lo que no es de primaria es hacer que ese número quepa en las restricciones del exchange . Ahí es donde se pierde dinero, y de formas que no aparecen en los logs. El patrón que multiplica tu riesgo Esto está en incontables bots, y estuvo en uno mío: cantidad = max ( 1 , int ( cantidad_teorica / contract_size )) La intención es defensiva: "que nunca salga cero". El efecto es el contrario. Si la cantidad teórica sale 0.1 contratos, int() la trunca a 0 , y entonces max(1, ...) la fuerza a uno . Acabas de abrir una posición diez veces más grande que la que autorizaste. Con números concretos: saldo de 500 USD, riesgo del 1% (5 USD), entrada en 50 000, stop en 45 000, contratos de 0.01. El riesgo real de ese contrato único es de 50 USD — diez veces el presupuesto. Y ocurre en silencio: la orden se acepta, el bot sigue, no hay excepción que capturar. Lo peor es que no es un caso raro. Pasa siempre que el saldo es pequeño o el stop es ancho, es decir, exactamente cuando menos margen tienes para equivocarte. Los otros dos que cuestan dinero Ignorar el nocional mínimo. El exchange rechaza la orden por valor mínimo, el bot lo registra como error de red, y nadie se entera de que esa señal nunca se operó. El backtest la contó; la cuenta no. No reservar para comisiones. Con un stop ajustado, las comisiones de ida y vuelta pueden ser la mitad del riesgo real . Si dimensionas contra la distancia al stop y nada más, arriesgas sistemáticamente más de lo que crees. Cómo lo resolví Saqué el cálculo del bot y lo publiqué como librería: position-sizing (Apache-2.0, sin dependencias). from decimal import Decimal from position_sizing import MarketSpec , size_for_risk spec = MarketSpec ( amount_step = Decimal ( " 0.001 " ), min_amount = Decimal ( " 0.001 " ), min_noti

GitHub热门项目 | Easily train a good VC model with voice data <= 10 mins! | Stars: 37,111 | 338 stars this week | 语言: Python

GitHub热门项目 | SkyRL: A Modular Full-stack RL Library for LLMs | Stars: 2,123 | 6 stars today | 语言: Python

GitHub热门项目 | Agent skill that removes signs of AI-generated writing from text | Stars: 33,621 | 397 stars today | 语言: Python

GitHub热门项目 | 🚀 2026 最系统的 AI Agent 速成指南｜智能体实战教程 · 完整学习路径 + 实战项目 + 面试题库 · 对标大模型应用开发工程师岗位 · 覆盖LangChain / LangGraph / Coze / Dify / MCP / skills / LLM / RAG / 提示词 · 企业级部署与微调 · 从0到企业级落地 + 从学习到上线项目 + 面试准备一体化 | Stars: 3,439 | 43 stars today | 语言: Python

GitHub热门项目 | Agentic AI for writing code | Stars: 736 | 10 stars today | 语言: Python

GitHub热门项目 | ComfyUI template workflows | Stars: 710 | 9 stars today | 语言: Python

Originally published at Programming Tech Lab . Welcome to the Garage: What is Linear Regression? Step away from the kitchen counter and step into a bustling auto garage. Imagine you are an experienced mechanic evaluating used cars brought in for trade-ins. A customer drives in a sedan with 50,000 miles on the odometer and asks: "How much is my car worth?" Without needing a complex computer program, your brain instantly draws a connection: as the mileage on a car goes up, its resale price goes down. If a car has 0 miles (brand new), it commands peak market price. If it has 200,000 miles, it drops significantly toward scrap value. This straight-line relationship between two factors—where changes in one variable cause a predictable increase or decrease in another—is the core concept behind Linear Regression . Deconstructing the Formula (Without the Headache) In high school math, you probably saw the classic line equation: y = mx + b In machine learning, Linear Regression uses this exact same formula to make predictions: Predicted Value (y) = ( Slope m × Input Feature x ) + Starting Point b Let's map this directly to our mechanic's garage evaluation: Target (y): The estimated resale price of the car ($). Input Feature (x): The total miles on the odometer. Starting Point / Intercept (b): The price of the car when mileage is 0 (Brand New MSRP). Slope / Weight (m): The rate of depreciation (e.g., losing $0.10 in value for every 1 mile driven). If a car starts at a baseline price of $30,000 and depreciates by $0.10 per mile, a car with 50,000 miles is predicted to be worth: Predicted Price = $30,000 - ($0.10 × 50,000) = $25,000 How the Algorithm Draws the Perfect Line: Least Squares If you plot 100 used cars on a graph where the horizontal axis (X) is Mileage and the vertical axis (Y) is Price, the dots won't form a perfectly straight laser line. Some owners took great care of their vehicles; others had minor scratches. So how does a Linear Regression algorithm draw the sin

Hey everyone, it's your friendly neighborhood dev-dad here. Mid-thirties, full-time engineer by day, battling AI trading bots by night (weekends, really). Today, I want to share a subtle but potentially catastrophic bug I found in my bot. Seriously glad I caught this before deploying with real money. The symptom: Discord notifications for order fills just weren't arriving. The culprit: I forgot to load my .env variables consistently across multiple Python scripts. This is a super common pitfall when you're linking several Python scripts in a personal project, and it can be a real headache. What Happened: A "Silent Failure" Uncovered by a DRY_RUN Last weekend, I was running my usual DRY_RUN tests for my FX bot. My bot's logic is split into two main parts: planner.py , which strategizes trades, and executor.py , which actually sends orders to the exchange. The console logs looked perfectly normal. executor.py seemed to be doing its job: I saw messages like "[DRY_RUN] Order placed: ...". But the Discord notifications, which should have been firing, never appeared. At first, I thought it was a Discord outage or just a delay. But after 30 minutes, nothing. Something was definitely wrong. Thinking about what would have happened if this were real money sent shivers down my spine. "I thought I placed an order, but it never went through." "I thought I closed a position, but I was still holding it." Bugs in notification systems are terrifying because they create these silent failures. You think everything is okay, but it's not. This is precisely how real money gets lost. The Investigation: Unmasking the Culprit To narrow things down, I first tried calling notify.py (which handles all notifications) directly. It worked flawlessly; the Discord notification came through. This pointed to an issue within executor.py , which calls notify.py . I re-examined executor.py 's logs more carefully and immediately saw it: the webhook URL being passed to the notification function was None .

Hey everyone, it's your friendly neighborhood senior dev here. I'm 38, working as a full-time engineer during the week, and tinkering with AI-powered algorithmic trading bots on the weekends. Today, I want to share a story about a subtle but potentially catastrophic bug I found in my bot. Seriously, thank goodness I caught this before deploying with real capital. The TL;DR: My Discord notifications for order confirmations weren't firing, and the culprit was a forgotten .env load across multiple Python scripts. I think this is a pretty common pitfall when you're working on personal projects with several interconnected Python scripts. What Happened: A "Silent Failure" Uncovered by DRY_RUN Over the weekend, I was running my usual DRY_RUN tests for my forex bot. My bot's architecture splits responsibilities: planner.py handles strategy logic, and executor.py executes actual trades on the exchange. Looking at the console logs, executor.py seemed to be working perfectly. I saw logs like [DRY_RUN] Order placed: ... . But the Discord notifications, which are supposed to arrive after an order, simply weren't showing up. Initially, I thought it might be a Discord issue or just a delay. But after 30 minutes, still nothing. This felt wrong. The thought of this happening with real money sent shivers down my spine: "I thought I placed the order, but it never went through." "I was sure I closed that position, but it's still open." Bugs in notification systems are notorious for creating these kinds of silent failures, and they're genuinely scary. The Investigation: Aha! Found You... My first step was to isolate the problem. I directly invoked notify.py , the script responsible for sending notifications. It worked perfectly, sending a test message to Discord. This strongly suggested the issue was upstream, likely within executor.py , which calls notify.py . I took a closer look at executor.py 's logs. And there it was: the webhook URL, which should have been passed to the notificati