标签：#ens

AI-Driven Security Workflows: Meet Reverse-Skill As AI coding agents (such as Claude Code, Cursor, and Cline) become integrated into daily software development, engineers are increasingly tasking them with security audits, binary analysis, and vulnerability detection. However, without structured guidance, AI models frequently guess random command-line arguments or struggle to coordinate complex multi-step security tools. reverse-skill is an open-source framework developed by zhaoxuya520 to solve AI security task coordination. Built as a deterministic "skill router," reverse-skill provides AI agents with verified execution paths and toolchain bootstrapping for reverse engineering and security research. What is Reverse-Skill? reverse-skill acts as an intelligence routing layer between AI agents and local security utilities. Instead of executing arbitrary terminal commands, the agent evaluates incoming tasks against a deterministic routing pipeline, selecting established methodologies for decompilation, memory analysis, or network auditing. Key Core Features 1. Deterministic Security Task Routing reverse-skill organizes security workflows into structured rules. When an AI agent encounters a task (such as inspecting an Android APK or analyzing a binary executable), the router directs the agent to a step-by-step methodology, minimizing ad-hoc execution errors. 2. Automatic Local Toolchain Bootstrapping reverse-skill includes local indexing scripts ( refresh-tool-index.sh / .ps1 ) that automatically scan your system. It indexes installed reverse-engineering tools—such as Ghidra, GDB, Radare2, Frida, Nmap, and Apktool—configuring exact executable paths for your AI agent. 3. Self-Evolving Methodology Base The framework maintains trajectory logs and CTF regression benchmarks. As your AI agent completes complex analysis tasks, reverse-skill refines its local knowledge base, preserving successful methodologies for future audits. 4. Universal AI Client Integration reverse-skill

WebForms Core 2.1 is coming soon from Elanat . The new version introduces a collection of capabilities designed to further expand the server-driven approach of WebForms Core. One of these new capabilities is Morphing . Morphing provides a way to synchronize an existing DOM element with a new HTML structure without necessarily replacing the existing element itself . This makes it possible to update HTML structures while preserving the identity of existing DOM elements. Morphing Morphing is a DOM synchronization mechanism that compares an existing HTML element with a new HTML structure and applies the required changes to the existing DOM. Unlike a traditional replacement operation such as: element . outerHTML = html ; Morphing does not simply discard the existing element and create another one. Instead, it analyzes the existing element and the new element and performs the necessary operations: Add new attributes Update existing attributes Remove attributes that no longer exist Add new child elements Update existing child elements Remove obsolete child elements Match elements using id and cb-data-id Preserve existing DOM element identity whenever possible Preserve registered event listeners when new Nodes have to be created The goal is to make the smallest necessary changes to the DOM. Reflection vs Morphing WebForms Core 2.1 contains both Reflection and Morphing , but they serve different purposes. Reflection is primarily a merge operation . For example, if the target contains: <div id= "userCard" > <h3> User </h3> </div> and the source contains: <div class= "premium" > <button> VIP </button> </div> Reflection can merge the source into the target, adding the class and child without treating the source as a complete replacement definition. Morphing has a different philosophy. The source represents the desired structure . If the source does not contain an element or attribute that exists in the target, Morphing can remove it. Therefore: Reflection Target + Source ↓ Merg

For the past week, developers have been puzzling over a model called Ox Alpha. It appeared on OpenCode and OpenRouter on August 20 with no owner attached, free to use, with a 1M-token context window and support for image and video input. Independent researchers fingerprinted its tokenizer, ran compression analyses, and traced it to Z.ai's GLM family with high confidence. On August 26, Z.ai confirmed it: Ox Alpha was GLM-5.3-Flash in disguise, tested anonymously to gather real-world feedback before the official launch. The reveal matters beyond the detective story. GLM-5.3-Flash is the first natively multimodal model in the GLM-5 series, it ships with open weights under the MIT license, and Z.ai claims it delivers frontier-adjacent performance at roughly one-tenth the price of its predecessor. A few things upfront. All benchmark numbers below are vendor-published. I have not run GLM-5.3-Flash myself, and the comparison tables skip some strong models (no Opus 5, no Grok 4.6, no Fable 5). Treat the scores as Z.ai's claims, not independent verification. What the Model Actually Is GLM-5.3-Flash is a Mixture-of-Experts model with 320B total parameters and just 18B active per token. The context window is 1M tokens. Unlike GLM-5.2 and GLM-5.3, which were text-only and drew repeated complaints about it, this model accepts text, images, and video natively, at the architecture level rather than as a bolted-on vision module. The parameter math is the interesting part. Compared with the GLM-4.5 series, GLM-5.3-Flash has a similar total size (320B vs 355B) but nearly halves the activated parameters (18B vs 32B) and the layer count (45 vs 92). In other words, Z.ai deliberately traded depth and width for a shape that is cheap to serve, then compensated with a richer training recipe: a 30T-token multimodal pre-training corpus and what the company calls Manifold-Constrained Hyper-Connections to improve scaling efficiency. A Hybrid Attention Architecture The most technically significa

Most tool documentation teaches by just telling you things. You read a page about /model , or hooks, or subagents, nod along, and forget it by the time you'd actually need it. I wanted something closer to how people actually learn a CLI, by using it, with something checking whether you did the thing right or not. So I built claude-quest , a text RPG that runs entirely inside a real claude session and teaches the Claude Code CLI zero to hero. the idea isn't new, I borrowed it This is basically GameShell 's philosophy applied to Claude Code. GameShell teaches Unix shell commands by dropping you into a real shell wrapped in a themed fake filesystem, and grading your progress by checking real shell/filesystem state instead of asking you to self report or answer a quiz question. claude-quest does the same thing, except the "filesystem" is a real Claude Code environment. missions live in real sandbox directories, and progress is checked by inspecting what you actually did, config files you wrote, hooks that fired, tool calls that happened. what it actually looks like There's no separate app, no fancy terminal UI, none of that. You say "let's play claude quest" inside a normal claude session, and Claude itself becomes the game master. It reads real output from the engine and narrates on top of it, something like this: > lets play claude quest **The Gatehall** You've just been let through the outer gate. The tower keeps no secrets from those who bother to read the walls... **Mission: First Contact** (Tier 1, Artifact) Create a CLAUDE.md file in this sandbox recording how to run the project's tests. Let me know when you're done and I'll check it. > done CLAUDE.md records how to run the tests. Claude Code will know next time. MISSION_STATUS: complete **What you actually learned:** Claude Code reads a file named CLAUDE.md in your project root automatically, at the start of every session... that's it, that's the whole interface. it's just a chat, with real commands running unde

AWS describes a specification-driven approach for composing flexible data workflows by separating intent from processing logic. Architecture uses declarative specifications, reusable processing capabilities, and validation before execution. AWS reports that the approach can reduce dataset onboarding from weeks to days while supporting traceability, versioning, data classification, and governance. By Leela Kumili

GitHub热门项目 | A fluid, morphing interface to your Linux desktop | Stars: 4,108 | 128 stars this week | 语言: TypeScript

GitHub热门项目 | The repository for high quality TypeScript type definitions. | Stars: 51,405 | 38 stars this week | 语言: TypeScript

GitHub热门项目 | Web framework built on Web Standards | Stars: 31,969 | 258 stars this week | 语言: TypeScript

GitHub热门项目 | A unified inference and post-training framework for accelerated video generation. | Stars: 4,070 | 111 stars this week | 语言: Python

GitHub热门项目 | 日報管理リポジトリ | Stars: 133 | 13 stars today | 语言: Rust

GitHub热门项目 | Mission control for your AI agents | Stars: 406 | 108 stars today | 语言: Rust

GitHub热门项目 | The premier source of truth powering network automation. Open source under Apache 2. Try NetBox Cloud free: https://netboxlabs.com/products/free-netbox-cloud/ | Stars: 21,389 | 35 stars today | 语言: Python

I maintain gumdrop , an async, non-blocking Java server framework. Last year I wanted to add HTTP/3 support, and ran into a wall: the Java ecosystem essentially doesn't have QUIC. The JDK's own experimental support (JEP 517) is client-only. Netty gets HTTP/3 by shelling out to quiche + BoringSSL over JNI — which works, but you're back to native builds, platform-specific binaries, and a C library sitting underneath your "pure Java" framework. I used that approach first. It was clumsy enough that I went looking for a pure-Java alternative. There's exactly one: Kwik. But Kwik is blocking per connection — one thread per QUIC connection. That's a non-starter for a framework built around single-threaded selector loops handling tens of thousands of concurrent connections. So I wrote a QUIC implementation from scratch: packet protection, loss detection and NewReno congestion control, connection migration, 0-RTT, QPACK, an HTTP/3 client and server — all driven by the same non-blocking event loop as everything else in gumdrop. Collaboration note: TLS 1.3 comes from Agent15 — also from Kwik's author, Peter Doornbosch, but just the handshake layer, not the connection model. We're currently working together on making PQC — hybrid key exchange and signatures — the default there. Why the thread model matters The reason this mattered beyond HTTP/3: gumdrop isn't a web framework with QUIC bolted on, it's a general async I/O framework, and QUIC is just a transport. One thread per connection is exactly the model gumdrop exists to avoid — it caps concurrency at your thread pool, not your file descriptors, and it's the reason a "just use Kwik" fix was never really on the table. The same QUIC stack backs DNS-over-QUIC (DoQ) as a first-class DNS transport alongside DoT, DoH, UDP, and TCP — and the DNS resolver itself is fully async, with no blocking InetAddress.getByName() anywhere in the I/O path, which is its own small miracle in Java. HTTP, SMTP, IMAP, POP3, FTP, MQTT, SOCKS — it's the

GitHub热门项目 | Криптографический слой, работающий поверх существующих мессенджеров | Stars: 250 | 32 stars today | 语言: Python

If you're building or evaluating an AI agent that can shop and check out on its own, you've probably run into the new "agentic commerce" protocols: ACP (OpenAI + Stripe + Meta), AP2 (Google), and UCP. They define how an agent talks to a merchant to create a checkout session, apply a payment token, and get an order back. Stripe's own test mode covers the payment half fine — test cards, test API keys. But there's no hosted "fake merchant" you can point your agent at to verify the protocol half: does your agent correctly create a session, handle a 422 idempotency conflict, parse the order response, retry politely? You either mock it yourself from the spec, or risk finding out against a real merchant. So I built acp-sandbox — a small hosted mock merchant implementing the ACP checkout API, live at https://acp-sandbox.flo-voice1.com . What it does It implements the real checkout_sessions lifecycle from ACP's 2026-04-17 spec : create, retrieve, update, complete, cancel. Responses match the actual CheckoutSession / Order / Error schemas for the fields it supports — I pulled the OpenAPI spec directly rather than guessing field names. # get a test key, no signup curl -X POST https://acp-sandbox.flo-voice1.com/keys \ -H "Content-Type: application/json" -d '{"email":"you@example.com"}' # create a session against the demo catalog curl -X POST https://acp-sandbox.flo-voice1.com/checkout_sessions \ -H "Authorization: Bearer acps_test_..." \ -H "Content-Type: application/json" \ -d '{"line_items":[{"id":"item_demo_headphones","quantity":1}],"currency":"usd"}' Every request/response is logged per API key ( GET /logs ), so you can see exactly what your agent sent when something doesn't work. What it deliberately doesn't do (yet) No real payment processing — complete always succeeds once you send any payment_data . No OAuth delegate_authentication flow. No fulfillment options (shipping/pickup) — every session goes straight to ready_for_payment . Fixed demo catalog (4 items), not a rea

Hoi hoi! I’m @nyaomaru, a frontend engineer who struggles to make game sounds. 😿 Have you used DSA...

As of August 26, 2026, GitHub reports that 398 merged pull requests carry my name on the author line. Twenty nine of those live inside repositories that I own myself, so I removed them from this count on purpose. What remains is the number that actually matters to me: 369 pull requests merged into other people's repositories , across 33 external projects , maintained by strangers who had zero reason to trust my code. Every single one of those 369 merges is real, dated, and linked in this post. Nothing here is rounded up and nothing is claimed without proof. If you want to skip my writing entirely, open the search query in section two and run it yourself. That is the whole point of this article. You should never have to take a stranger's word about their own stats. Jump To Any Section How I Verified These Numbers | The Complete Scoreboard | 2024 The Year Of Volume | 2025 Fewer Pull Requests Higher Quality | 2026 The Year Production Code Got Merged | What 369 Merges Taught Me | Frequently Asked Questions | Where To Find Me How I Verified These Numbers I did not count these by hand. I queried the GitHub search API directly, which means the numbers come from GitHub itself, not from my memory or my ego. You can reproduce everything in this post with one click: https://github.com/search?q=is%3Apr+is%3Amerged+author%3Aaniruddhaadak80&type=pullrequests Or if you have the GitHub CLI installed: gh api -X GET search/issues -f q = "is:pr is:merged author:aniruddhaadak80" That query currently returns 398 results. I then filtered out every repository under my own account, which left exactly 369 external merges. The math is boring on purpose: 398 minus 29 own repository merges equals 369. One more honest number before we go further. I have submitted 918 pull requests in my lifetime so far. That means fewer than half of everything I ever sent got merged. Rejection is not the exception in open source, it is the price of admission, and anyone who shows you a 100 percent merge rate is

More agents do not automatically produce better engineering. They usually add total tokens, duplicated context, handoff delay, and integration risk. Their defensible advantages are narrower: reduced elapsed time for independent work, isolated investigation, or specialist evidence that one agent might omit. The useful question is therefore not “Can this task use subagents?” It is: Does this task contain independent, bounded work whose value exceeds the coordination cost? Codex How To now includes a dependency-free benchmark for testing that question instead of answering it from intuition. Disclosure: I maintain Codex How To , the independent open-source project containing the benchmark, evaluator, and measurements used here. The minimum decision rule Use one agent when the change is small, the interface is unsettled, or several steps must edit the same central files. Consider bounded orchestration only when all of these are true: The task has at least two genuine ownership surfaces. Each writer can own exclusive paths. The interface between those paths is frozen before implementation. The controller retains integration, system checks, and final review. Every worker returns concise evidence rather than a narrative transcript. One external acceptance bar can evaluate every execution method. flowchart TD A["One task contract"] --> B{"Independent write surfaces?"} B -- "No" --> C["One agent or sequential work"] B -- "Yes" --> D{"Frozen interface and exclusive paths?"} D -- "No" --> C D -- "Yes" --> E["Bounded workers"] E --> F["Controller integrates and evaluates"] F --> G{"Coverage or elapsed-time value exceeds coordination cost?"} G -- "Unproven" --> H["Keep measuring"] G -- "Repeated evidence" --> I["Adopt for this task class"] Job titles are not ownership boundaries. “Backend agent,” “test agent,” and “review agent” may still collide on the same files or execute dependent stages. A useful boundary is concrete: one writer owns incident/** , another owns web/** , and n

You know that moment when you're building an n8n workflow and realize: “Wait… does n8n already have a node for this?” Maybe you need a specific AI provider. Or a browser automation tool. Or some obscure database. Or a service that isn't part of n8n's core integrations. The first instinct is usually to reach for the HTTP Request node. But before writing API calls yourself, there's another possibility: Someone may have already built the node. That's one of the reasons I created Awesome n8n Community Nodes . The n8n ecosystem is bigger than it looks One of the best things about n8n is that it isn't limited to its built-in integrations. Developers can create community nodes and publish them as npm packages, extending n8n with new services, triggers, actions, AI capabilities, utilities, and more. The ecosystem has grown significantly. One existing ecosystem tracker had already indexed thousands of community nodes, showing just how quickly the space is expanding. That's great for n8n users. But it creates a new problem: Discovery. Having thousands of nodes is useful only if you can actually find the one you need. So I built a directory I created: Awesome n8n Community Nodes 🔗 https://github.com/bhavyshekhaliya/awesome-n8n-community-nodes It's an open-source, curated directory for discovering community-built n8n integrations and utilities. Instead of organizing everything as one massive list, I grouped nodes around what you're actually trying to automate. 🤖 AI, Agents & Search Looking for AI, LLM, search, agent, or AI-media capabilities? There's a dedicated section for that. 🌐 Browser, Web & Scraping Need browser automation, crawling, scraping, or web extraction? You'll find those together. 💬 Communication & Messaging WhatsApp, email, chat, notifications, and other communication-related nodes have their own category. 🗄️ Data, Storage & Observability Database, storage, infrastructure, monitoring, and data-related integrations live here. 📄 Documents, Media & Productivity For

I’ve been building a small open-source TypeScript toolkit called Tenant Evidence Kit for private, multi-tenant evidence workflows on Supabase. The project started from a very specific problem: How do you attach photos, documents, or other evidence to a business object without making files public, leaking tenant data, or duplicating authorization logic across the application? The toolkit keeps that infrastructure deliberately small and domain-agnostic. It currently provides: private Supabase Storage; evidence metadata separated from file bytes; tenant isolation with Row Level Security; short-lived signed URLs; compensating cleanup when metadata persistence fails; reference migrations for tenant membership and evidence authorization. But the interesting part of the latest release was not the original implementation. It was the review loop. A community review found real problems I shared the project with the Supabase community and received a detailed security review. The feedback raised several important questions: roles existed, but authorization was still too close to flat membership; evidence deletion needed a more explicit privilege boundary; the lack of UPDATE support needed to be intentional rather than accidental; RLS assumptions around service_role , table owners and BYPASSRLS needed to be documented; authorization needed behavioral tests, not only static SQL assertions. That feedback was good enough that I didn’t want to treat it as a documentation exercise. I turned it into an implementation task. Using Codex as the implementation loop Instead of asking Codex something broad like: “Improve the security.” I gave it a tightly scoped issue with explicit acceptance criteria. The workflow became: community review → scoped issue → Codex implementation → human review → correction pass → CI → release The first implementation was useful, but the review still found problems. For example, it initially changed existing INSERT behavior and modified only the original migra