今日已更新 302 条资讯 | 累计 37551 条内容
关于我们

标签：#open

找到 2648 篇相关文章

AI 资讯

The Smallest Fix With The Biggest Impact [Skips VS Technology Edition]

This is a submission for DEV's Summer Bug Smash: Smash Stories powered by Sentry . Remember that one Regular Show episode where Skips tried to destroy the park's computer because it caught the Error 220 bug? He took one look at it, picked up a sledgehammer and said the line we’ve all felt as devs: “ There’s something evil in that computer. We gotta smash it ”. In the cartoon, they literally smash the computer and this works to fix the bug. In real life? We don’t get sledgehammers. We get Github PRs. Last week, I almost felt like Skips. I found a one-line bug in an open source repo that could’ve broken Instagram webhook security. No hammer, no explosion, just one misindented ‘if’ statement and a missing test. This is the story of how the smallest fix had the biggest impact. -The Challenge So what was my Error 220 ? While contributing to the corsair open-source repo, I found a security breach in the Instagram webhook handler. Something about the verification flow felt off, so I started tracing it line by line. The code called timingSafeEqual but the result was indecisive. I took an extensive look at it and that's when I saw it- The if statement meant to guard the check was there, but timingSafeEqual was indented wrong. It was meant to return the result of timingSafeEqual to accept or reject the request, but it fell through instead. Although it was running, its return value wasn’t being used to control the flow. This bug was tiny-one mis-indented line- but it had a great impact. In JS, it is not considered an error and so it’s easy to miss. Webhook security relies on a signature check to prove a request. If timingSafeEqual isn’t actually enforcing it, an attacker could forge a webhook and it would be accepted. The entire protection could fall apart over one tab. View PR #759 -The Fix In fixing it, I opened PR#759 to correct the indentation so crypto.timingSafeEqual would be inside the if block and its boolean result would decide whether to return true or false . Prior

2026-08-20 原文 →
AI 资讯

Dashforge: an application orchestrator for React

React solved rendering. Dashforge tries to solve orchestration — theming, forms, permissions, and visibility moved out of your components, declaratively, predictably, reusably. Two skins (MUI and Tailwind), one contract. Building complex applications isn't about building components. Inside a single module you're juggling forms, permissions, roles, visibility conditions, fields that depend on other fields, business logic. And all that logic ends up scattered across the app : a <Controller> here, an if (user.role === …) there, a useEffect watching one field to update another, a context for theming. If React solves the rendering problem, Dashforge tries to solve the orchestration problem. Dashforge moves that complexity out of the components and makes it declarative, predictable, and reusable . At its core it uses react-hook-form ; on top of it, a stable contract — identical across the MUI and Tailwind editions. Let's go through it piece by piece. 1. Theming — token-first, build-time and run-time Components don't hard-code colors or spacing: they consume typed design tokens ( @dashforge/tw-tokens , a pure TypeScript package, zero runtime). From there, the tokens travel on two rails. Build-time — the utilities. A Tailwind preset emits the usual utilities ( bg-primary-600 , text-neutral-900 ): // tailwind.config.ts import { dashforgePreset } from ' @dashforge/tw-theme ' ; export default { presets : [ dashforgePreset ()], content : [ ' ./src/**/*.{ts,tsx} ' ] }; Run-time — the CSS variables. The provider republishes those same tokens as CSS variables on <html> : < DashforgeTailwindProvider > < App /> </ DashforgeTailwindProvider > Here's the trick: bg-primary-600 doesn't resolve to a fixed color — it resolves to var(--tw-color-primary-500) . The provider sets that variable; change the variable, the color changes — no re-render, no Tailwind rebuild. The store is reactive (Valtio) with cross-tab sync, so dark mode or a live theme change is just a variable flip. In the MUI e

2026-08-20 原文 →
AI 资讯

1a vez trabalhando com git com time: tudo que você precisa saber

Faz mais de 5 anos que eu não abria um PR ou issue técnica no Github, mas essa semana tenho aprendido algumas boas práticas e termos que reuni neste artigo. Introdução Essa semana eu fiz uma coisa simples: atualizei o README de um projeto open source, o 4noobs , da comunidade He4rt. Troquei um badge, ajustei o contraste de um logo, organizei umas pastas e adicionei um índice pra facilitar a navegação. Nada muito complexo no fim das contas. Só que antes de chegar no "nada muito complexo", eu passei um tempo enrolada com uma pergunta boba: "E se eu mandar isso direto pra branch principal e bagunçar tudo?" Se tu já sentiu esse friozinho na barriga antes de mexer num repositório que não é só teu, esse artigo é pra ti. Não importa se tu é dev há anos ou se nunca abriu um terminal na vida... A lógica por trás de "como contribuir sem quebrar nada" é a mesma e bem mais simples do que parece. Definição de Git Colaborativo Quando eu aprendi git há uns anos, aprendi somente o versionamento e a enviar os arquivos pra dentro do Github, mas ele é bem mais que isso, né? É através dele que times enormes interagem a respeito de um mesmo projeto de forma organizada, comentando, gerenciando tarefas, sugerindo melhorias e conhecendo o que os outros envolvidos estão fazendo. Isso é a parte do Git Colaborativo . O Git resolve isso com um conceito central: branches (ou "ramificações"). Cada branch é tipo uma cópia paralela do projeto, onde tu pode mexer à vontade sem afetar a versão "oficial" (geralmente chamada de main ou master ). Quando tu termina sua parte, tu propõe que essas mudanças sejam incorporadas de volta pelo Pull Request (PR) . Ou seja, o fluxo básico é: Tu cria uma branch nova a partir do projeto principal Faz as alterações lá, no seu espaço isolado Envia ( push ) essa branch pro repositório remoto Abre um Pull Request pedindo pra essas mudanças serem revisadas e, se aprovadas, unidas ( merge ) à branch principal Ninguém mexe direto na versão "de produção" do projeto. Isso

2026-08-20 原文 →
AI 资讯

Switch Icons v0.2.0: A React Icon Library Built for the Icons Developers Actually Need

Modern web applications rarely need only arrows, menus, and generic interface icons. A fintech dashboard needs payment and banking icons. A logistics platform needs waybills, packages, warehouses, and delivery trucks. An AI application needs model, prompt, and AI-related visual language. An African commerce platform may need icons that represent local payment methods such as Naira, USSD, POS, and bank transfers. That is the idea behind Switch Icons. Switch Icons is a modern, developer-focused React icon library designed around practical icons for real-world applications—not simply another collection of unrelated SVGs. Why Switch Icons? There are already plenty of excellent icon libraries available. But while building modern applications, there is often a gap between the generic icons most libraries provide and the domain-specific icons developers actually need. Switch Icons is being built around that gap. Instead of focusing exclusively on generic UI elements, the library combines familiar interface icons with categories such as: Fintech and payment rails Logistics AI Commerce Technology Security Social Business and CRM Communication Media The goal is simple: make it easier for developers to find the right icon without having to create or hunt down an SVG every time they build a feature. What's New in v0.2.0? Switch Icons has now reached its first public npm release. Version 0.2.0 includes 93 icons across 9 major categories, along with 14 solid variants for icons where a filled visual style makes more sense. The current collection includes: Navigation & UI Essential icons for navigation, actions, and common interface patterns. People & Communication Icons for users, teams, messaging, communication, and related functionality. Business & CRM Icons designed for business applications and customer-management interfaces. Fintech & Payment Rails This is one of the areas that makes Switch Icons particularly different. The library currently includes icons such as: Naira Bank

2026-08-20 原文 →
AI 资讯

How to Build Your First AI Agent Tool in 15 Minutes (20+ Open Issues for Beginners!)

If you’ve been using ChatGPT, Claude, or LangChain, you know that Large Language Models (LLMs) are completely isolated from the real world. They can't check the weather, read your emails, query your database, or send Slack messages. That is, unless you give them Tools. Connecting AI agents to external APIs is one of the most in-demand skills in AI engineering right now. To make this easier for everyone, I recently launched Agent Tools & MCP Hub, an open-source directory of plug-and-play AI tools compatible with the new Model Context Protocol (MCP) standard. And the best part? We have over 20+ good first issue tasks open right now for anyone who wants to contribute! 🌟 What is the Agent Tools & MCP Hub? Agent Tools & MCP Hub is a modular, zero-dependency repository that standardizes how tools are built for AI agents. Whether you are using LangChain, CrewAI, AutoGen, or Anthropic’s new Claude Desktop MCP clients, our tools are designed to work right out of the box. Why Contribute? If you've been wanting to make your first open-source contribution but felt overwhelmed by massive codebases and merge conflicts, this repo is built specifically for you: 🧩 100% Modular: Every tool lives in its own isolated folder ( tools/<tool-name> ). Your code will never conflict with someone else's. ⚡ Easy Templates: We provide a copy-paste _template folder. You just add your API logic. 3. 🏅 Instant Recognition: Every contributor whose PR is merged gets their GitHub profile showcased on the official repository README! 🛠️ How to Contribute (in 15 Minutes) We've made the contribution process as frictionless as possible. Step 1: Claim an Issue Head over to our GitHub Issues Page and find an open issue labeled good first issue . Comment on the issue to get it assigned to you! Here are some of the trendy tools waiting to be built: Spotify Current Track & Playlist Fetcher Notion Page & Database Appender Stripe Payment Status Inspector Supabase Realtime Table Query Tool Linear / Jira Task Creato

2026-08-20 原文 →
AI 资讯

"What's the Catch?" — Why StayPresent Is Actually Free

A tool that handles crash recovery, hang detection, and a full status page sounds like it should cost something. Here's why it doesn't, and won't. "What's the Catch?" — Why StayPresent Is Actually Free It's a reasonable question. A tool that handles crash recovery, hang detection, and generates a real status page — the kind of thing you'd expect to see behind a pricing page with a "Pro" tier — is, in fact, entirely free. Not a free tier that nudges you toward upgrading. Not a trial. Just free. Here's the honest answer to "what's the catch," because the skepticism is fair. The MIT license, plainly stated StayPresent is released under the MIT License — one of the most permissive open-source licenses that exists. In practice, that means: use it in a personal project, use it in something you're charging money for, modify it, redistribute it, all without paying anything or asking permission. There's no feature gate waiting behind a paywall, and no functionality quietly disabled unless you upgrade. No account required, no data leaving your deployment There's no account to create, no API key issued by a third party, no external service your bot phones home to. Everything — the web server, the crash recovery, the status page, the hang detection — runs directly inside your own deployment, on infrastructure you already control. There's genuinely nothing to charge for on the vendor side, because there's no ongoing service being provided from outside your own process. Why "free forever" is actually plausible here A lot of "free" developer tools eventually aren't, because they're subsidizing a hosted service somewhere — servers, bandwidth, support staff — and the free tier exists to fund a business built around eventually charging some of its users. StayPresent doesn't have that shape. It's a library, not a hosted service. There's no infrastructure cost scaling with your usage that would ever create pressure to start charging. What you're actually trading The honest trade isn't

2026-08-20 原文 →
AI 资讯

Introduction

Hi, I’m a Principal Architect with 15+ years of experience designing and delivering scalable, resilient, high-availability Java SaaS platforms. My work sits at the intersection of distributed systems, real-time data platforms, and the emerging enterprise generative AI stack. I enjoy turning complex technical challenges into secure, maintainable systems that create measurable business value. Architectural Foundation I lead technical direction for platforms built with JDK 17–25 and Spring Boot 3.x, with a strong focus on microservices, transactional consistency, and operational resilience. My experience includes: Designing services around ACID transaction requirements Managing distributed workflows with Saga and Outbox patterns Applying strategic Domain-Driven Design (DDD) Defining bounded contexts that align software architecture with business capabilities Using Architecture Decision Records (ADRs) to make technical decisions transparent and durable Real-Time and Distributed Systems I build the “nervous systems” of enterprise platforms using Kafka, Redis, and MongoDB. My focus is on event-driven architectures that support real-time processing, high throughput, low latency, and global availability. I am particularly interested in infrastructure-aware design: making sure application architecture, data flow, deployment topology, and observability work together rather than being treated as separate concerns. Generative AI and Agentic Systems A significant part of my current work involves AI/ML and generative AI initiatives, especially Retrieval-Augmented Generation (RAG) and agentic workflows for enterprise use cases. Areas I am actively exploring include: JVM-native inference: Running inference with ONNX Runtime to reduce network overhead and improve predictability Agent orchestration: Building production-ready workflows with LangChain4j and Spring AI Build vs. buy decisions: Evaluating emerging AI platforms against enterprise requirements AI guardrails: Designing secur

2026-08-20 原文 →
AI 资讯

OpenAI Expands Zero Data Retention Options for Frontier Model Enterprise Workloads

OpenAI is positioning Zero Data Retention (ZDR) as a scalable privacy control for eligible frontier-model API and enterprise workloads. The policy matters as businesses use more capable models for longer-running and increasingly autonomous work, where prompts, outputs, and related interactions can contain sensitive operational, customer, or proprietary information. On its official API platform page , OpenAI lists "Zero data retention policy by request" alongside access to frontier models and APIs. The company’s enterprise privacy materials and GPT-5.4 release information add important context: ZDR is a configurable option for eligible organizations and endpoints, rather than a universal default across all OpenAI services or customer configurations. The shift is less about a newly invented privacy principle than about applying retention controls more explicitly to frontier-capable deployments. OpenAI’s GPT-5.4 materials describe Zero Data Retention surfaces and safety controls designed for higher-sensitivity contexts. That framing acknowledges a practical tension for enterprise AI: more autonomous systems can create more valuable workflows, but they also require safety systems that assess risks across related interactions. What Zero Data Retention changes for enterprise AI Under ZDR, OpenAI disables logging of customer content for abuse monitoring and model-training purposes. The setting also affects API behavior. For example, the store parameter for chat completions and responses is forced to false in ZDR contexts. That is a meaningful control for teams that need to minimize the persistence of prompt and response content. It should not, however, be interpreted as a blanket statement that no information can ever be retained anywhere in the service. OpenAI documents that some endpoints may retain application state or metadata for operational reasons. It also describes exceptional safety and retention mechanisms, including Eyes Off and Safety Retention , that may apply

2026-08-20 原文 →
AI 资讯

OpenAI hit the brakes. Now what?

With a looming IPO, intense competition from Anthropic, and Chinese and open-weight rivals nipping at its heels, OpenAI has plenty of reasons to move fast. Instead, it hit the brakes. On Tuesday, the company said it had slowed the pace of some AI development while it tightened security and safeguards. That included a two-week pause […]

2026-08-20 原文 →
AI 资讯

Hacktoberfest 2026: AI belongs to everyone

We have some news we're excited to share today: Major League Hacking (MLH) and DEV are partnering with DigitalOcean to run Hacktoberfest 2026. This October, we’ll host over 300 in-person events (“Fests”) plus a global online event, all about building with open source and open-weight AI. DEV and MLH have supported Hacktoberfest for years under DigitalOcean’s ownership. DEV provided a space to share maintainer and contributor learnings, while MLH has powered both in-person and online events. This year will be the first time MLH, DEV, and DigitalOcean are full partners in bringing Hacktoberfest to life. From four PRs to a global tradition Hacktoberfest started back in 2014 with a simple idea from DigitalOcean: open four pull requests in October, earn a t-shirt. It worked. Thousands of developers made their first open-source contribution during the month-long celebration. For many people reading this, Hacktoberfest was the door that opened open source to them in the first place. It certainly was for a lot of us at MLH. But a good thing can require a refresh. Over the years, that same PR-counting format started to work against the community. Maintainers began to burn out under the volume of low-effort, box-checking pull requests they were receiving. That problem only got worse as AI tools made it trivially easy to generate a PR without generating any real value. The event meant to make maintainers' lives easier started doing the opposite. We didn't want to keep running that version of Hacktoberfest. So we're trying something new. Hacktoberfest 2026 This year, we’re not counting PRs. Hacktoberfest is focused on giving everyone the tools and knowledge to learn, experiment, and build with open artificial intelligence: write your first open-source skills.md, build your own open-source agent, fine-tune an open-weight model, or just follow your curiosity wherever it takes you. We believe open innovation deserves the same priority as proprietary tools for a healthy ecosystem, e

2026-08-19 原文 →
← 上一页 下一页 →