标签：#open

Hello again! Weeks 9 and 10 covered the fourth estimator family, the first release that carries my work, and a git mess that taught me more than the code did. PR #1920 merged, and sbi 0.27 shipped First, the ratio estimator builder from my last post made it in, together with the whole base class hardening bundle. Right after that, sbi 0.27 was released and PRs 1 to 5 were ported over to main . So the typed builder API is now actually in a release, for NPE, NLE, MNPE, MNLE and all four NRE variants. That also means the free rename window is closed. The z_score_input and z_score_condition names we picked in week 7 are now the shipped names, which is exactly why we did that rename when we did. Writing the design before the code Under the new workflow I described last time, the vector field work started with a markdown file instead of a Python file. The vector field family is genuinely harder than the others. build_vector_field_estimator picks along what looks like three axes at the same time: whether you want flow matching or score matching, which SDE type you want if it is score matching, and which network architecture sits inside. And unlike every other family, there are no per-model build functions to hang a config class on. I wrote up the options with some open questions then my mentor, Jan reviewed it and we settled on one builder with a base class abstraction to cut the redundancy across builders. Doing this on paper first was clearly the right call. Some of the things I had assumed while writing the proposal turned out to be wrong, and finding that out in a review comment on a markdown file was a lot cheaper than finding it out in a review comment on 800 lines of code. PR #1921 : VectorFieldEstimatorBuilder With the design agreed, the implementation covers FMPE and NPSE. The builder takes the architecture as model , one of mlp , ada_mlp , transformer or transformer_cross_attn , plus estimator_type for flow versus score and sde_type for the noise schedule. One de

Hey everyone! Weeks 7 and 8 are done, and the biggest news first: I passed the midterm evaluation🎉. Half of GSoC is behind me now. These two weeks were less about writing new classes and more about going back and making the ones I already had a lot stricter. Here is what happened. PR #1920: The RatioEstimatorBuilder This PR adds the builder for the NRE family, so NRE_A , NRE_B , NRE_C and BNRE all get the same typed interface that NPE and NLE already had. The builder itself was honestly the easy part. By now the pattern is well established, so it was mostly mirroring what already worked, with linear , mlp and resnet as the classifier options. The interesting part was what my mentor Jan Teusen suggested we bundle into the same PR. Some improvements to the base class PR #1920 was the first PR that proved the shared base class serves a third family. My Mentor, Jan pointed out that this was exactly the right moment to fix the validation gaps in that base, because then the NRE builder and the vector field builder that was coming next would inherit the fixes for free, instead of me retrofitting four builders later. So we folded a hardening bundle into the same PR: Invalid Literal values now raise at construction. This was the real gap. If you typed a wrong field name , Python already raised a TypeError for you. But if you typed a wrong value on a correctly named field, like z_score_input="idependent" , nothing happened until you called .train() and it blew up much later. Now it fails immediately. Model-incompatible kwargs now raise too. Passing num_blocks to a linear classifier used to be silently dropped, and the same argument on mlp crashed late. Both are caught at construction now by inspecting the target build function's signature. frozen=True on the config dataclasses. Configs are now immutable. If you want a different setting, you make a new object instead of mutating the old one. This sounds like a small thing but it removes a whole class of " I changed the config

April - 1805 Napoleon is master of Europe Only the British fleet stands before him Compute is now an asset class I see it is once again time to talk financial innovation. Apollo, BlackRock, Blackstone, Brookfield, Goldman Sachs, and KKR are all working with Nvidia to put together $500 billion in financing to turn compute […]

I work with PGP regularly and I work with it across multiple operating systems. Linux on my workstation, a MacBook on the go and every now and then I have to touch Windows. And on every single one of them, PGP means a different tool: Kleopatra on Linux, GPG Keychain on Mac, Gpg4win on Windows (which is Kleopatra again, just wrapped differently). Three tools, three UIs, three sets of quirks, three different workflows and none of them are what I'd call user-friendly. And yes, i know: the GnuPG CLI is the same everywhere, and it's a great tool. I use it. But gpg --encrypt --sign --armor -r test@key.com is not something I want to type 100 times a day and it's definitely not something I can give to a non-technical colleague. Every time I had to walk someone through encrypting or decrypting a message, I lost a bit of hope. So I made it my mission to finally build something better: PGP Manager . A free and open-source desktop app that looks and works the same on Linux, Mac and Windows. Why another PGP Tool? The cryptography behind OpenPGP is mature and has been trusted for decades. The problem was never the crypto, it's the workflow and the fragmentation. Encrypting a message for a colleague shouldn't require different tools per OS and a wiki page. My goal was simple: all the everyday PGP tasks in one place, without dumbing anything down or inventing a new format. PGP Manager is not a new crypto system. It uses gopenpgp v3 (ProtonMail's OpenPGP library) and standard OpenPGP (RFC 4880), so it stays fully compatible with GPG, Kleopatra, Thunderbird and the rest. You can leave anytime, your keys are just standard armored files. One more thing that sets it apart from the tools above: they're all frontends for a local GnuPG installation. PGP Manager brings its own OpenPGP implementation, so there's nothing else to install. It can still read an existing GnuPG keyring if you have one, but it doesn't need it. That's also what makes the standalone/USB mode possible in the first pla

Hoi hoi! I’m @nyaomaru, a frontend engineer who dislikes crowded places, so I'm planning to take a...

JSON has no representation for a file. Strings, numbers, arrays, objects - that is the whole list. So every JSON-RPC API eventually runs into the same question: how do you accept a file upload - a photo, a scan, a PDF - when the protocol itself cannot carry binary data? The usual answer is: you don't. The file goes to a separate, ordinary controller that reads $request->files , and the JSON-RPC layer handles everything else next to it. And now you have exactly the ad hoc endpoint sprawl that JSON-RPC was supposed to remove. In otezvikentiy/json-rpc-api 5.2 there is a different answer. And more interesting than the feature is how it came about: I did not write it - an external contributor did. But first things first. Full disclosure: I am the author of the bundle, and I have maintained it alone for almost three years. That is exactly why a release whose headline feature was written by someone else feels like a different kind of event to me. The problem Straight from issue #8 : two services exchange scanned images plus structured metadata (tenant, station, session) on the same call - something like captures.create(tenantId, stationId, image) . Today image cannot be expressed as a parameter of a JSON-RPC method, so that call has to live outside the bundle as a separate multipart controller. What you want is for the method to simply declare a parameter of type UploadedFile and get the file, like any other parameter. The solution: multipart as a transport adapter The key idea is to leave the core untouched. A multipart/form-data request is normalized into the very same JSON-RPC envelope an ordinary request produces, only with UploadedFile objects already sitting inside params . Everything below the transport - hydration, batching, validation - stays completely unaware of multipart, exactly the way it is unaware that a GET request's payload came from a query string. The wire format: one text part named jsonrpc carries the full JSON-RPC envelope as a string (all scalar par

I Tested 5 AI Engines On My Own Sites. None Agreed. In July I wrote that my open-source...

I'd already done a lot right by the time I started writing tests for Beaver-Auth . Every module had gone through multiple rounds of deliberate review. Enumeration protection, hashed tokens, refresh rotation, TOTP replay defense — the design was solid, and I knew it was solid, because I'd thought hard about every piece of it. Then I wrote 238 tests against the actual code, and found 8 real bugs. Some of them were the kind that would have silently broken production on day one. This post isn't about the bugs specifically — it's about the gap between "I reviewed this carefully" and "this is shippable," and why that gap is bigger than most of us assume, even when the reviewing was genuinely careful. "Passing tests" and "shippable" are different claims Here's the trap I nearly walked into: I'd built a solid test suite covering the core auth flows — registration, login, verification — and every test passed. It felt done. But passing tests only tell you the code does what the tests expect. If the tests were written from the same mental model as the code, they'll happily confirm a bug is correct behavior, because both the code and the test agree on the same wrong assumption. The fix wasn't "write more tests." It was testing against the real, integrated system — not a hand-built mock of my own logic, and not testing modules in isolation from what actually calls them. A few of the bugs below only surfaced because a test exercised the real dependency chain instead of assuming it worked. Bug 1: TypeScript let an argument-shift bug compile clean This is the one that scared me most. Beaver-Auth dispatches background work (like sending a verification email) through a TaskDispatcher interface: interface TaskDispatcher { dispatch ( taskName : string , payload : unknown , handler : () => Promise < void > , onFailure ?: ( error : unknown ) => Promise < void > | void , ): Promise < void > } The default implementation had drifted to a different signature — missing the payload parameter e

If you’ve ever tried to reconcile a night of sleep from an Oura Ring , a morning run from a Garmin watch, and active minutes from an Apple Watch , you know the "Dirty Data" struggle is real. Each platform has its own schema, its own definition of "active calories," and its own idiosyncratic export format. In the world of Data Engineering , this is a classic multi-source integration problem. But you don't need a massive Snowflake cluster to solve it. Today, we’re building a high-performance, serverless data pipeline to clean and normalize wearable data using DuckDB , dbt , and GitHub Actions . By leveraging a modern Serverless Data Pipeline and DuckDB's lightning-fast processing, we can turn a mess of CSVs into a structured Parquet -based personal data warehouse. The Architecture: From Chaos to Clarity Before we dive into the code, let’s look at how the data flows from your wearables to a clean, queryable state. graph TD A[Oura JSON] -->|Python Ingestion| D[(DuckDB Raw)] B[Garmin CSV] -->|Python Ingestion| D C[Apple Health XML] -->|Python Ingestion| D D --> E{dbt Models} E -->|Cleaning| F[stg_models] E -->|Normalization| G[int_health_metrics] G -->|Final Output| H[Gold Layer: Parquet Files] H --> I[Visualization / BI] subgraph GitHub Actions D E F G H end Prerequisites To follow along, you'll need: DuckDB : The "SQLite for OLAP" that makes local analytical processing insanely fast. dbt-duckdb : The adapter that lets dbt talk to DuckDB. GitHub Actions : Our free "orchestrator." Tech Stack : DuckDB, dbt, Python, Parquet. Step 1: The Ingestion Layer (Python + DuckDB) The first hurdle is getting disparate files (JSON, CSV, XML) into a unified storage format. DuckDB is magical here because it can query these files directly. We'll use a simple Python script to load these into a local .duckdb file. import duckdb def ingest_raw_data (): # Initialize the database con = duckdb . connect ( ' health_data.duckdb ' ) # Ingest Garmin CSV con . execute ( """ CREATE TABLE raw_garmin

The hard part of a fast-moving plugin ecosystem is rarely finding another project. It is deciding whether a project deserves a place in a working setup. DeepSeek Harness is a developer preview with a plugin-first architecture, and its surrounding ecosystem already includes interface extensions, vision tools, workflow helpers, terminal experiences, and desktop clients. Those projects can be useful, but an install command is not a review process. A plugin may execute with local permissions and interact with files, credentials, networks, or shell commands. That is why I prefer repository-first discovery. DSH Hub is a bilingual directory for DeepSeek Harness plugins and clients. Its rule is simple: every listed item must point to a publicly reachable GitHub repository. The goal is not to turn a catalog into a trust badge. The goal is to make the source, ownership, license, release history, and installation material easy to inspect before an extension enters a Harness profile. What the directory separates DSH Hub keeps clients and plugins in different groups. A plugin usually adds a narrow capability to a running Harness profile. A client can do more: package a runtime, provide its own update path, expose a network listener, or ship a bundle of extensions. That difference changes what needs review. If both are listed as the same kind of tool, it is easy to miss the extra surfaces a client can introduce. The August 18, 2026 catalog snapshot contains 19 plugins and 6 clients. Discovery starts with the official DeepSeek Harness repository, the GitHub dsh-plugin topic, and a community-maintained registry. Each selected repository is then checked for a clear, public connection to the ecosystem. A practical evaluation loop A short loop catches more than a long list of popularity signals: Run the official Harness first, so you understand the baseline behavior. Choose the single capability you actually need instead of adding a large bundle. Open the linked repository. Read its R

OpenAI has rolled out the GPT-5.6 family , introducing three models intended to cover advanced professional work, balanced deployments and high-volume workloads. The July 9, 2026 general-availability launch of Sol, Terra and Luna marks a significant step in OpenAI's effort to consolidate its model portfolio across ChatGPT and its API, while moving customers away from older GPT-4-era offerings. The company's official GPT-5.6 announcement positions the generation as a higher-performance foundation for the ChatGPT experience and API use cases involving agents and coding. Rather than presenting a single general-purpose release, OpenAI has divided the family into distinct options: Sol for advanced professional work, Terra for a balance of capability and cost, and Luna for cost-sensitive, high-volume tasks. That segmentation matters because model selection is becoming a deployment decision rather than simply a question of accessing the newest available system. Teams building production workflows need to weigh performance requirements, usage volume, migration work and the cost profile of each application. What the GPT-5.6 rollout changes The general-availability announcement was followed by a July 30, 2026 pricing update that reduced Luna pricing by around 80% and Terra pricing by around 20%. OpenAI also signaled the phase-out of older models , including GPT-4o and related GPT-4.x variants, as customers move toward GPT-5.x and GPT-5.6 offerings. Taken together, the launch and subsequent price adjustments show that the GPT-5.6 family is not only a model update. It is part of a broader product lifecycle shift . OpenAI's roadmap messaging has emphasized more unified experiences across ChatGPT and API surfaces, and the new family gives that strategy a clearer set of deployment tiers. Model Positioning July 30, 2026 pricing change Sol Flagship model for advanced professional work Not specified in the supplied research Terra Balanced option for capability and cost Reduced by aro

OpenAI is announcing security updates following the July news that its AI broke out of a sandboxed environment and accidentally hacked Hugging Face, including improvements to its research environments, monitoring, and alignment techniques. The company had already put the brakes on a new model, Astra, that it thinks could have "critical" cybersecurity capabilities, and the […]

How We Built a Safe GitHub Bounty Lifecycle for MyZubster MyZubster is evolving into a distributed ecosystem of repositories, services, automation, hardware projects, AI components, and contributor workflows. As the number of repositories and contributors increased, one problem became increasingly important: How do we automate bounty workflows without accidentally treating a GitHub event as proof of payment, verification, or settlement? We recently completed an important part of that architecture: a real-time GitHub bounty lifecycle system . And we tested it end-to-end. The lifecycle We use an explicit bounty lifecycle instead of assuming that an issue, pull request, or merge means a bounty has been completed. The lifecycle is roughly: text PROPOSED ↓ VALIDATED ↓ APPROVED ↓ FUNDED ↓ ACTIVE ↓ SUBMITTED ↓ UNDER_REVIEW ↓ VERIFIED ↓ REWARD_RECORDED ↓ SETTLEMENT_PENDING ↓ SETTLED The important part is that GitHub automation only controls a limited part of this flow. Today, GitHub can automatically move a bounty through: APPROVED ↓ assignment ACTIVE ↓ linked PR SUBMITTED ↓ review UNDER_REVIEW And then automation stops. GitHub Webhooks Across the Ecosystem We configured repository webhooks across 17 first-party MyZubster repositories. The subscribed events are: issues pull_request pull_request_review The central endpoint is: POST /api/github-bounties/webhook The backend is Node.js / Express and validates GitHub webhook signatures using: X-Hub-Signature-256 with an HMAC-SHA256 secret. Unsigned requests are rejected. For example: POST /api/github-bounties/webhook → HTTP 401 while valid GitHub webhook deliveries receive a normal application response. A Useful Production Bug: PM2 Had a Stale Secret One of the most interesting parts of the deployment was a real production debugging problem. GitHub was delivering webhook events correctly, but every delivery returned: 401 Unauthorized Cloudflare was healthy. The public API was healthy. The webhook route was healthy. GitHub delive

The ChatGPT maker says its upcoming Astra model may have reached “critical” cyber capabilities, prompting it to halt a significant number of training runs while it tightens internal safeguards.

The new safeguards include more detailed monitoring of models during the development process, as well as greater emphasis on alignment and security during the post-training process.

ChatGPT for Teens adds age-appropriate safety measures, parental controls, and learning tools designed to steer teens away from harmful content — and from using AI to cheat on their homework.

GitHub热门项目 | 🦋 An Infographic Generation and Rendering Framework, bring words to life with AI! | Stars: 6,357 | 221 stars this week | 语言: TypeScript

GitHub热门项目 | | Stars: 15,756 | 543 stars today | 语言: TypeScript

GitHub热门项目 | PipesHub is an open-source fully extensible AI context layer that unifies your business data for explainable enterprise search and agentic workflow automation. | Stars: 3,405 | 50 stars today | 语言: Python

GitHub热门项目 | Open-source, low-cost 10.5 GHz PLFM phased array RADAR system | Stars: 24,169 | 204 stars today | 语言: PLSQL