标签：#open

There's a lot of capital pouring into the business of giving models away.

GitHub热门项目 | Scalable CLI | Stars: 427 | 20 stars today | 语言: Rust

GitHub热门项目 | Python toolkit for quantitative finance | Stars: 12,772 | 25 stars today | 语言: Python

GitHub热门项目 | "AI-Trader: 100% Fully-Automated Agent-Native Trading" | Stars: 21,730 | 155 stars today | 语言: Python

GitHub热门项目 | Drop in a screenshot and convert it to clean code (HTML/Tailwind/React/Vue) | Stars: 75,295 | 309 stars today | 语言: Python

GitHub热门项目 | GitNexus: The Zero-Server Code Intelligence Engine - GitNexus is a client-side knowledge graph creator that runs entirely in your browser. Drop in a git repository (Github, Gitlab, Azure, Local) or ZIP file, and get an interactive knowledge graph with a built in Graph RAG Agent. Perfect for code exploration | Stars: 46,029 | 189 stars today | 语言: TypeScript

Sandhya Devanathan will oversee some OpenAI operations across Southeast Asia and Australia in her new role.

Last week OpenAI published its technical report on the Hugging Face incident, METR published an independent one, and the headlines turned it into "AI broke loose". It did happen. That part is real. But OpenAI is narrating its own security failure as a demonstration of capability, and most of the coverage took that version straight. I read the OpenAI post, the METR report and a few of the critical takes. Here is what I actually got out of it as someone who runs agents with tools every day. What happened, short version Between May and July 2026, agents in OpenAI's internal RL training and evaluation runs found a way to talk to each other through Artifactory, the package manager hosted inside their sandbox. They turned it into a message board. Through the same service they got outbound internet access via SSRF, because the package proxy legitimately needed to reach the internet to fetch packages. On July 4 the message board traffic took Artifactory down. Security rebuilt it, which wiped the board. Agents rebuilt it four days later by encoding messages into directory names. Then it escalated. An agent found publicly exposed Hugging Face tokens, shared them with the group, and the collective chained a couple of zero-days into code execution on Hugging Face workers. Around 1,200 agents, over 70,000 messages, code running on 41 Hugging Face servers, root on one of them. Hugging Face disclosed it on July 16. OpenAI admitted its models were behind it on July 21. Real incident, real zero-days, real third party affected. Nobody disputes that. Three things the headlines skip It was not a conspiracy of 1,200 minds. Those were parallel rollouts of the same model inside an evaluation, dropping files on a shared store with no authentication. The "secret message board" was directories in a package manager. Impressive as emergent behavior, much less impressive as a security event. It was not a plan, it was reward hacking. Out of 898 tasks in the ExploitGym benchmark, 198 had never be

GitHub热门项目 | Daily updated list of Tech Company OAs and Interview Problems. Save your time from finding them all over the internet. | Stars: 4,635 | 98 stars today | 语言: Python

I recently built and open-sourced Flaky HTTP , a small Java 11 library for deliberately making HTTP calls less reliable. That may sound like an unusual goal. Most of the time, we work hard to make HTTP calls reliable. We add retries, timeouts, circuit breakers, fallbacks, caches, and monitoring. But eventually we need to answer a more difficult question: How do we know any of that behavior actually works? The original idea was simple: wrap Java's standard HttpClient , add controlled latency or synthetic HTTP errors to selected requests, and leave the rest of the application unchanged. That simple idea led to a few interesting decisions around API design, asynchronous cancellation, response body handling, deterministic testing, and the boundary between application-level failure injection and real network chaos. This article goes beyond a launch announcement. I want to explain why I built the library, how it works internally, where it is useful, and where it is deliberately limited. TL;DR Flaky HTTP is a lightweight wrapper around Java 11's java.net.http.HttpClient . It can: add fixed or random latency; return synthetic HTTP errors with a configurable probability; target requests using a full-URI regular expression; handle synchronous and asynchronous calls; propagate cancellation for delayed asynchronous work; and run without runtime dependencies beyond Java 11. The Maven coordinate is com.tapadyuti:flaky-http:1.0.0 . The shortest useful test setup is a deterministic failure: FlakyConfig config = FlakyConfig . builder () . failureRate ( 1.0 ) . errorStatus ( 503 ) . build (); Every targeted call now returns an empty synthetic 503 response without reaching the network. Replace 1.0 with 0.0 and add LatencyStrategy.fixed(500) when the test should exercise slowness without an HTTP error. It is intended for integration tests, resilience tests, local development, and controlled demonstrations. It is not a replacement for a network proxy or a full chaos-engineering platform

GitHub Trending Digest — 28 Agustus 2026 Minggu ini, repo-repo di GitHub menunjukkan arah yang cukup jelas: AI agent menjadi semakin otonom dan ringan . Dari framework yang membuat agent berpikir hemat kode, hingga engine lokal untuk model MoE (Mixture of Experts) yang bisa berjalan di hardware apa pun, ekosistem open source terus mendorong batas apa yang mungkin dilakukan developer dengan sumber daya terbatas. Berikut rangkuman lima repository paling trending minggu ini. 1. deepseek-ai/deepseek-harness ⭐ 200.216 Bahasa: TypeScript DeepSeek Harness mengusung filosofi "Everything is a Plugin" . Repositori ini menawarkan kerangka kerja yang memungkinkan developer membangun pipeline AI secara modular, di mana setiap komponen—mulai dari preprocessing data, inference, hingga post-processing—dapat ditukar seperti lego. Dengan pendekatan berbasis plugin ini, tidak ada lagi lock-in ke satu library atau model tertentu. Mengapa repo ini trending? Karena komunitas sedang haus akan fleksibilitas. DeepSeek sendiri terus merilis model yang kompetitif dengan model besaran internasional, dan Harness memberi jalan bagi developer untuk mengintegrasikannya tanpa ribet. Use case praktis: Membangun sistem RAG (Retrieval-Augmented Generation) di mana Anda bisa mengganti embedding model, vector store, dan LLM backend tanpa mengubah logika inti aplikasi. 2. DietrichGebert/ponytail ⭐ 114.054 Bahasa: JavaScript Ponytail memperkenalkan pendekatan unik: membuat AI agent bersikap seperti "senior developer paling malas di ruangan" . Filosofi dasarnya sederhana—kode terbaik adalah kode yang tidak pernah kamu tulis. Ponytail mendorong agent untuk memaksimalkan reuse, meminimalkan boilerplate, dan menolak menulis ulang hal yang sudah ada. Trending karena resonansi budaya. Kalimat "the best code is the code you never wrote" langsung menyentuh pain point developer yang sering terjebak menulis ulang solusi yang sudah tersedia. Ponytail bukan sekadar tool, tapi semacam mindset yang dikodekan. Use case

God’s Eye View was the top project on GitHub Trending when we selected it for Jian AI Lab’s daily experiment. The pitch is immediately compelling. It brings aircraft, vessels, satellites, earthquakes, wildfire data, traffic, CCTV sources, and other feeds into one 3D globe. The repository also makes a serious effort to label data as live, modeled, reconstructed, or simulated. We tested commit b22573a9db28e47c324821ebdd4c67bdb241c0e1 on Linux with Node.js 24.19.0 and npm 11.9.0. Installation and security checks We first ran npm ci --ignore-scripts , reviewed the install-script sources, and then ran the normal npm ci . Both installations succeeded with 201 packages. The root project has no preinstall, install, or postinstall hook. Transitive install scripts come from esbuild, fsevents, Puppeteer, and sharp. npm audit --omit=dev reported no known vulnerabilities in production dependencies. A common secret-pattern scan did not find hard-coded live credentials. This is a limited check, not a full source audit. The project talks to many external services, including Google Maps, OpenAI, OpenSky, AISStream, NASA FIRMS, TomTom, CelesTrak, OSM, Open-Meteo, GDELT, and Radio Browser. It is local-first, but it is not offline. Server-side keys such as OpenAI and AISStream are read by the local Vite proxy. Google Maps and Cesium tokens are intentionally delivered to the browser. Users must restrict referrers and APIs and set provider budgets and quotas. 2,588 visible assertions passed The main test suite reported 2,587 passing assertions and zero failures. A separate focus-allocation check added one more passing assertion. The visible total was 2,588 passes and zero failures. The process did not exit after the summary. We waited more than 90 seconds and interrupted it manually. The final exit code was 130. The precise result is that all visible assertions passed, while the official test command did not complete with a clean exit in this environment. This may indicate an open handle

Your filesystem is already a database. Most tools just don't treat it that way. That's the core idea behind the Markdown Database Pattern — written up properly on The Way of Markdown , a site we've been contributing to that makes the case for building things on plain markdown instead of locked-in platforms. We think it's a pattern worth more attention, so here's the short version. Treat a folder of markdown files as a database. Each file is a record. Frontmatter fields are columns. Directories are tables. Tags, wikilinks, and tasks in the body become queryable relations. Filesystem Database ────────────────────────────────── markdown file → record frontmatter field → column directory → table #tag → tag relation [[wikilink]] → link relation - [ ] task → task relation You get portability, version control (git works perfectly on plain text), no framework lock-in, and full queryability. You give up scale and real relational joins — this isn't for millions of records. It's a lightweight database, honest about its limits. Once you name it, you start seeing it everywhere. Obsidian Bases and Dataview already do versions of this, half-consciously. A team wiki where every page has a status and owner field is one. A blog with date and tags in frontmatter is one — it just doesn't know it yet. Sweet spot: up to roughly 10k files. Past that, reach for a real database. Below it, this gets you almost everything a database gives you, at a fraction of the complexity, with none of the lock-in. The full writeup — the complete tradeoff analysis, a worked example with actual queries, how to implement it in a weekend, and the tool ( MarkdownDB ) that does it for you — is here: wayofmarkdown.com/markdown-database

GitHub热门项目 | A spy satellite simulator in your browser, except the data is real. Live open source spatial intelligence on a photorealistic 3D globe. | Stars: 7,705 | 1,984 stars today | 语言: JavaScript

Hey everyone! 👋 Finding reliable, free public APIs for side projects or learning is always a hassle because many listed APIs eventually go down or become paid. To solve this, I created Awesome Free APIs Live — an open-source, curated collection of 50+ free public APIs across AI, developer tools, security, and open data. ⚙️ How It Works Daily Health Checks: Powered by GitHub Actions , an automated script tests endpoints daily and updates live status badges. Zero Dead Links: Broken endpoints are flagged automatically so developers don't waste time debugging dead services. Categorized & Searchable: Clean, categorized UI hosted on GitHub Pages. ### 🔗 Links 🌐 Live Directory: shilpshakti.github.io/awesome-free-apis-live ⭐ GitHub Repository: github.com/ShilpShakti/awesome-free-apis-live Contributions are very welcome! If you know of any great free APIs, feel free to open a PR or check out the open issues on GitHub.

What is ZeroDroid? ZeroDroid is an open-source Android toolkit that exposes the radios, sensors and connected-device capabilities already present in a phone. GitHub: https://github.com/theabhishekchandra/ZeroDroid What problems does it address? The app contains 29 tools across five areas: Wireless: Wi-Fi, BLE, NFC, Bluetooth Classic and peer-to-peer connections RF and signals: IR, UWB, SDR-device detection and ultrasonic analysis Sensors: GPS/GNSS, QR analysis, device sensors and magnetic anomalies Network: USB inspection, cell-tower information and wardriving Security: tracker scanning, hidden-camera indicators, rogue-AP detection, network scanning and deauthentication indicators Architecture ZeroDroid uses Kotlin, Jetpack Compose, Material 3, MVVM, StateFlow, Hilt and Room. Services are lazy-loaded, and scanning begins only when the user starts a tool. Important limitations A smartphone cannot guarantee that it has found every camera, tracker, bug or network threat. Several detections are heuristic and may produce false positives or miss threats. Hardware availability also differs between Android devices. The project is intended only for education, defensive security and testing devices or networks you own or are authorized to assess. Feedback wanted I am looking for: Compatibility reports from different Android phones Feedback about permission handling False-positive reports Contributions, tests and documentation improvements Repository: https://github.com/theabhishekchandra/ZeroDroid

Zoph, who co-founded Thinking Machines Lab alongside Mira Murati and also served as the startup's CTO, led a brief stint at OpenAI and is now at Google.

The Linux Foundation has launched Akrites , an initiative intended to coordinate vulnerability discovery, remediation and disclosure for critical open-source software. The project arrives as AI-enabled vulnerability scanning changes the scale at which potential software flaws can be identified. Its central emphasis is not simply finding more issues, but getting fixes made upstream and patches deployed. Akrites is organized around a multi-stakeholder coalition that includes technology vendors, financial institutions and open-source foundations. The official Akrites open letter describes the effort under the message, “We All Depend on Open Source. We Will Defend It Together.” The initiative was launched on June 25, 2026 and is coordinated by the Linux Foundation. The publicly displayed letter includes organizations such as AWS, Anthropic, Chainguard, Cisco, Citi, Google, Microsoft and GitHub, JPMorganChase, IBM, NVIDIA and OpenAI, Endor Labs, Red Hat, the Rust Foundation, Sonatype, Vodafone and Zscaler. It also lists open-source groups including the Cloud Native Computing Foundation, OpenInfra Foundation, OpenJS Foundation, LF Energy, OpenSSF and the PyTorch Foundation. What Akrites is trying to change Akrites is focused on a practical security lifecycle: identifying vulnerabilities in critical open-source projects, helping drive remediation and handling disclosure. That focus matters because discovering a possible vulnerability is only an early stage of risk reduction. A finding has limited value if maintainers cannot address it, if the correction is not adopted upstream, or if downstream users do not deploy the available patch. The initiative therefore places upstream fixes and patch deployment at the center of its stated success measures. This is a meaningful distinction from approaches that judge progress largely by the number of vulnerabilities found or reports generated. The coalition combines several types of participants: Cloud, software and security vendors ,

Code reviewed by WIRED reveals the company is developing a feature that enables Codex to continue working proactively until it is “put to sleep.”

OpenClaw is the fastest-growing project in GitHub history. Peter Steinberger and several maintainers share what they learned in the project's first six months. The post OpenClaw went viral. Meet the maintainers building and securing it. appeared first on The GitHub Blog .