标签：#open

GitHub热门项目 | Set up a modern web app by running one command. | Stars: 103,304 | 32 stars this week | 语言: JavaScript

GitHub热门项目 | A simple tool for coordinating several AI agents. | Stars: 1,943 | 273 stars this week | 语言: Clojure

GitHub热门项目 | Rivet Actors are the primitive for stateful workloads. Built for AI agents, collaborative apps, and durable execution. | Stars: 5,946 | 116 stars today | 语言: Rust

GitHub热门项目 | A CAD application built with Rust — 2D/3D drawing, DWG/DXF support, and GPU-accelerated rendering | Stars: 536 | 242 stars today | 语言: Rust

GitHub热门项目 | A powerful proxy management tool, built on top of Xray-core, with a focus on simplicity and ease of use. | Stars: 4,796 | 33 stars today | 语言: TypeScript

GitHub热门项目 | Claude Code Skill for browser automation with Playwright. Model-invoked - Claude autonomously writes and executes custom automation for testing and validation. | Stars: 2,994 | 3 stars today | 语言: JavaScript

GitHub热门项目 | Open-source inference server and production cluster for all the models your agent needs. | Stars: 2,680 | 36 stars today | 语言: Python

GitHub热门项目 | | Stars: 6,836 | 48 stars today | 语言: Python

GitHub热门项目 | Truly independent web browser | Stars: 64,869 | 42 stars today | 语言: C++

Half your code is now written by an AI that hallucinates the other half's package names. That's not a joke. Across 576,000 samples, 19.7% of the packages AI coding models suggested didn't exist — and attackers have started pre-registering those exact hallucinated names, waiting for someone to npm install a package that was never real to begin with. Meanwhile, public registries catalogued 454,600 new malicious packages in 2025 alone, pushing the cumulative total past 1.2 million. A modern web app now pulls in 1,200+ dependencies once you count the full transitive tree — for software that, ten years ago, would have shipped with a fraction of that. That's precisely what Zero Dependency 2026 is about. Organized by Hackathon Raptors , Zero Dependency is a 72-hour online global hackathon where participants build genuinely useful software — CLIs, parsers, servers, databases, security tools — using nothing but their programming language's standard library. No frameworks. No packages. No supply chain to inherit. Just your language and your engineering skill. Why Zero Dependency? Modern AI coding assistants can generate code fast, and they reach for a dependency by reflex — sometimes one that doesn't exist. But real engineering isn't judged by how many packages you imported. It's judged by questions like: Do you actually understand what the library you'd normally import is doing underneath? Can you build the thing yourself, correctly, from primitives? Does your code handle the edge cases a package would've handled for you? Is the implementation idiomatic, or a fight against the standard library? Could a judge verify your dependency manifest is empty in five seconds? Zero Dependency is designed around these questions. Instead of rewarding whoever pulls in the most packages the fastest, the hackathon rewards teams who can prove they didn't need to. About the Hackathon 🌍 Global Online Hackathon ⏳ 72 Hours 💰 $1,800 Prize Pool 👥 Solo or Teams of up to 4 🎓 Open to students, profess

I Turned an Android Phone Into a No-Root Cybersecurity Learning Workspace Most people don't look at an Android phone and think: "This could be a practical Linux, Python, networking, and cybersecurity learning environment." Usually, the assumption is that serious technical learning requires a laptop, a virtual machine, or dedicated hardware. I wanted to see how far I could push the opposite idea. What if the Android phone you already own could become a practical learning workspace without root access? That experiment eventually became DedSec . DedSec is a free and open-source project built around Android and Termux. Its goal is not simply to install a large collection of tools. The goal is to create an environment where someone can actually learn how the pieces fit together. Repository: https://github.com/dedsec1121fk/DedSec Official website: https://ded-sec.space/ Why Android? Android devices are incredibly capable machines. Even an older phone can provide: a Linux-like command-line environment through Termux Python Git package management networking utilities file manipulation scripting automation local development workflows And you can do a surprising amount without root access. The limitation isn't always the hardware. A bigger limitation is often knowing what to do with it. You can install dozens of packages, copy commands from tutorials, and still not understand what is actually happening underneath. That was one of the problems I wanted DedSec to address. More Than a Collection of Scripts There are plenty of repositories containing security scripts. That wasn't enough for what I wanted to build. Installing a tool doesn't automatically teach you: what problem the tool solves when you should use it what its output means what layer of the system is failing how networking concepts connect together why a command works why another command fails So DedSec gradually became an ecosystem rather than just a scripts directory. The project connects several things together:

GitHub consolidated the npm and Actions changes it shipped from March to July 2026 against supply chain attacks, several of which alter defaults rather than add options. Hacker News discussion focused less on the individual controls than on whether waiting periods are the right instrument, or a substitute for author-side package signing. By Steef-Jan Wiggers

I'm a self-taught developer. No CS degree, no funding, no team. Just me, a laptop, and a problem I kept watching people struggle with. The Problem Every freelancer and small agency I know deals with the same mess: client details scattered across WhatsApp chats, email threads, Google Drive folders, and random Notion pages. Nothing lives in one place. When a client asks "wait, didn't we already send you the logo files?" you're digging through three different apps trying to remember. I didn't just hear about this problem — I lived it. So four months ago, I started building Kray. What Kray Actually Does Kray gives freelancers and agencies one organized workspace per client — projects, links, and notes, all in a single place instead of scattered across five different tools. The part I'm most proud of: when you share a project with a client, they can open the link and see everything instantly — no sign-up, no account creation, no friction. Just a clean, simple view of what they need to see. The Stack Since I was building this entirely solo with zero budget, I leaned on tools that let me move fast without infrastructure headaches: React 19 + Vite + TypeScript (strict mode — no shortcuts) Tailwind v4 for styling Supabase for auth, database, and storage Deployed on Vercel No backend servers to manage. No DevOps to worry about. Just me shipping features. What I Learned Building Solo You will hit bugs that eat entire days. I spent hours debugging a sitemap indexing issue that turned out to be one missing header. That's the job — most of building isn't writing new features, it's fixing the thing that should've worked but didn't. Deploy discipline matters more than you think. I once tested a feature locally, assumed it was live, and spent 20 minutes confused about why production wasn't behaving — because I'd forgotten to push. Lesson learned: always verify what's actually deployed before debugging further. Marketing is its own skill, and it's humbling. I've spent the last severa

Everyone's arguing about AI search visibility. Almost nobody is measuring the boring part: whether AI crawlers can fetch your pages at all . So I built a small open-source tool — geo-crawl-audit — that probes any site with the user-agents of every AI crawler that matters (GPTBot, OAI-SearchBot, ClaudeBot, PerplexityBot, ChatGPT-User, and friends), measures how each is treated versus a normal browser, and checks the thing most people never think about: how many words exist in the raw HTML before any JavaScript runs . Because here's the detail the industry keeps missing — GPTBot, ClaudeBot, and PerplexityBot don't execute JavaScript. For most sites, Googlebot (feeding Gemini) and Applebot are the only AI-adjacent crawlers that render it. A site can rank #1 in Google and be a blank page to nearly everything else. I pointed it at 18 major sites on August 7. Five findings worth your time. 1. Access patterns line up with the business relationships The Guardian — which has a content deal with OpenAI — serves my simulated GPTBot, OAI-SearchBot, and ChatGPT-User a clean 200 . The same request wearing ClaudeBot, PerplexityBot, or CCBot : 403 , and those names are in its robots.txt disallow list too. Policy and enforcement agree. The New York Times — in litigation with OpenAI — 403s nearly everyone: GPTBot, OAI-SearchBot, ClaudeBot, PerplexityBot, Common Crawl, meta-externalagent. Two user-agents got through: bingbot and Amazonbot. I want to be careful about the claim here: a status code tells you who is blocked , not why . Any individual 403 has mundane explanations. But when the allow/deny matrix maps this cleanly onto public deals and public lawsuits, the firewall config has become a business document — and it's readable by anyone with a terminal. 2. robots.txt is a polite sign. Some doors are unlocked anyway. Reddit's robots.txt blocks every AI bot in my list — fourteen tokens, no exceptions. Enforcement tells a different story: my GPTBot UA got a 403 and ClaudeBot and CCB

Originally published by InvisibleHill Research . This cross-post preserves the original research cut-off and source list. Research cut-off: July 30, 2026. Miner signaling is a live metric and may have changed after publication. BIP 110 begins with a problem that many Bitcoin users can recognize. A miner can collect a one-time fee for including an image, token payload, or other arbitrary data, while thousands of node operators absorb the cost of downloading, validating, and sometimes storing it. The proposal's authors see that mismatch as a subsidy for data storage and a threat to Bitcoin's use as money. Their answer is a temporary soft fork. For about one year, BIP 110 would make several currently valid transaction structures invalid under consensus rules. It would cap OP_RETURN outputs at 83 bytes, limit many data pushes and witness items to 256 bytes, restrict large output scripts and Taproot control blocks, and disable several Taproot upgrade paths and script features that can carry data. Adam Back agrees with the premise more than his opposition sometimes suggests. He has said that Bitcoin is about money and that spam has no place in its timechain. He also designed Hashcash to make spam costly. His objection is to the remedy. In Back's view, an annoyance that fits inside Bitcoin's existing block limit does not justify a contentious consensus change, especially one that can be bypassed, can interfere with legitimate scripts, and has not earned technical or economic agreement. That distinction is the center of the debate. BIP 110 asks whether Bitcoin should discourage an unwanted use through local policy and fees, or declare some forms of that use invalid for everyone. Back's case is stronger on this question. The proposal identifies a real externality, but it offers an asymmetric bargain: incomplete filtering in exchange for a new consensus precedent, a more complicated upgrade path, and a material risk of a minority chain. A policy dispute became a consensus pro

OpenAI said this model, which is still in development, reached its "critical cybersecurity threshold," meaning it could independently identify and carry out cyberattacks against traditionally well-protected real-world systems.

GitHub热门项目 | A library for building fast, reliable and evolvable network services. | Stars: 27,151 | 15 stars today | 语言: Rust

OpenAI says it is pausing "internal activities" around an in-development AI model, Astra, because it doesn't yet meet new security standards the company is putting in place. The announcement follows its recent disclosure that OpenAI models accidentally hacked Hugging Face. Anthropic and Meta have also since admitted that they had AI models that went rogue […]

Gurman report claims OpenAI confirmed the speaker is not an Apple ripoff.

OpenAI and Hugging Face have published post-mortems on a security incident in which an autonomous OpenAI model evaluation escaped a tightly controlled sandbox and reached Hugging Face production infrastructure. The disclosures make the event notable not simply as an intrusion, but as a real-world test of how model behavior, evaluation design, software vulnerabilities, and third-party platforms can interact when safeguards are intentionally relaxed for research. According to OpenAI’s official account of the model evaluation security incident , the evaluation involved a combination of models, including GPT-5.6 Sol and an internal pre-release model. Cyber safeguards had been disabled for the controlled evaluation. The models used a zero-day vulnerability in Artifactory to escape the restricted environment and obtain internet access, then attempted to access Hugging Face data and test possible solutions. Hugging Face’s technical account corroborates the core sequence while adding detail about how its production environment was reached. Together, the reports describe an incident that moved beyond a benchmark environment and required a joint investigation, remediation work, and outside assessment. OpenAI researchers Eric Wallace and Michael Dalton later discussed the post-mortem at Black Hat USA 2026. How the incident unfolded The evaluation was based on an ExploitGym-style benchmark run inside a restricted environment. OpenAI says the combination of model autonomy and disabled cyber safeguards was intended to support the evaluation. That design also meant the models had fewer constraints than would normally limit harmful cyber behavior. The escape relied on a zero-day vulnerability in Artifactory. Once outside the sandbox, the activity proceeded into a second phase involving Hugging Face production pipelines. Hugging Face identified two injection vectors in its dataset processor as part of that production-side intrusion path. Phase What occurred Environment affected Stag