标签：#open

Kintara is a self-hosted document library and reader that runs in Docker and watches a folder you already have. Drop PDFs, Markdown, or text files into the directory and it indexes them automatically, extracts searchable text and metadata, generates thumbnails, and makes the whole library available through a browser or installable PWA. It has libraries, collections, tags, full-text search, highlights, favorites, reading progress, private library sharing, and GitHub OAuth. I have been working on Kintara for a few months, and the architecture actually changed pretty dramatically while I was building it. Kintara originally had a Tauri desktop shell, but I eventually realized that isn't what I wanted at all. So I ripped the desktop layer out and rebuilt it around one Rust server that serves both the API and frontend. Now I can point Kintara at a NAS folder and open the same library from my desktop, laptop, tablet, or phone. The thing I really love about this app is the optional AI features. I added an option to use OpenAI or Gemini, and with so few tokens being spent, it's a fraction of a cent to use most of them, aside from the cover image generation, which is bit more, but makes the library look so much prettier! 😄 Anyway, I wanted AI to be a tool inside the library rather than taking the thing over, and I wanted it to be fully optional, so if you're one of those "Ew, AI is in this app" people, you just don't turn it on and it's like it doesn't exist. What the AI can do is summarize documents, suggest metadata and fill in those blank spaces, generate cover images for docs that don't have a cover, search the library for docs, or you can just chat with it about your docs. Find is a pretty great AI feature I think. Instead of letting the model vaguely tell you that something appears "somewhere in the document," Kintara asks for actual passages with page numbers, verifies the quote against extracted page text on the server, then verifies it again against the rendered PDF.

GitHub热门项目 | VoiceStudio is the open-source, fully-local ElevenLabs alternative — voice cloning, voice design, video dubbing, dictation, transcription & audiobook creation in 646 languages. | Stars: 11,154 | 125 stars today | 语言: Python

At the first step, I picked up the SurrealDB project for contribution. I didn't know how I could help this project become better. So I asked my beautiful OpenCode to find parts of the project that could be better. It suggested this file of the project(core/src/val/value/get.rs) to me and said it has a double-cloning issue. So I opened up VS Code, and I started checking the issue. The code was something like this: let mut a = Vec :: new (); for v in v .iter () { let cur = v .clone () .into (); if stk .run (| stk | w .compute ( stk , ctx , opt , Some ( & cur ))) .await .catch_return () ? .is_truthy () { a .push ( v .clone ()); } } First Optimization: As you can see at line 3 and line 9, we have multiple clones from a single document. I thought about how I could fix this issue; I went to see the CursorDoc structure because the first clone is converted to it: #[derive(Clone, Debug)] pub ( crate ) struct CursorDoc { pub ( crate ) rid : Option < Arc < RecordId >> , pub ( crate ) ir : Option < Arc < IteratorRecord >> , pub ( crate ) doc : CursorRecord , pub ( crate ) fields_computed : bool , } impl From < Value > for CursorDoc { fn from ( val : Value ) -> Self { Self { rid : None , ir : None , doc : val .into (), fields_computed : false , } } } #[derive(Clone, Debug)] pub ( crate ) struct CursorRecord { /// The underlying record, shared via Arc for copy-on-write record : Arc < Record > , } impl CursorRecord { // .... // /// cloning. Otherwise the value is cloned. pub ( crate ) fn into_owned ( self ) -> Value { match Arc :: try_unwrap ( self .record ) { Ok ( record ) => record .data , Err ( arc ) => arc .data .clone (), } } // .... // } impl From < Value > for CursorRecord { fn from ( value : Value ) -> Self { Self { record : Arc :: new ( Record :: new ( value )), } } } I saw that the value passed through CursorDoc is directly stored in a field in CursorRecord without any changes, and it is accessible using .into_owned() from CursorRecord. That is the solution; I edited the

Most people's first experience with an LLM API is deceptively simple: send a prompt, get a reply. It feels like magic, and for a single question-answer exchange, it basically is. But the moment you try to build something that holds an actual conversation one where the model remembers what you said three messages ago you run into a problem that isn't obvious until you hit it: LLM APIs are stateless. Every request is a blank slate unless you explicitly hand the model its own memory. That was the core challenge behind a recent project I built during my internship a chatbot backed by a real LLM API ([OpenAI / Gemini]) with genuine multi-turn conversation support, not just a scripted request-response loop. * The problem nobody mentions upfront * You can't just "turn on" memory. Every conversation turn has to be manually tracked and resent with each new API call, which means the developer, not the model, is responsible for deciding what counts as context. And that decision has real consequences: send too little history and the bot forgets things it should remember; send too much, and you run into token limits and rising costs as the conversation grows. This is where most simple chatbot tutorials stop short. They show you how to get a reply from an API, but not what happens once a conversation runs long enough that you can't keep resending everything forever. * Where the actual engineering happens * Solving that meant implementing a context management strategy deciding what to keep, what to drop, and eventually exploring smarter approaches like summarising older parts of a conversation instead of just discarding them. It also meant thinking about the bot's identity through a system prompt, handling API failures gracefully instead of letting the UI break, and treating credentials properly by keeping API keys out of source code entirely. None of this is complicated in isolation. What's interesting is how much of it is invisible until you actually build the thing yourself. Us

Every open-source tool has the same brutal first 90 days: zero users, zero signal, no idea whether anything works. I have shipped several free CLI tools and browser tool sets. This is the exact funnel I use — no ads, no paid growth, no "build in public" theater. Just a repeating sequence of small, concrete actions. Step 1: Make the Tool Trivial to Try The first rule: npx must work. If a reader has to install, configure, and read a README before running the first command, the funnel is already broken. npx @wuchunjie/dotguard . That is the entire onboarding. Zero dependencies, no config, instant output. The first 10 seconds decide whether the reader comes back. Step 2: Publish One Article Per Angle Not one article. One per angle , spread over time: Tutorial — "Scan your .env files in 1 command" (the how) Comparison — "Why I stopped using X" (the why) Listicle — "5 tools for Y" (the discovery) Workflow — "My dev setup" (the context) Security/devops — "Your CI is missing this" (the fear) Each article targets a different search intent. A developer looking for "pre-commit secret scan" lands on article 4, not article 1. The funnel is wide because the angles are wide. Step 3: Cross-Link Everything Every article mentions every tool. The footer of a snippet article lists the scaffolder and the scanner. The GitHub repo links to the articles. The npm README links to the articles. The effect is compounding: a reader of article 3 meets four tools, not one. Your content becomes a network instead of a pile. Step 4: Make the GitHub Repo the Hub The repo README is the landing page that never goes stale: One-line description per tool Install/run commands (copy-paste ready) Links to every article A donation link, present but quiet GitHub is where developers actually trust. Stars and forks are the signal that converts "interesting article" into "let me try it". Step 5: Add the Quiet CTA One line at the end of every article: If this saved you time, a Ko-fi keeps the next tool coming. No

AWS has released aws-bench, an open-source benchmark for evaluating AI agents on real AWS tasks such as misconfigurations and infrastructure provisioning. Unlike traditional benchmarks, it uses real resources in disposable AWS accounts, scoring agent performance through automated verifiers. By Gianmarco Nalin

When I started GSoC in May, my plan was to build a runtime sandbox for community plugins. By week two my mentor had talked me out of it, and I ended up spending the rest of the summer building a review queue instead. This post is about how that happened and what I actually shipped. Quick summary Project: Community Driven Plugin Ecosystem for OWTF Org: OWASP Foundation Mentors: Abraham Aranguren, Viyat Bhalodia What got shipped: Six pull requests against owtf/owtf , around 6,000 lines of Python and TypeScript, 153 backend unit tests, and a trust model doc. Working mirror of this post: gist If you only want the code, here are all my PRs on OWTF . The problem I was trying to solve OWTF is a security testing framework, and until this summer its plugin catalogue was static. If you wrote a detection for some new attack pattern, your options were: open a PR against the framework itself (high bar, slow), or keep the plugin to yourself. Most useful plugins never made it upstream because of that. The Community Plugin Marketplace fixes this. Any authenticated user can upload a Python plugin through the web UI. The plugin is validated at upload time, lands in a pending queue, and waits for an admin to look at the source. Once approved, the plugin gets mirrored into OWTF's standard plugin table. From that point on, the runner, the worklist, and the report generator all treat it exactly like a built-in plugin. The pivot My accepted proposal called for a sandbox. Community plugins would run inside something like a subprocess with dropped privileges, so that a malicious plugin could not do too much damage. Then Viyat said this in Slack: A sandbox in Python that talks to the same postgres, the same file system, the same target scope as OWTF itself is not really a security boundary. I sat with that for a couple of days and realised he was right. A plugin that runs inside OWTF has to see the target, has to read config, has to write results. Any "sandbox" I put around that is going to

I ran a penetration test on my own infrastructure last week. No Burp Suite, no exploit fired at production, no CVE popped. The whole engagement came down to one habit: refusing to believe a control was working until I had watched it work. The target is a small observability hub I built for my own AI-assisted coding. Six services in one compose file: a tunnel, an OpenTelemetry Collector taking metrics and logs from Claude Code, Prometheus, Grafana, Loki, and a status API. The public surface is three aggregate numbers. Everything else stays private. That boundary, three numbers out and nothing else, was the whole thing I was testing. The word "pentest" carries a picture that does not match, so: no attack traffic at the live system. The platform bills by usage and there is a WAF in front, so a flood of probes would have cost money and poisoned its own results. What I did was a read-only audit of the code and config, plus a dynamic run against the whole stack brought up locally in Docker. I expected the findings to cluster around the parts nobody had looked at. They did the opposite. Nearly every serious defect sat inside a control written days or hours earlier, usually by me, usually with a comment beside it naming what it protected against. Old code has been observed: it has run against real traffic and somebody has been surprised by it. A defence written yesterday has only been reasoned about, which feels like the same thing and is not. "Independent" is a measurement, not a comment The privacy boundary is an allow-list rather than a deny-list, and that part was right. Claude Code was measured sending five identity attributes, user.email among them carrying a real address, and no flag turns them off. A delete_key for each works until the client adds a sixth, and this telemetry is beta: its attribute set is not a contract. - context : resource statements : - keep_keys(resource.attributes, ["service.name"]) - set(resource.attributes["service.name"], "claude-code") The s

Tu agente de código lee tu workspace. Un archivo envenenado en cualquier rincón puede llevar instrucciones que el agente ejecuta. ¿Sabes qué fracción de tu workspace tiene que leer para que eso ocurra? topowatch mide eso. El problema no es el prompt, es la topología El paper Workspace Topology as an Attack Vector in Agentic Coding Assistants (arXiv:2608.14876, Day et al., 2026) demostró algo que intuíamos pero no medíamos: la topología del workspace afecta mediblemente el Attack Success Rate (ASR) de la inyección indirecta. Los entornos altamente modulares muestran ASR significativamente menor que los planos. La razón es mecánica: si el agente acota su lectura al módulo de la tarea, nunca llega al archivo envenenado. Si hace un wide read de todo el workspace, lo lee siempre. Qué es topowatch topowatch es una herramienta de línea de comandos que, dado un workspace, mide el ASR de una inyección indirecta de referencia bajo varias configuraciones de topología, y reporta qué estructura minimiza el ASR. Fundamentado en arXiv:2608.14876. Determinista y reproducible sin claves ni red: usa un agente sintético configurable y un fixture con tres topologías (monolito, modular, nesting profundo). pip install -e ".[test]" topowatch --json Resultados Sobre el fixture de referencia (200 trials, semilla fija): Topología ASR % leído Monolito (plano) 1.000 100% Modular (acotado) 0.000 28.5% Nesting profundo 0.000 66.6% El reporte incluye read_budget (fracción del workspace que lee el agente) y el veredicto del defense contract: modular < monolito . Honestidad sobre v0.1 v0.1 usa un agente sintético , no un coding assistant real (Claude Code / Codex). El claim "modularidad → ASR menor" está anclado al fixture reproducible, no a una medición contra un assistant real — eso es v0.2 (feature 002). El objetivo de v0.1 es darte una herramienta para medir y recomendar modularidad, no simular un ataque completo. Roadmap v0.2 : medición contra coding assistants reales (sandbox, sin credenciale

For three years, the biggest complaint about Mojo was not the syntax, the performance claims, or the missing ecosystem. It was that the compiler was closed. You could read the standard library, you could file issues, but the thing that turned your code into GPU machine instructions was a binary you had to download on faith. For a language whose creator, Chris Lattner, built his reputation on LLVM and Swift, two of the most open projects in compiler history, that sat badly with a lot of developers. Then came the strangest possible sequence. Qualcomm announced an all-stock acquisition of Modular on June 24, 2026, valued around $3.92 billion at announcement. The deal closed at the end of July. Mojo hit version 1.0 the following week. And on August 18 at ModCon, Modular open sourced the entire compiler and toolchain under Apache 2.0 with LLVM exceptions. A chip company bought the language, and only then did the source drop. The Hacker News thread reached 409 points, and the reaction splits into two camps that basically never overlap: people who say "finally, I can try this," and people who say "too late, the window closed." Both are worth listening to, because the honest answer to whether Mojo matters now depends on what you actually do with Python. What Actually Got Released The whole toolchain, not a teaser. The modular repository on GitHub now contains the Mojo compiler, the tooling, and everything needed to build the language from source. One command builds the compiler and runs a Mojo file against it: ./bazelw run --config = build-mojo KGEN:mojo -- run hello.mojo That is a real bar to clear. This is not "source available with a look-but-do-not-touch license." Apache 2.0 is the same license family as the rest of the LLVM world, and the LLVM exceptions expand what you can do with distributed binaries. You can fork it today if you want. But not contributions, yet. The announcement is explicit: Modular is not accepting contributions to the compiler and tooling right no

GitHub热门项目 | 📚 Lista de libros sobre programación en Español y gratis | Stars: 5,763 | 23 stars today | 语言: TypeScript

So I've been using OpenCode for a while now, and it's pretty cool. It's clean, minimal, effective, and not hacking other companies with rogue AI bots 😅. But there is one thing that I dislike about all of these AI tools besides people using them wrong: it's all 1 prompt, 1 agent at a time. Even with these new crazy models such as Kimi K3, Claude Fable 5, GPT Sol, DeepSeek V4 Pro, and the list goes on, having reliable workflows/pipelines is the best way to use AI effectively. Even these models that seem to be the "best" have pretty major flaws. Whether it is hardly speaking in an understandable way or just lying to your face, AI can be pretty annoying. I mean, they literally have "peak hours" and then "dumb hours" depending on the time zone. All of these are reasons why I just built an open-sourced project to fix this. A little while ago, I discovered node-based workflows. Like I said earlier, using one agent one prompt at a time felt super unproductive, so I was inspired to fork OpenCode's harness and create my own twist on it. It still follows the concept of BYOK keys and using any provider you want, but instead of simply prompting, you build a workflow that you can easily save to reuse over and over again. How it works is you create a card for an agent, specify their role (planner, architect, coder, etc), and connect them to another agent or a chain of agents. Now it's not just Opus 5 doing everything, but every agent having a designated role and working together. You can make it as simple or complex as you want, and fork it so that it fits your needs. That's all I have to say. I am still working on it and constantly improving it. Feel free to fork it and make it your own as well, and I hope that this tool levels up how you use AI. Link: https://github.com/SeeRay11/OpenFlow

Taking the right medication at the right time is more than just a routine—it's a critical part of healthcare. However, for the elderly or those with complex prescriptions, "pill fatigue" is real. Mistakes happen. In this tutorial, we are diving deep into Computer Vision , Edge AI , and IoT to build a real-time pill identification and reminder system. We will leverage YOLOv8 for multi-pill detection and semantic segmentation, deploy it on a Raspberry Pi , and use MQTT to trigger physical alarms or notifications. Whether you are looking to master real-time object detection , explore embedded AI implementation , or build a life-saving IoT device , this guide has you covered! The Architecture: From Vision to Action 🏗️ The system follows a classic Edge-to-Cloud (or Edge-to-Local) pattern. The Raspberry Pi acts as the brain, processing image frames locally to ensure privacy and low latency. graph TD A[Raspberry Pi Camera] -->|Video Stream| B[OpenCV Preprocessing] B --> C{YOLOv8 Engine} C -->|Detection/Segmentation| D[Logic Layer: Check Schedule] D -->|Match/Mismatch| E[MQTT Broker] E -->|Publish Topic| F[Physical Alarm / Buzzer] E -->|Status Update| G[Mobile App/Dashboard] D -->|Log Data| H[Local Database] Prerequisites 🛠️ To follow along, you'll need: Hardware : Raspberry Pi 4B/5 (8GB recommended), Camera Module (V2 or HQ). Tech Stack : YOLOv8 : For state-of-the-art segmentation and detection. OpenCV : For image manipulation. Paho-MQTT : For the messaging protocol. Ultralytics : The framework powering our model. Step 1: Training the YOLOv8 Segmentation Model While YOLOv8 is famous for object detection, we use Semantic Segmentation here to precisely calculate the area and shape of pills, which helps distinguish between very similar-looking tablets. from ultralytics import YOLO # Load a pretrained model model = YOLO ( ' yolov8n-seg.pt ' ) # Train the model on our custom pill dataset # Assume we have a 'pills.yaml' defining classes: 'aspirin', 'vitamin_c', etc. results = mo

Nvidia continues to pour money into data center development — just as AI data centers bring lots of money into Nvidia.

GitHub热门项目 | Community recipes for serving LLMs on RTX 3090/4090/5090 CUDA gpus. Multi-engine (vLLM, llama.cpp, ik_llama) and model-agnostic. Currently shipping Qwen3.6-27B Qwen3.6 35B Gemma 4 26B Gemma 4 31B configs for 1× and 2× cards. | Stars: 2,048 | 102 stars this week | 语言: Python

GitHub热门项目 | Developer Control Plane for your AI Agents | Stars: 5,332 | 64 stars today | 语言: Rust

GitHub热门项目 | BookOrbit: Your Reading Space | Stars: 2,675 | 82 stars today | 语言: TypeScript

GitHub热门项目 | A collection of projects designed to help developers quickly get started with building deployable applications using the Claude API | Stars: 17,504 | 20 stars today | 语言: TypeScript

GitHub热门项目 | A coding-agent skill for multi-phase security audits with independently verified, machine-readable findings | Stars: 3,004 | 29 stars today | 语言: JavaScript

GitHub热门项目 | Salesforce's curated collection of agent skills for building applications. Optimized for Agentforce Vibes, compatible with all AI tools. | Stars: 890 | 44 stars today | 语言: Python