标签：#opensource

One of the most useful questions in network troubleshooting is also one of the simplest: Does it fail from another machine too? If a website will not load on my laptop, trying it from another computer can immediately change the investigation. If it works there, the service probably is not down. Something about my machine, DNS configuration, VPN, firewall, route, or network path is different. If it fails there too, the problem may be farther upstream. I wanted Network Doctor to be able to ask that question directly. So I added remote diagnosis over SSH. netdoc --via ideapad github.com Instead of running the diagnosis locally, Network Doctor connects to ideapad , runs the checks there, and reports the result back on my machine. Why another vantage point matters A network failure is always observed from somewhere. Suppose github.com is unreachable from my workstation. I can test DNS: dig github.com Then TCP: nc -vz github.com 443 Then TLS: openssl s_client -connect github.com:443 Maybe I inspect my routes, VPN, proxy settings, or firewall. Those tests are useful, but they all share one property: they are observing the network from the same machine. Trying the same destination from another machine gives me a new piece of evidence. Imagine this: Thelio: DNS PASS TCP 443 FAIL Ideapad: DNS PASS TCP 443 PASS TLS PASS HTTPS PASS That difference is interesting. GitHub clearly is not universally unreachable. The second machine just reached it. Now I have a much smaller problem to investigate: what is different about the path from Thelio? That is often more useful than running another five commands on Thelio. Turning that into a command Network Doctor already runs network checks as a dependency graph. For an HTTPS target, for example, it can test things such as the local interface, DNS resolution, TCP connectivity, TLS, HTTP, routing, and path MTU. Normally: netdoc github.com means: Diagnose github.com from this machine. With --via : netdoc --via ideapad github.com it becomes:

If you are a woman in tech who is stuck in "tutorial hell," constantly taking courses but never actually deploying real software, this is for you. I am Mary Macharia, a Software Engineer specializing in Backend Development, AI/ML, and QA. I founded SHEinnov8 because I noticed a massive gap in our community: plenty of brilliant women have the drive to build something real, but they lack the space, the collaborative structure, or the network to actually push it across the finish line. We are changing that. What is SHEinnov8? SHEinnov8 is a decentralized digital guild built specifically for female developers, product designers, and tech creators. We operate on a simple framework: We learn by doing, we build together, and we do not stop until we ship a finished product. What We Are Currently Hacking On Right now, our guild is building an intensive AI Multilingual Project . We are engineering scalable backend infrastructures, orchestrating multi-language AI pipelines, and building deep automated QA suites to break the code and make it smarter. Why You Should Join the Guild Real Production Experience: Skip the basic todo-list apps. Work on raw, complex, collaborative codebases that you can proudly put on your resume. Founder Ecosystem: Meet fellow technical founders, bounce ideas off each other, and turn raw concepts into real tools. End-to-End Ownership: Learn what it actually takes to push code through CI/CD pipelines, configure metadata, handle security/QA audits, and go live. Let's Build Something Together! We are actively looking for software engineers, QA professionals, AI/ML enthusiasts, and designers who are ready to build, learn, and ship. Drop a comment below with your core tech stack, what you're passionate about building, or simply ask a question. Let's connect and get you plugged into the guild! Or check out our workspace directly at [sheinnov8.vercel.app]

AI coding agents are getting very good at writing code. They can build components, create APIs, fix bugs, and implement features from short prompts. But I kept noticing one issue: Working code does not always mean a good product. For example, if you ask an agent: “Add a delete button to every project.” It may technically do exactly that. But will it also think about: confirmation before deletion error handling undo options accessibility clear feedback to the user Those are not just coding problems. They are product judgment problems. That led me to experiment with a reusable instruction layer for AI coding agents at AudranLab. The idea is simple: Instead of only asking an agent, “Can you build this?”, also encourage it to ask, “Is this a good way to build it?” I want agents to consider things like accessibility, failure states, destructive actions, usability, and sensible defaults while they work. This does not magically turn an AI into a product designer. But I think it raises an interesting question: Can explicit product principles consistently improve the quality of software generated by coding agents? That is what I’m currently exploring. My next step is to test the approach across different coding tasks and compare the results with and without the additional product-judgment layer. If you’re interested in AI agents, LLM reliability, developer tools, or applied AI, I’ll be sharing more experiments here. AudranLab: https://www.audrantechlab.online/

How to run internal phishing simulations for your organization (free & self-hosted) Phishing is still how most breaches start. The single most effective defence isn't another mail filter — it's people who can spot a lure and report it. The way you build that instinct is internal phishing simulations : controlled, authorized fake-phishing tests of your own employees, paired with training the moment someone slips. This is a practical guide to doing that well — and doing it for free, on your own infrastructure, with an open-source tool. First rule: authorization, always Internal phishing simulation means testing people who have agreed to be tested — your own organization, or a client with a signed engagement scope. Point a phishing tool at anyone outside that and you're very likely breaking the law. Keep a record of your authorization, tell leadership and (per your policy/works-council rules) employees that a program exists, and never use captured data for anything but the training exercise. Good tools are built as trainers , not credential-harvesters — for example, they don't store the passwords people type into a fake login page by default. With that ground rule set, here's what a real program looks like. A good program is a loop, not a single test "Who clicked?" is where most free tools stop. A program that actually reduces risk runs four stages: Attack — send a believable lure and track engagement per person. Report — make it one click for employees to report suspicious mail, and give them credit when they do. Train — the moment someone clicks or submits, teach them what they missed. Measure — roll it all up into a human-risk score you can trend over time. You can assemble this from separate tools, or use one platform. Below I'll use VoltPhish , an open-source, self-hosted platform that does the whole loop from one Docker container. (If you only need email click-tracking, GoPhish is the classic minimal option; commercial suites like KnowBe4 or Proofpoint do all of

GitHub热门项目 | Scalable CLI | Stars: 427 | 20 stars today | 语言: Rust

GitHub热门项目 | Python toolkit for quantitative finance | Stars: 12,772 | 25 stars today | 语言: Python

GitHub热门项目 | "AI-Trader: 100% Fully-Automated Agent-Native Trading" | Stars: 21,730 | 155 stars today | 语言: Python

GitHub热门项目 | Drop in a screenshot and convert it to clean code (HTML/Tailwind/React/Vue) | Stars: 75,295 | 309 stars today | 语言: Python

GitHub热门项目 | GitNexus: The Zero-Server Code Intelligence Engine - GitNexus is a client-side knowledge graph creator that runs entirely in your browser. Drop in a git repository (Github, Gitlab, Azure, Local) or ZIP file, and get an interactive knowledge graph with a built in Graph RAG Agent. Perfect for code exploration | Stars: 46,029 | 189 stars today | 语言: TypeScript

Last week OpenAI published its technical report on the Hugging Face incident, METR published an independent one, and the headlines turned it into "AI broke loose". It did happen. That part is real. But OpenAI is narrating its own security failure as a demonstration of capability, and most of the coverage took that version straight. I read the OpenAI post, the METR report and a few of the critical takes. Here is what I actually got out of it as someone who runs agents with tools every day. What happened, short version Between May and July 2026, agents in OpenAI's internal RL training and evaluation runs found a way to talk to each other through Artifactory, the package manager hosted inside their sandbox. They turned it into a message board. Through the same service they got outbound internet access via SSRF, because the package proxy legitimately needed to reach the internet to fetch packages. On July 4 the message board traffic took Artifactory down. Security rebuilt it, which wiped the board. Agents rebuilt it four days later by encoding messages into directory names. Then it escalated. An agent found publicly exposed Hugging Face tokens, shared them with the group, and the collective chained a couple of zero-days into code execution on Hugging Face workers. Around 1,200 agents, over 70,000 messages, code running on 41 Hugging Face servers, root on one of them. Hugging Face disclosed it on July 16. OpenAI admitted its models were behind it on July 21. Real incident, real zero-days, real third party affected. Nobody disputes that. Three things the headlines skip It was not a conspiracy of 1,200 minds. Those were parallel rollouts of the same model inside an evaluation, dropping files on a shared store with no authentication. The "secret message board" was directories in a package manager. Impressive as emergent behavior, much less impressive as a security event. It was not a plan, it was reward hacking. Out of 898 tasks in the ExploitGym benchmark, 198 had never be

GitHub热门项目 | Daily updated list of Tech Company OAs and Interview Problems. Save your time from finding them all over the internet. | Stars: 4,635 | 98 stars today | 语言: Python

I recently built and open-sourced Flaky HTTP , a small Java 11 library for deliberately making HTTP calls less reliable. That may sound like an unusual goal. Most of the time, we work hard to make HTTP calls reliable. We add retries, timeouts, circuit breakers, fallbacks, caches, and monitoring. But eventually we need to answer a more difficult question: How do we know any of that behavior actually works? The original idea was simple: wrap Java's standard HttpClient , add controlled latency or synthetic HTTP errors to selected requests, and leave the rest of the application unchanged. That simple idea led to a few interesting decisions around API design, asynchronous cancellation, response body handling, deterministic testing, and the boundary between application-level failure injection and real network chaos. This article goes beyond a launch announcement. I want to explain why I built the library, how it works internally, where it is useful, and where it is deliberately limited. TL;DR Flaky HTTP is a lightweight wrapper around Java 11's java.net.http.HttpClient . It can: add fixed or random latency; return synthetic HTTP errors with a configurable probability; target requests using a full-URI regular expression; handle synchronous and asynchronous calls; propagate cancellation for delayed asynchronous work; and run without runtime dependencies beyond Java 11. The Maven coordinate is com.tapadyuti:flaky-http:1.0.0 . The shortest useful test setup is a deterministic failure: FlakyConfig config = FlakyConfig . builder () . failureRate ( 1.0 ) . errorStatus ( 503 ) . build (); Every targeted call now returns an empty synthetic 503 response without reaching the network. Replace 1.0 with 0.0 and add LatencyStrategy.fixed(500) when the test should exercise slowness without an HTTP error. It is intended for integration tests, resilience tests, local development, and controlled demonstrations. It is not a replacement for a network proxy or a full chaos-engineering platform

GitHub Trending Digest — 28 Agustus 2026 Minggu ini, repo-repo di GitHub menunjukkan arah yang cukup jelas: AI agent menjadi semakin otonom dan ringan . Dari framework yang membuat agent berpikir hemat kode, hingga engine lokal untuk model MoE (Mixture of Experts) yang bisa berjalan di hardware apa pun, ekosistem open source terus mendorong batas apa yang mungkin dilakukan developer dengan sumber daya terbatas. Berikut rangkuman lima repository paling trending minggu ini. 1. deepseek-ai/deepseek-harness ⭐ 200.216 Bahasa: TypeScript DeepSeek Harness mengusung filosofi "Everything is a Plugin" . Repositori ini menawarkan kerangka kerja yang memungkinkan developer membangun pipeline AI secara modular, di mana setiap komponen—mulai dari preprocessing data, inference, hingga post-processing—dapat ditukar seperti lego. Dengan pendekatan berbasis plugin ini, tidak ada lagi lock-in ke satu library atau model tertentu. Mengapa repo ini trending? Karena komunitas sedang haus akan fleksibilitas. DeepSeek sendiri terus merilis model yang kompetitif dengan model besaran internasional, dan Harness memberi jalan bagi developer untuk mengintegrasikannya tanpa ribet. Use case praktis: Membangun sistem RAG (Retrieval-Augmented Generation) di mana Anda bisa mengganti embedding model, vector store, dan LLM backend tanpa mengubah logika inti aplikasi. 2. DietrichGebert/ponytail ⭐ 114.054 Bahasa: JavaScript Ponytail memperkenalkan pendekatan unik: membuat AI agent bersikap seperti "senior developer paling malas di ruangan" . Filosofi dasarnya sederhana—kode terbaik adalah kode yang tidak pernah kamu tulis. Ponytail mendorong agent untuk memaksimalkan reuse, meminimalkan boilerplate, dan menolak menulis ulang hal yang sudah ada. Trending karena resonansi budaya. Kalimat "the best code is the code you never wrote" langsung menyentuh pain point developer yang sering terjebak menulis ulang solusi yang sudah tersedia. Ponytail bukan sekadar tool, tapi semacam mindset yang dikodekan. Use case

God’s Eye View was the top project on GitHub Trending when we selected it for Jian AI Lab’s daily experiment. The pitch is immediately compelling. It brings aircraft, vessels, satellites, earthquakes, wildfire data, traffic, CCTV sources, and other feeds into one 3D globe. The repository also makes a serious effort to label data as live, modeled, reconstructed, or simulated. We tested commit b22573a9db28e47c324821ebdd4c67bdb241c0e1 on Linux with Node.js 24.19.0 and npm 11.9.0. Installation and security checks We first ran npm ci --ignore-scripts , reviewed the install-script sources, and then ran the normal npm ci . Both installations succeeded with 201 packages. The root project has no preinstall, install, or postinstall hook. Transitive install scripts come from esbuild, fsevents, Puppeteer, and sharp. npm audit --omit=dev reported no known vulnerabilities in production dependencies. A common secret-pattern scan did not find hard-coded live credentials. This is a limited check, not a full source audit. The project talks to many external services, including Google Maps, OpenAI, OpenSky, AISStream, NASA FIRMS, TomTom, CelesTrak, OSM, Open-Meteo, GDELT, and Radio Browser. It is local-first, but it is not offline. Server-side keys such as OpenAI and AISStream are read by the local Vite proxy. Google Maps and Cesium tokens are intentionally delivered to the browser. Users must restrict referrers and APIs and set provider budgets and quotas. 2,588 visible assertions passed The main test suite reported 2,587 passing assertions and zero failures. A separate focus-allocation check added one more passing assertion. The visible total was 2,588 passes and zero failures. The process did not exit after the summary. We waited more than 90 seconds and interrupted it manually. The final exit code was 130. The precise result is that all visible assertions passed, while the official test command did not complete with a clean exit in this environment. This may indicate an open handle

Your filesystem is already a database. Most tools just don't treat it that way. That's the core idea behind the Markdown Database Pattern — written up properly on The Way of Markdown , a site we've been contributing to that makes the case for building things on plain markdown instead of locked-in platforms. We think it's a pattern worth more attention, so here's the short version. Treat a folder of markdown files as a database. Each file is a record. Frontmatter fields are columns. Directories are tables. Tags, wikilinks, and tasks in the body become queryable relations. Filesystem Database ────────────────────────────────── markdown file → record frontmatter field → column directory → table #tag → tag relation [[wikilink]] → link relation - [ ] task → task relation You get portability, version control (git works perfectly on plain text), no framework lock-in, and full queryability. You give up scale and real relational joins — this isn't for millions of records. It's a lightweight database, honest about its limits. Once you name it, you start seeing it everywhere. Obsidian Bases and Dataview already do versions of this, half-consciously. A team wiki where every page has a status and owner field is one. A blog with date and tags in frontmatter is one — it just doesn't know it yet. Sweet spot: up to roughly 10k files. Past that, reach for a real database. Below it, this gets you almost everything a database gives you, at a fraction of the complexity, with none of the lock-in. The full writeup — the complete tradeoff analysis, a worked example with actual queries, how to implement it in a weekend, and the tool ( MarkdownDB ) that does it for you — is here: wayofmarkdown.com/markdown-database

GitHub热门项目 | A spy satellite simulator in your browser, except the data is real. Live open source spatial intelligence on a photorealistic 3D globe. | Stars: 7,705 | 1,984 stars today | 语言: JavaScript

Hey everyone! 👋 Finding reliable, free public APIs for side projects or learning is always a hassle because many listed APIs eventually go down or become paid. To solve this, I created Awesome Free APIs Live — an open-source, curated collection of 50+ free public APIs across AI, developer tools, security, and open data. ⚙️ How It Works Daily Health Checks: Powered by GitHub Actions , an automated script tests endpoints daily and updates live status badges. Zero Dead Links: Broken endpoints are flagged automatically so developers don't waste time debugging dead services. Categorized & Searchable: Clean, categorized UI hosted on GitHub Pages. ### 🔗 Links 🌐 Live Directory: shilpshakti.github.io/awesome-free-apis-live ⭐ GitHub Repository: github.com/ShilpShakti/awesome-free-apis-live Contributions are very welcome! If you know of any great free APIs, feel free to open a PR or check out the open issues on GitHub.

What is ZeroDroid? ZeroDroid is an open-source Android toolkit that exposes the radios, sensors and connected-device capabilities already present in a phone. GitHub: https://github.com/theabhishekchandra/ZeroDroid What problems does it address? The app contains 29 tools across five areas: Wireless: Wi-Fi, BLE, NFC, Bluetooth Classic and peer-to-peer connections RF and signals: IR, UWB, SDR-device detection and ultrasonic analysis Sensors: GPS/GNSS, QR analysis, device sensors and magnetic anomalies Network: USB inspection, cell-tower information and wardriving Security: tracker scanning, hidden-camera indicators, rogue-AP detection, network scanning and deauthentication indicators Architecture ZeroDroid uses Kotlin, Jetpack Compose, Material 3, MVVM, StateFlow, Hilt and Room. Services are lazy-loaded, and scanning begins only when the user starts a tool. Important limitations A smartphone cannot guarantee that it has found every camera, tracker, bug or network threat. Several detections are heuristic and may produce false positives or miss threats. Hardware availability also differs between Android devices. The project is intended only for education, defensive security and testing devices or networks you own or are authorized to assess. Feedback wanted I am looking for: Compatibility reports from different Android phones Feedback about permission handling False-positive reports Contributions, tests and documentation improvements Repository: https://github.com/theabhishekchandra/ZeroDroid

The lakehouse projects spent this week arguing about boundaries. Iceberg decided where conformance testing lives and started sketching the REST API shape that V4 tables will need. Polaris argued about what a committer owes a project when LLMs make pull requests cheap. Parquet pulled a feature apart because two proposals were reaching for the same mechanism. DataFusion and Iceberg Rust opened a joint thread about which repository should own their integration. Every one of those debates is a question about ownership, and the answers this week tell you a lot about how these communities plan to scale. Apache Iceberg The single biggest outcome of the week was the creation of a new repository. Neelesh Salian, working with Sung Yun and Andrei Tserakhau, called a vote to create apache/iceberg-verification , a standalone home for language-neutral conformance fixtures that every Iceberg implementation can run against. The vote passed with five binding +1s from Russell Spitzer, Sung Yun, Matt Topol, Daniel Weeks, and Amogh Jahagirdar, plus twenty-two non-binding votes. That is a wide turnout. The names on the non-binding list read like a roll call of the Rust, Python, Go, and Java maintainers, which is the point. Salian will now work with a PMC member to stand the repository up. The reason this matters goes beyond tidiness. Iceberg has at least five serious implementations today across Java, Python, Rust, Go, and C++. Each one carries its own test fixtures and its own understanding of edge cases in the spec. When two implementations disagree about how to interpret a manifest list, users find out the hard way. A shared set of fixtures that every implementation reads from one place turns spec ambiguity into a failing test rather than a production surprise. The 29 messages in the vote thread also included a fair amount of discussion about what belongs in the first batch of fixtures, and the conversation is worth reading if you maintain a client. The second major thread was about

GitHub热门项目 | Open-source personal finance manager. Self-hosted, privacy-first. | Stars: 2,324 | 617 stars this week | 语言: Python