标签：#pens

GitHub热门项目 | Why is this running? Trace any process, port, container, or file back to what started it - CLI + TUI. | Stars: 20,264 | 556 stars today | 语言: Go

Authentication is often presented as a short sequence: Accept a username and password. Return a JWT. Protect a few endpoints. That is enough for a tutorial, but it is not an authentication lifecycle. Real applications must also answer harder questions: How is an email address verified without storing a reusable secret? What happens to existing sessions after a password reset? Can a user see and revoke a lost device? How do we prevent a rotated refresh token from being replayed? How should TOTP secrets and recovery codes be stored? How can an OIDC identity be linked without trusting email matching? I explored those questions while building FastAPI Production API v1.2.0 , a backward-compatible authentication lifecycle release for an open-source FastAPI backend foundation. This article explains the design decisions behind it—not just the endpoints that were added. 1. Model lifecycle tokens as scoped, single-use credentials Email verification and password recovery look similar from the outside: send a link, receive a token, and update an account. Treating them as interchangeable, however, creates unnecessary risk. The release uses account-action tokens with four important properties: Random: the token is generated as an opaque secret rather than derived from user data. Scoped: a verification token cannot be used as a password-reset token. Expiring: every token has a short, configurable lifetime. Single use: confirmation atomically marks the token as consumed. Only a hash of the token is persisted. The original value exists only long enough to be delivered to the user. This gives email verification and password reset a shared security primitive without making their policies identical. The main endpoints are: POST /auth/email-verification/request POST /auth/email-verification/confirm POST /auth/password-reset/request POST /auth/password-reset/confirm Both request operations return uniform responses. A caller should not be able to determine whether an email belongs to an a

AMD เปิดตัว Instella-MoE-16B-A3B — โมเดล AI ที่เทรนด้วย GPU ของตัวเอง ไม่พึ่ง Nvidia โดย Nokka (นก-กา) | 5 สิงหาคม 2569 AMD เพิ่งปล่อยโมเดล AI ตัวใหม่ที่สร้างความฮือฮาในวงการ เพราะไม่ได้เป็นเพียง "โมเดลฟรีอีกตัว" แต่มันคือการพิสูจน์ว่า GPU ของ AMD ก็เทรน AI ระดับท็อปได้จริง โดยไม่ต้องพึ่ง Nvidia [1][2] โมเดลชื่อ Instella-MoE-16B-A3B มีขนาด 16 พันล้านพารามิเตอร์ แต่จุดเด่นคือไม่ได้ใช้ทั้งหมดพร้อมกันทุกครั้งที่ประมวลผล ใช้จริงแค่ 2.8 พันล้านตัวต่อคำ [1][2] นี่คือหัวใจของสถาปัตยกรรมแบบ Mixture-of-Experts (MoE) เปรียบง่ายๆ เหมือนบริษัทที่มีผู้เชี่ยวชาญหลายแผนก แต่ละงานจะถูกส่งไปให้แผนกที่เกี่ยวข้องเท่านั้น ไม่ต้องเรียกทุกแผนกมาประชุมทุกครั้ง ทำให้ประมวลผลเร็วขึ้นโดยที่โมเดลยังมีความรู้กว้างเหมือนเดิม [2] ในบทความนี้ผมจะพาคุณไปทำความเข้าใจว่าโมเดลนี้คืออะไร ทำไม AMD ถึงต้องทำแบบนี้ และถ้าคุณเป็นนักวิจัยหรือคนสนใจ AI ควรรู้เรื่องอะไรบ้าง ทำไมเรื่องนี้ถึงเป็นข่าวใหญ่ ประเด็นหลักไม่ได้อยู่ที่ตัวเลขสเปก แต่อยู่ที่ AMD เทรนโมเดลนี้ตั้งแต่ต้นจนจบด้วย GPU ของตัวเอง (Instinct MI300X และ MI325X) โดยไม่ใช้ Nvidia เลย [1][2] ปกติงานระดับนี้ต้องพึ่ง CUDA ของ Nvidia แทบทั้งหมด การที่ AMD ทำได้สำเร็จจึงเป็นสัญญาณว่าทางเลือกที่ไม่ใช่ Nvidia เริ่มเป็นไปได้จริง แถม AMD ยังเปิดให้ดาวน์โหลด weight ของทุกขั้นตอนการเทรน พร้อมโค้ดเทรน และสูตรผสมข้อมูลแบบเปิดหมด [1][2] นี่คือสิ่งที่ทำให้เรื่องนี้กลายเป็นข่าวใหญ่ เพราะเป็นการ "เปิดไพ่ทั้งหมด" ให้วงการตรวจสอบและต่อยอดได้ สถาปัตยกรรมของ Instella-MoE โมเดลนี้ใช้การออกแบบแบบ decoder-only MoE ที่มีส่วนผสมของนวัตกรรมทางสถาปัตยกรรมและระบบ [1] รายละเอียด ค่า Parameters รวม 16B Parameters active ต่อ token 2.8B Decoder layers 27 Hidden size 2048 Shared experts 2 Routed experts (เลือก 6 จาก 64) 6/64 ต่อ token Pre-training tokens 7.1T Context window 4K → 64K จุดเด่นทางสถาปัตยกรรม 2 อย่าง [1] Gated Multi-head Latent Attention (Gated MLA) — เพิ่ม output gate แบบเรียนรู้ได้ให้กับ attention ทำให้โมเดลเลือก "ลดทอน" คำตอบของ attention ที่มีประโยชน์ต่ำสำหรับแต่ละ token ได้ เพิ่มความสามารถในการแสดงออกของโมเดลด้วยต้นทุนต่ำ FarSkip-Collective — ปรับการเชื่อมต่อของ M

Hello everyone! This is the second article about the development of RUSEON-core, a Zero-Copy video streaming server for AI platforms and Edge video infrastructure. In the first article , I talked about the fundamental reason why we decided to create our own server in the first place. I also covered the main problem with most similar solutions — the "thundering herd" — and how we managed to squeeze out 8 Gbps on a single CPU core. By the way, I forgot to mention in that article that besides simple streaming, we also record the streams in fMP4 format. It’s stored locally for N amount of time, and it can fly off to an S3 bucket (depending on how long the clients want to keep the recordings). This article is precisely about a non-obvious (well, at least to me, maybe for someone else it's an everyday thing) problem related to data storage and its specifics across all Operating Systems. So, let's dive in. We rolled out our first release to production (100 cameras), made the clients happy, and started working. About an hour passed, and the alerts started flying. I SSH into the server, open htop, and see there's only 100 MB of free RAM. Uh-oh. I should clarify that the production server had 32 gigs of RAM. The expected behavior was that the CPU is chilling, the network card is chewing through the traffic, RAM usage is around 250-300 MB, and the disks are not heavily loaded. So, when you see numbers like that in htop, you start blaming yourself and your crooked hands that wrote this piece of "garbage". But still, we decided to go to Google, ChatGPT, and the like. Fortunately, the answer was found quickly, and we stopped beating ourselves up. The code was absolutely not the culprit; Linux itself ate the memory. If you've ever written tons of data to a disk, I think you already know what’s going on. There is an "invisible enemy" known as the Page Cache. That was exactly the root of this problem. How does the Page Cache work and what to do with it? When your function that is su

When I started building Weather Experience , I wasn't planning to release an open-source project. I simply wanted to answer a question: Could I build a modern radar rendering pipeline using NOAA's publicly available MRMS data? That question led me down a rabbit hole of GRIB2 decoding, radar products, rendering pipelines, performance benchmarking, and ultimately the release of MRMS Renderer , the first open-source project from Taylor Creative Development. Why MRMS? NOAA's Multi-Radar/Multi-Sensor (MRMS) system provides an incredible amount of weather data. For my use case, I focused on the ReflectivityAtLowestAltitude product because it provides an excellent foundation for radar visualization. The challenge wasn't obtaining the data. The challenge was turning that data into something useful. The Pipeline MRMS Renderer performs the complete workflow: Discover the latest MRMS products directly from NOAA/NCEP Download and decompress GRIB2 data Decode the grid using ecCodes Process reflectivity values with NumPy Render transparent PNG radar frames Generate an animation manifest Display animated radar over OpenStreetMap using Leaflet Everything runs locally. The project intentionally does not provide a hosted radar service. Instead, it demonstrates how developers can work directly with NOAA's publicly available data. Performance One of the biggest questions I had at the beginning was performance. Could this realistically be done fast enough for a modern application? Rather than speculate, I wrote benchmarks. On my M4 Pro MacBook Pro over a standard Wi-Fi connection, the complete pipeline—from downloading the latest MRMS frame through rendering the finished PNG—consistently completed in around two seconds . The surprising result wasn't the renderer. The renderer itself was already highly optimized using NumPy vectorization. The largest source of latency turned out to be downloading the GRIB2 data itself. That finding helped shape later architectural decisions for Weather E

I built RepoTrek , a terminal-first GitHub source browser written in Rust. GitHub: https://github.com/yuna-r/repotrek crates.io: https://crates.io/crates/repotrek The basic idea is simple: I wanted a comfortable way to deeply explore GitHub repositories without constantly switching between the browser, terminal, and editor. RepoTrek is not intended to replace Git clients such as git , lazygit , tig , or gitui . Its focus is different: Git client ↓ operate on a repository RepoTrek ↓ explore and read a repository Why I built it When reading open-source projects on GitHub, I often move through a sequence like this: Code ↓ Blame ↓ Commit ↓ Diff ↓ File history ↓ Another file GitHub's web interface is excellent, but when I spend a long time reading source code, I prefer staying in the terminal and using the keyboard. So I started building a TUI specifically around source code exploration . No clone required You can open a repository directly from GitHub. For example: rust-lang/rust or: torvalds/linux RepoTrek retrieves the repository information through GitHub APIs, so you don't need to clone the entire repository just to inspect it. This is especially convenient for quickly looking through large projects. Features RepoTrek currently includes: Repository tree browsing Source code viewer with line numbers Syntax highlighting Dark / Light themes Commit history Commit diffs File history Git blame Branch switching File search Repository-wide code search Symbol navigation Definition search Pull Requests Issues GitHub Actions Releases Keyboard-based text selection and copy Source/diff wrapping HTML export for printing The interface is designed to make moving between these views fast without leaving the terminal. Source code browsing The main view works like a terminal-native repository browser. src/ ├── app.rs ├── auth.rs ├── export.rs ├── highlight.rs ├── provider/ └── ui/ Open a file and RepoTrek displays it with line numbers and syntax highlighting. Common languages such as

A year ago, connecting a model to your tools meant writing glue for that model , in that framework , with that vendor's function-calling format. Swap the model and you rewrote the glue. In 2026, that pain is mostly gone, and the reason has a boring name: the Model Context Protocol (MCP) . MCP is worth understanding not because it's clever, but because it's winning — and the reason it's winning tells you where the industry's center of gravity is moving. What MCP actually is Strip away the branding and MCP is a small client–server contract for connecting language models to the outside world. A server exposes three kinds of things: tools (functions the model can call), resources (data the model can read), and prompts (reusable templates). A client — your IDE, your agent, your chat app — speaks the same protocol and can talk to any compliant server. The analogy people keep reaching for is USB-C, and it's accurate. Before USB-C you had a drawer full of proprietary chargers. MCP is the drawer-emptying moment for AI integrations: write the connector once, and any MCP-aware client can use it. Why "model-agnostic" is the whole point Here's the shift that matters. For most of the LLM era, your tooling was coupled to a model . If you built your agent stack around one vendor's function-calling quirks, you were locked in — a new, better model meant a migration project. MCP decouples the tooling layer from the model layer. Your filesystem server, your database server, your ticketing-system server don't know or care which model is on the other end. When a new flagship drops — and in 2026 they drop every few weeks — you point your client at it and keep your entire tool ecosystem intact. That's a strategic hedge, not just a convenience. In a market where the "best model" changes monthly, the durable asset is your integration layer , and MCP is how you stop rebuilding it. What to build with it Practical entry points, cheapest first: Wrap an internal system as a server. Your team's de

Most AI coding tools fail before they write a single line of code. The prompt was vague, and the model quietly filled the gaps with assumptions you never agreed to. You ask for "a task management CLI." The model picks a data model, a priority scheme, a persistence layer — all reasonable, none of them yours. You find out three files in, during review, and you rework it. That's the loop most of us are stuck in: prompt, guess, rework, repeat. Ouroboros is an open-source Agent OS that fixes the input instead of the output. It's a local-first runtime layer that sits in front of Claude Code, Codex CLI, OpenCode, Gemini CLI, GitHub Copilot CLI, Kiro, Hermes, Pi, and Zcode, and replaces ad-hoc prompting with a five-stage, replayable workflow: interview, seed, execute, evaluate, evolve. The real problem is unclear intent Ouroboros' own framing of this is a simple table: Problem What happens Ouroboros fix Vague prompts AI guesses, you rework Socratic interview exposes hidden assumptions No spec Architecture drifts mid-build Immutable seed spec locks intent before code Manual QA "Looks good" isn't verification 3-stage automated evaluation gate The fix targets clarity, not capability. The loop Interview -> Seed -> Execute -> Evaluate ^ | +---- Evolutionary Loop ----+ Interview : Socratic questioning surfaces the assumptions you didn't know you were making. Seed : your answers crystallize into an immutable specification: acceptance criteria, ontology, constraints. Execute : the seed runs through a Double Diamond decomposition (Discover → Define → Design → Deliver). Evaluate : a 3-stage gate: Mechanical (free, deterministic checks) → Semantic → Multi-Model Consensus. Evolve : the evaluation output feeds back into the next generation's seed, and the cycle repeats until the system stops learning anything new. Each cycle is meant to converge, not just repeat. The stopping condition isn't a timer or a step count. It's math. The interview ends when the math says so This is the part I

Hey DEV community! 👋 If you've ever tried to embed a dynamic YouTube channel feed, a live stream detector, or playlist carousel on a client site, you've probably run into two major issues: Expensive SaaS widgets that slap watermarks on your site unless you pay a monthly fee. Leaking your YouTube API Key directly in the frontend script. To solve this, we built YT Widget —a free, self-hostable, dependency-free JavaScript library that handles YouTube feeds, playlists, channel stats, and live stream status seamlessly. 📦 Where to Get It The project is fully open-source and ready for your production projects: Source Code & Contributions: scott8462 / YT-Widget A free, self-hostable, dependency-free JavaScript library for embedding YouTube feeds, playlists, channel stats, single videos, and live stream status on any website. YT Widget — Free Open-Source YouTube Website Embed A free, self-hostable, dependency-free JavaScript library for embedding YouTube feeds, playlists, channel stats, single videos, and live stream status on any website — just like SociableKIT, but 100% free and open-source. Created and provided free to the developer community by R&S Development . ✨ Features 📺 5 Widget Types feed : Latest channel uploads grid or list live : Auto-detects live broadcasts and embeds the live player — shows a custom Offline Card with recent uploads when offline playlist : Show videos from any YouTube playlist stats : Channel metrics cards (Subscribers, Views, Videos count) single : Responsive single video player with metadata 🔒 Secure PHP Server Proxy ( proxy/ ) : Keep your YouTube API key hidden server-side with built-in CORS, rate limiting, and 5-minute response caching. 🎨 Full Color Customization Light & Dark themes Custom Accent / Button… View on GitHub Alternative Downloads & Mirrors: Download on SourceForge ✨ Core Features 📺 5 Widget Types: Switch layouts instantly ( feed grid/list, live stream detector, playlist fetcher, profile stats , or single responsive video). 🔒 Se

Mediax: FFmpeg's Cooler Cousin 🚀 FFmpeg is powerful, but the syntax? A nightmare. So I built Mediax. 36 intuitive verbs. Interactive TUI. One-line install. Convert, compress, trim, crop, rotate, add watermarks... all with simple commands. bash mediax convert input.mov output.mp4 mediax compress large.mp4 small.mp4 --quality medium mediax trim video.mp4 clip.mp4 --start 00:01:30 --duration 10 Just run mediax for the interactive terminal interface. One-line install curl -sSL https://raw.githubusercontent.com/robert-sarah/mediax/main/install.sh | sh Built with Go Single binary — no dependencies Cross-platform: Windows, macOS, Linux Open source (MIT) 36 verbs for everything Conversion: convert, compress, gif Audio: extract-audio, mute, volume, replace-audio Video: trim, crop, resize, rotate, flip, concat, split Effects: speed, reverse, blur, sharpen, fade-in, fade-out Advanced: watermark, subtitle, thumbnail, template, batch Examples Resize for Instagram mediax template video.mp4 insta_video.mp4 --platform instagram Extract audio from 1:30 to 1:40 mediax extract-audio video.mp4 clip.mp3 --start 00:01:30 --duration 10 Detect video issues mediax wtf video.mp4 Why I built it I was tired of copying FFmpeg commands from Stack Overflow and breaking files because I forgot a flag. Mediax makes FFmpeg accessible for beginners and faster for pros. Try it today Repo: github.com/robert-sarah/mediax Contributions welcome! 🙏

Most embeddable widgets are surveillance with rounded corners. You paste one script tag, it opens a socket back to someone else's server, drops analytics, fingerprints the page, and turns your article into their funnel. I wanted the opposite. I had built a small screen-time calculator for an iPhone side project. You enter daily phone hours, how much of that time you'd actually want back, and your age. It returns the number not just as hours per year, but as waking years of the life you have left . The surprising part was not the maths. The surprising part was that the calculator itself was the first marketing asset I had built that people might reasonably link to. So the next step was obvious: make it embeddable. Constraints I gave myself four rules: No tracking script No backend callback No cookie or storage requirement Useful standalone, but with a real reason to click through That ruled out the normal widget pattern immediately. I did not want a script that asks the host page for DOM access. I did not want the embed to send typed values back to me. And I did not want to bolt analytics onto a tool whose whole public claim is "nothing leaves your device". So the widget became a single static iframe page. The embed snippet This is the whole thing: <iframe src= "https://shantj.github.io/sproutguard/embed.html" width= "100%" height= "620" style= "border:0;max-width:600px" loading= "lazy" title= "Screen time calculator" ></iframe> <p style= "font-size:13px;opacity:.7;margin:6px 0 0" > <a href= "https://shantj.github.io/sproutguard/screen-time-calculator.html?ct=embed-credit" > Screen Time Calculator </a> — free, no signup, runs in your browser. </p> No JavaScript include. No SDK. No npm package. Just an iframe and a credit link. The iframe points at a page that contains the calculator UI and the arithmetic. Because it is a static page, the host site never has to trust my script with its DOM. The actual calculator logic The core number is intentionally boring: const LIF

Originally published at vinpatel.com What is actually inside the Department of Energy's new Genesis Open Models Initiative? Right now, the honest answer is: a name, a URL, and a lab crest. The claim, as DOE has made it by putting the initiative live at genesisopenmodels.anl.gov, is that the federal government is now in the open-model business — training or releasing AI systems the way Meta releases Llama or Mistral releases its weights, except under a federal national lab's letterhead instead of a Silicon Valley one. The .anl.gov domain ties it directly to Argonne National Laboratory, a DOE lab that runs some of the country's largest public research compute. Here is what is measurable today: a hostname registered under a DOE national laboratory's domain, and a title. That is the entirety of what's publicly documented about this launch right now. No model card. No parameter count. No benchmark table. No license terms. No dataset provenance. If you went looking for the thing the name promises — an open model you can download, fine-tune, or audit — you'd come away with a URL and nothing to point a training run or a procurement memo at yet. That gap is not evidence of a bluff. It's what federal AI launches look like structurally. National labs run compute clusters under export-control review, multi-agency sign-off, and clearance processes that have nothing to do with how fast a model can actually train. A private lab ships a checkpoint the day it clears internal review. A DOE initiative clears communications, legal, and interagency review before it clears a single line of a model card — and the announcement is often the artifact that exists first, because it's the cheapest one to produce. The site can go live in an afternoon. The weights cannot. What would actually close this gap is specific and checkable: a published model card with parameter counts and training data provenance, an open license attached to real downloadable weights, and benchmark numbers outside resear

The bug that isn't a bug On Tuesday you attach a dead-letter queue to orders-queue . On Wednesday a batch of messages disappears and you ask Claude Code what happened. It answers immediately: orders-queue has no DLQ configured, so failed messages are dropped after the maximum receive count. That answer is wrong, and it is also not a hallucination. The assistant read a real snapshot of your AWS account. The snapshot was taken Monday. This is the failure mode that shows up once you give an AI assistant deterministic infrastructure context instead of letting it guess. Guessing produces answers that feel uncertain, and you treat them accordingly. A stale snapshot produces answers that feel authoritative, with real table names, real queue names, real ARNs. Nothing in the response signals that the underlying facts expired. Infrawise extracts your DynamoDB tables, Lambda configs, queue settings, database schemas, and code-to-table access patterns into a graph, then serves that graph to AI editors over MCP. Everything below is about the part nobody asks for in a feature list: what happens to that graph when it gets old. Why the context has to be cached at all The obvious fix is to never cache. Answer every question from a live account read. That does not survive contact with an actual session. A full infrawise analyze walks every enabled service, paginating through DynamoDB DescribeTable , Lambda configurations and their event source mappings, SQS queue attributes, SNS subscriptions and filter policies, Secrets Manager rotation state, S3 versioning and public-access configuration, ElastiCache clusters, CloudWatch log groups, plus schema introspection against Postgres, MySQL, or MongoDB, plus a local IaC parse, plus an AST scan of the repository. Every extractor is dispatched through a single Promise.all , so wall-clock time is bounded by the slowest one rather than their sum, but it is still seconds, not milliseconds. An assistant calls get_infra_overview at the start of a

GitHub热门项目 | An open-source AI coding agent that lives in your terminal. | Stars: 26,842 | 387 stars this week | 语言: TypeScript

GitHub热门项目 | Set up a modern web app by running one command. | Stars: 103,304 | 32 stars this week | 语言: JavaScript

GitHub热门项目 | A simple tool for coordinating several AI agents. | Stars: 1,943 | 273 stars this week | 语言: Clojure

GitHub热门项目 | Rivet Actors are the primitive for stateful workloads. Built for AI agents, collaborative apps, and durable execution. | Stars: 5,946 | 116 stars today | 语言: Rust

GitHub热门项目 | A CAD application built with Rust — 2D/3D drawing, DWG/DXF support, and GPU-accelerated rendering | Stars: 536 | 242 stars today | 语言: Rust

GitHub热门项目 | A powerful proxy management tool, built on top of Xray-core, with a focus on simplicity and ease of use. | Stars: 4,796 | 33 stars today | 语言: TypeScript

GitHub热门项目 | Claude Code Skill for browser automation with Playwright. Model-invoked - Claude autonomously writes and executes custom automation for testing and validation. | Stars: 2,994 | 3 stars today | 语言: JavaScript