标签：#pens

GitHub热门项目 | Open-source inference server and production cluster for all the models your agent needs. | Stars: 2,680 | 36 stars today | 语言: Python

GitHub热门项目 | | Stars: 6,836 | 48 stars today | 语言: Python

GitHub热门项目 | Truly independent web browser | Stars: 64,869 | 42 stars today | 语言: C++

Half your code is now written by an AI that hallucinates the other half's package names. That's not a joke. Across 576,000 samples, 19.7% of the packages AI coding models suggested didn't exist — and attackers have started pre-registering those exact hallucinated names, waiting for someone to npm install a package that was never real to begin with. Meanwhile, public registries catalogued 454,600 new malicious packages in 2025 alone, pushing the cumulative total past 1.2 million. A modern web app now pulls in 1,200+ dependencies once you count the full transitive tree — for software that, ten years ago, would have shipped with a fraction of that. That's precisely what Zero Dependency 2026 is about. Organized by Hackathon Raptors , Zero Dependency is a 72-hour online global hackathon where participants build genuinely useful software — CLIs, parsers, servers, databases, security tools — using nothing but their programming language's standard library. No frameworks. No packages. No supply chain to inherit. Just your language and your engineering skill. Why Zero Dependency? Modern AI coding assistants can generate code fast, and they reach for a dependency by reflex — sometimes one that doesn't exist. But real engineering isn't judged by how many packages you imported. It's judged by questions like: Do you actually understand what the library you'd normally import is doing underneath? Can you build the thing yourself, correctly, from primitives? Does your code handle the edge cases a package would've handled for you? Is the implementation idiomatic, or a fight against the standard library? Could a judge verify your dependency manifest is empty in five seconds? Zero Dependency is designed around these questions. Instead of rewarding whoever pulls in the most packages the fastest, the hackathon rewards teams who can prove they didn't need to. About the Hackathon 🌍 Global Online Hackathon ⏳ 72 Hours 💰 $1,800 Prize Pool 👥 Solo or Teams of up to 4 🎓 Open to students, profess

I Turned an Android Phone Into a No-Root Cybersecurity Learning Workspace Most people don't look at an Android phone and think: "This could be a practical Linux, Python, networking, and cybersecurity learning environment." Usually, the assumption is that serious technical learning requires a laptop, a virtual machine, or dedicated hardware. I wanted to see how far I could push the opposite idea. What if the Android phone you already own could become a practical learning workspace without root access? That experiment eventually became DedSec . DedSec is a free and open-source project built around Android and Termux. Its goal is not simply to install a large collection of tools. The goal is to create an environment where someone can actually learn how the pieces fit together. Repository: https://github.com/dedsec1121fk/DedSec Official website: https://ded-sec.space/ Why Android? Android devices are incredibly capable machines. Even an older phone can provide: a Linux-like command-line environment through Termux Python Git package management networking utilities file manipulation scripting automation local development workflows And you can do a surprising amount without root access. The limitation isn't always the hardware. A bigger limitation is often knowing what to do with it. You can install dozens of packages, copy commands from tutorials, and still not understand what is actually happening underneath. That was one of the problems I wanted DedSec to address. More Than a Collection of Scripts There are plenty of repositories containing security scripts. That wasn't enough for what I wanted to build. Installing a tool doesn't automatically teach you: what problem the tool solves when you should use it what its output means what layer of the system is failing how networking concepts connect together why a command works why another command fails So DedSec gradually became an ecosystem rather than just a scripts directory. The project connects several things together:

I'm a self-taught developer. No CS degree, no funding, no team. Just me, a laptop, and a problem I kept watching people struggle with. The Problem Every freelancer and small agency I know deals with the same mess: client details scattered across WhatsApp chats, email threads, Google Drive folders, and random Notion pages. Nothing lives in one place. When a client asks "wait, didn't we already send you the logo files?" you're digging through three different apps trying to remember. I didn't just hear about this problem — I lived it. So four months ago, I started building Kray. What Kray Actually Does Kray gives freelancers and agencies one organized workspace per client — projects, links, and notes, all in a single place instead of scattered across five different tools. The part I'm most proud of: when you share a project with a client, they can open the link and see everything instantly — no sign-up, no account creation, no friction. Just a clean, simple view of what they need to see. The Stack Since I was building this entirely solo with zero budget, I leaned on tools that let me move fast without infrastructure headaches: React 19 + Vite + TypeScript (strict mode — no shortcuts) Tailwind v4 for styling Supabase for auth, database, and storage Deployed on Vercel No backend servers to manage. No DevOps to worry about. Just me shipping features. What I Learned Building Solo You will hit bugs that eat entire days. I spent hours debugging a sitemap indexing issue that turned out to be one missing header. That's the job — most of building isn't writing new features, it's fixing the thing that should've worked but didn't. Deploy discipline matters more than you think. I once tested a feature locally, assumed it was live, and spent 20 minutes confused about why production wasn't behaving — because I'd forgotten to push. Lesson learned: always verify what's actually deployed before debugging further. Marketing is its own skill, and it's humbling. I've spent the last severa

Everyone's arguing about AI search visibility. Almost nobody is measuring the boring part: whether AI crawlers can fetch your pages at all . So I built a small open-source tool — geo-crawl-audit — that probes any site with the user-agents of every AI crawler that matters (GPTBot, OAI-SearchBot, ClaudeBot, PerplexityBot, ChatGPT-User, and friends), measures how each is treated versus a normal browser, and checks the thing most people never think about: how many words exist in the raw HTML before any JavaScript runs . Because here's the detail the industry keeps missing — GPTBot, ClaudeBot, and PerplexityBot don't execute JavaScript. For most sites, Googlebot (feeding Gemini) and Applebot are the only AI-adjacent crawlers that render it. A site can rank #1 in Google and be a blank page to nearly everything else. I pointed it at 18 major sites on August 7. Five findings worth your time. 1. Access patterns line up with the business relationships The Guardian — which has a content deal with OpenAI — serves my simulated GPTBot, OAI-SearchBot, and ChatGPT-User a clean 200 . The same request wearing ClaudeBot, PerplexityBot, or CCBot : 403 , and those names are in its robots.txt disallow list too. Policy and enforcement agree. The New York Times — in litigation with OpenAI — 403s nearly everyone: GPTBot, OAI-SearchBot, ClaudeBot, PerplexityBot, Common Crawl, meta-externalagent. Two user-agents got through: bingbot and Amazonbot. I want to be careful about the claim here: a status code tells you who is blocked , not why . Any individual 403 has mundane explanations. But when the allow/deny matrix maps this cleanly onto public deals and public lawsuits, the firewall config has become a business document — and it's readable by anyone with a terminal. 2. robots.txt is a polite sign. Some doors are unlocked anyway. Reddit's robots.txt blocks every AI bot in my list — fourteen tokens, no exceptions. Enforcement tells a different story: my GPTBot UA got a 403 and ClaudeBot and CCB

Originally published by InvisibleHill Research . This cross-post preserves the original research cut-off and source list. Research cut-off: July 30, 2026. Miner signaling is a live metric and may have changed after publication. BIP 110 begins with a problem that many Bitcoin users can recognize. A miner can collect a one-time fee for including an image, token payload, or other arbitrary data, while thousands of node operators absorb the cost of downloading, validating, and sometimes storing it. The proposal's authors see that mismatch as a subsidy for data storage and a threat to Bitcoin's use as money. Their answer is a temporary soft fork. For about one year, BIP 110 would make several currently valid transaction structures invalid under consensus rules. It would cap OP_RETURN outputs at 83 bytes, limit many data pushes and witness items to 256 bytes, restrict large output scripts and Taproot control blocks, and disable several Taproot upgrade paths and script features that can carry data. Adam Back agrees with the premise more than his opposition sometimes suggests. He has said that Bitcoin is about money and that spam has no place in its timechain. He also designed Hashcash to make spam costly. His objection is to the remedy. In Back's view, an annoyance that fits inside Bitcoin's existing block limit does not justify a contentious consensus change, especially one that can be bypassed, can interfere with legitimate scripts, and has not earned technical or economic agreement. That distinction is the center of the debate. BIP 110 asks whether Bitcoin should discourage an unwanted use through local policy and fees, or declare some forms of that use invalid for everyone. Back's case is stronger on this question. The proposal identifies a real externality, but it offers an asymmetric bargain: incomplete filtering in exchange for a new consensus precedent, a more complicated upgrade path, and a material risk of a minority chain. A policy dispute became a consensus pro

GitHub热门项目 | A library for building fast, reliable and evolvable network services. | Stars: 27,151 | 15 stars today | 语言: Rust

Every new SaaS seems to embed ChatGPT these days. Most AI support solutions rely on third-party platforms, monthly subscriptions, and vendor lock-in. While they're great products, I wanted something different. I wanted complete ownership. I wanted to deploy everything on my own server, use my own OpenAI API key, customize every part of the experience, and embed the widget into any website with a single script tag. So I built my own self-hosted AI support widget using Spring Boot and Vanilla JavaScript. Why I Built It When building small products and websites, I realized that customer support quickly becomes a problem. Users have questions about pricing, features, returns, or simply get stuck. Most developers solve this by integrating services like Intercom, Crisp, or Tidio. Those platforms are excellent, but they also mean: Monthly subscription costs Vendor lock-in Customer conversations stored on third-party platforms Limited customization Another external dependency I wanted something that developers could completely own. The Goal The goal was simple. Build an AI-powered customer support widget that developers can deploy on their own server and integrate into any website in less than a minute. The widget should: Answer customer questions using AI Learn from a custom knowledge base Match the company's branding Store conversation history Allow human handoff Be easy to deploy Require only one script tag to embed Technology Stack Java 17 Spring Boot 3 Spring Security Spring Data JPA Thymeleaf Vanilla JavaScript H2 Database (MySQL supported) OpenAI API Architecture The overall architecture is intentionally simple. Visitor │ ▼ AI Chat Widget (Vanilla JavaScript) │ ▼ Spring Boot REST API │ ▼ OpenAI API │ ▼ Database (H2 / MySQL) Keeping the frontend framework-free makes the widget lightweight and easy to embed into virtually any website. One-Line Integration Adding the widget to a website only requires a single script. <script src="/widget/widget.js" data-api-base=""></sc

While contributing to Grafana, I picked up a memory issue in the Time Comparison feature — a follow-up to earlier performance work I had done in the same area. A comparison panel was consuming significantly more memory than expected. The interesting part: the extra memory wasn't coming from real data. This post covers how I traced it to the root cause and fixed it. Background Time Comparison overlays an earlier period onto the current one — for example, this week vs. last week. The comparison data is fetched from the earlier window and shifted forward before rendering: Query → DataFrame → Prepare frame → Shift → Render │ └─ Gap filling The important detail: gap filling ran before the comparison frame was shifted. The Problem I reproduced the issue with: Parameter Value Series 500 Window 6h Interval 20s Compare offset 24h A single-period panel contained roughly 540,000 points , so a comparison panel should be about 2× the baseline . Instead, the compare frame contained 3,240,500 points — ~6× the baseline — and consumed 76.4 MB . The question was: where did the extra points come from? Investigation I first verified the baseline to rule out the query returning unexpected data. It was correct. Then I used a reproducible browser harness and a heap snapshot to inspect the extra memory. Most of it was null rows introduced during gap filling — not real samples, not copies. Following the frame through the preparation pipeline revealed why. When gap filling ran, the compare frame still represented data 24 hours in the past , but the gap-filler was using the current time range as its reference: Compare frame Current range [===== 6h =====] [===== 6h =====] └─────────────── 24h ───────────────┘ gap-filler reads this offset as one gap At a 20-second interval, 24 hours is: 24 × 60 × 60 / 20 = 4,320 intervals So up to 4,320 null positions per series were introduced purely because the frame hadn't been shifted yet. The frame was then shifted forward, leaving most of that padding out

GitHub热门项目 | The free coding agent | Stars: 8,536 | 440 stars this week | 语言: TypeScript

GitHub热门项目 | GlazeWM is a tiling window manager for macOS and Windows inspired by i3wm. | Stars: 12,543 | 31 stars today | 语言: Rust

GitHub热门项目 | Payload is the open-source, fullstack Next.js framework, giving you instant backend superpowers. Get a full TypeScript backend and admin panel instantly. Use Payload as a headless CMS or for building powerful applications. | Stars: 44,041 | 27 stars today | 语言: TypeScript

GitHub热门项目 | AI-Engineering Foundation Framework built with AI and designed for AI. Hundreds of architectural and domain decisions (multi-tenancy, RBAC, event flow, pricing, sales pipeline,CRM/ERP processes) are already made conventions and specs so agents (Cursor, Claude Code, Codex) arch. decisions without reinventing. Ship production grade with AI Agents. | Stars: 1,572 | 12 stars today | 语言: TypeScript

GitHub热门项目 | Graph-Native Infrastructure for Context and Accountable AI Systems | Stars: 2,183 | 118 stars today | 语言: Python

GitHub热门项目 | A self-improving RLM agent for coding workflows and long-running autonomous tasks. | Stars: 5,231 | 2,271 stars today | 语言: TypeScript

I have been building machin for a while — a Go-flavored, type-inferred language that compiles through C to a single native binary. It has grown a lot recently, and I wanted to answer the obvious question honestly: does it beat Rust and Zig at anything? It does, at two things, decisively. But the first thing I found was not a win. It was my own benchmark quietly lying to me, and the number it was lying about was the best one I had. The benchmark was measuring the order I ran things in machin's repo has had a bench/native-speed suite for months: four compute kernels — recursive fib, a mandelbrot, a sieve, a big integer loop — written in machin, Rust and Zig, producing byte-identical output, so the timing compares the same computation three ways. The published result claimed machin won the integer loop by 20-25% . That claim also shipped inside machin guide , which is what every coding agent reads to learn the language. When I re-ran it, the margin was gone. Not shrunk — gone. So I read the harness instead of the output: for kernel in kernels : for lang in [ machin , rust , zig ]: for _ in range ( 5 ): # all 5 machin, THEN all 5 rust, THEN all 5 zig time ( binary ) It ran every sample of one language before starting the next. On a laptop that heats up and down-clocks during a three-second kernel, that does not measure the languages. It measures who had the misfortune of running last . Zig always went last. Zig always looked slowest. The fix is four lines — interleave the rounds, rotate who starts each one. Here is what my headline number did: intsum 10^9 before (blocked) after (interleaved) machin 2832 ms 3079.7 ms rust 3764 ms 3223.8 ms zig 3556 ms 3189.7 ms "machin +20-25%" machin +3% = a TIE A 20-25% win became a tie. I deleted the claim from the README and from machin guide . The harness now also refuses to declare a winner inside a 3% band, because the worst run-to-run spread I measured was 41% of the min sample. Calling winners inside that is how benchmarks start

A live production integration case study Introduction and Purpose of This Article This article is written for mid- and high-level managerial and technical decision makers. I am the author of the open-source Java library MgntUtils . The article presents an analysis of a real integration of the stacktrace-filtering feature from that library into a live commercial production environment. A few important clarifications up front: This is not a side-project pilot and not a lab demo. The feature was integrated into a production service of a company that serves a high volume of real customers. Due to legal constraints, I am not at liberty to name the company. This is not a how-to article for implementers. If you came looking for code samples or logging-framework wiring, please see the dedicated articles listed in the Disclaimer below. MgntUtils can be used in Java projects and in other JVM-based languages such as Kotlin. Before diving into the production numbers, it is worth stating briefly what the feature does and why those numbers matter. Server-side stacktraces are usually full of framework and infrastructure noise — proxies, filter chains, containers, thread pools, and similar boilerplate — while the few lines that actually explain the failure are easy to lose in the pile. The MgntUtils filtering utility keeps the application frames and the exception / Caused by chain, and collapses that noise. The result is a much shorter stacktrace without losing the information you actually need . When those stacktraces are later consumed — sent to an LLM for analysis, or opened by an engineer — that reduction can mean: Substantial AI token savings Typically more accurate AI root-cause answers , because the model has less framework noise to latch onto and hallucinate about A meaningful productivity boost for human triage The rest of this article focuses on what was observed after integrating this feature in production: the measured benefits, how to interpret them, and the integratio

The AI leaderboard just had a seismic shift. Qwen3.8 Max, Alibaba's latest open-weight model, has been ranked as the best overall model by the Artificial Analysis Agentic Index — beating out GPT-5.6 Sol from OpenAI, Claude Opus 4.5 from Anthropic, and Gemini Ultra 2 from Google. This isn't just a benchmark win. It's the first time an open-source model has topped a comprehensive agentic intelligence index that measures real-world task performance, not just test scores. What Is the Agentic Index? The Artificial Analysis Agentic Index is an independent benchmark that evaluates AI models on their ability to complete agentic tasks — multi-step reasoning, tool use, code generation, and real-world problem solving. Unlike traditional benchmarks (MMLU, HumanEval) that test static knowledge, the agentic index measures whether a model can actually do things . The index evaluates models across multiple dimensions: Intelligence Index : Composite score across reasoning, coding, math, and instruction following Speed : Output tokens per second under production load Cost : Weighted average cost per intelligence task Endpoint Accuracy : Whether provider endpoints match reference model quality Qwen3.8 Max: The Specs Qwen3.8 Max represents Alibaba's most capable model to date: Parameters : 240B (MoE architecture, ~35B active during inference) Context : 256K tokens native, 1M extended Training : Trained through November 2025 data cutoff Licensing : Open weights for research and commercial use (with restrictions for users in restricted jurisdictions) What makes Qwen3.8 Max notable isn't just raw intelligence — it's the combination of high performance with competitive pricing and speed. The model scores near the top on intelligence while maintaining cost per task well below premium alternatives. Why This Matters for Developers 1. Open-Source is Catching Up — and Pulling Ahead For two years, the gap between open-source models (Llama, Qwen, Mistral) and proprietary frontier models (GPT, Cla