标签：#rce

GitHub热门项目 | Beautiful, Modern & Opinionated Linux | Stars: 34,415 | 5,942 stars this week | 语言: Shell

I just wrote about the billion-dollar rounds flooding into humanoid robotics. Here is the story from the other end of the scale, and I find it more encouraging. Hugging Face's open-source robot, a 25-centimeter bipedal machine with fifteen actuators and a sensor kit that includes a camera, speaker, LiDAR, NFC, Bluetooth, and WiFi, just passed a million dollars in sales. Fully open hardware, openly documented, quietly making real money. One of these robotics stories is funded like an industrial giant. The other is a small, open, shippable thing that people are actually buying. They are both true, and the small one is the one most builders can learn from. Open hardware turned out to be a business The reflexive assumption about open-source hardware is that you cannot make money on it, because anyone can copy the design. Hugging Face's robot is a live counterexample. The plans are open, the software stack is open through their LeRobot ecosystem, and it crossed a million in sales anyway. That is worth sitting with, because it means openness and revenue are not the opposites people assume. The reason it works is the same reason open-source software companies work. Most buyers do not want to source fifteen actuators, fabricate a chassis, and debug a sensor stack to save money on a robot that already exists and is affordable. They want the finished thing, they want it to work out of the box, and they are happy to pay the people who designed it. Openness is not the giveaway that kills the business. It is the trust and the ecosystem that make the business, because you can see exactly what you are buying, modify it, and build on a platform other people are also building on. Why this is the better story for builders The mega-funded humanoid companies are placing a bet only a handful of players can place: billions of dollars, years of runway, factories. That is a real path, and it is not your path or mine. The Hugging Face robot is the other path, and it is copyable. Small, open

Most AI workspaces start with the same useful primitive: a chat box. I kept one in AI Workstation because it is still the fastest interface for many research and writing tasks. But while using the product for day-to-day work, I found two questions that did not belong in a general chat flow: What current topic is worth researching today? Which open-source AI project is worth evaluating now? Both questions depend on live evidence. They also have different failure modes from ordinary drafting. A model can produce a fluent answer while using stale memory, mixing project identities, overlooking a license, or treating popularity as proof of quality. That led me to split AI Workstation into three layers: a general workspace, public discovery Radars, and installable Agent Skills. Layer 1: the workspace The main AI Workstation handles everyday knowledge work: questions, links, documents, images, drafting, proofreading, reusable templates, and exports. The point is not to hide every operation behind one large prompt. It is to keep routine work accessible while letting tasks that need current data move into a more explicit flow. Layer 2: public Radars for live discovery The first Radar is Global Topic Radar . It is designed for creators and editors who need current candidates rather than generic content ideas. It keeps the topic lane, freshness, market context, evidence state, and original sources visible. The second is Open-Source AI Radar . It is designed for developers and researchers comparing active AI projects. It presents dated rankings, categories, collections, and project cards with direct links to upstream repositories. Stars, forks, licenses, languages, and practical summaries are treated as research inputs. The important design choice is what the Radars do not claim: A topic score is not a prediction that a post will go viral. Project popularity is not a security audit or a quality guarantee. A generated summary does not replace the upstream repository or license t

The problem I run Hermes, an open-source agent with tools, memory, and cron built in. Before running my own managed service SaaS, I used various competitors to deploy on VPS. This method has a lot of downsides because you are often SSH'ing in and managing secrets directly in a .env file, which can leave you exposed if your box is compromised. It is also very cumbersome, especially for agencies to manage these "alway-on agents" for clients on VPS. Luckily, these are just hosting problems, so I built SEAOTTER to fix it for myself, and then realized other people probably have the same problem. * What it does * SEAOTTER is a managed control plane for Hermes Agent: Per-agent isolation - each agent runs in its own namespace with a gVisor sandbox, so one client's agent can't see or touch another's. Operate without SSH — pause, restart, restore, and read logs through an API instead of a terminal. MCP-native — talk to a hosted agent from Claude, Cursor, or Codex. Secrets handled for you — backed by Google Secret Manager instead of a .env file you have to remember exists. The rough idea POST /api/v1/agents or on "Create Agent", and it provisions a namespace, installs Hermes via Helm, brings up the sandbox, wires DNS/TLS, and gives you a reachable dashboard, typically in under five minutes. Who it's actually for Agencies running one isolated agent per client without spinning up a VPS per client Hermes power users who want lifecycle control (pause/restart/restore) without maintaining SSH access Hobbyists who want a standing assistant without becoming an ops person Try it There's a 14-day free trial on the Hobby plan. Worth being upfront: it currently asks for a card at checkout, which I know is friction — I'm working on a no-card way to try it. In the meantime, the docs walk through the API and dashboard in detail if you want to look before you sign up. What I'd love feedback on If you're currently self-hosting Hermes on a VPS: what would actually get you to switch, or keep you

One of the most useful questions in network troubleshooting is also one of the simplest: Does it fail from another machine too? If a website will not load on my laptop, trying it from another computer can immediately change the investigation. If it works there, the service probably is not down. Something about my machine, DNS configuration, VPN, firewall, route, or network path is different. If it fails there too, the problem may be farther upstream. I wanted Network Doctor to be able to ask that question directly. So I added remote diagnosis over SSH. netdoc --via ideapad github.com Instead of running the diagnosis locally, Network Doctor connects to ideapad , runs the checks there, and reports the result back on my machine. Why another vantage point matters A network failure is always observed from somewhere. Suppose github.com is unreachable from my workstation. I can test DNS: dig github.com Then TCP: nc -vz github.com 443 Then TLS: openssl s_client -connect github.com:443 Maybe I inspect my routes, VPN, proxy settings, or firewall. Those tests are useful, but they all share one property: they are observing the network from the same machine. Trying the same destination from another machine gives me a new piece of evidence. Imagine this: Thelio: DNS PASS TCP 443 FAIL Ideapad: DNS PASS TCP 443 PASS TLS PASS HTTPS PASS That difference is interesting. GitHub clearly is not universally unreachable. The second machine just reached it. Now I have a much smaller problem to investigate: what is different about the path from Thelio? That is often more useful than running another five commands on Thelio. Turning that into a command Network Doctor already runs network checks as a dependency graph. For an HTTPS target, for example, it can test things such as the local interface, DNS resolution, TCP connectivity, TLS, HTTP, routing, and path MTU. Normally: netdoc github.com means: Diagnose github.com from this machine. With --via : netdoc --via ideapad github.com it becomes:

If you are a woman in tech who is stuck in "tutorial hell," constantly taking courses but never actually deploying real software, this is for you. I am Mary Macharia, a Software Engineer specializing in Backend Development, AI/ML, and QA. I founded SHEinnov8 because I noticed a massive gap in our community: plenty of brilliant women have the drive to build something real, but they lack the space, the collaborative structure, or the network to actually push it across the finish line. We are changing that. What is SHEinnov8? SHEinnov8 is a decentralized digital guild built specifically for female developers, product designers, and tech creators. We operate on a simple framework: We learn by doing, we build together, and we do not stop until we ship a finished product. What We Are Currently Hacking On Right now, our guild is building an intensive AI Multilingual Project . We are engineering scalable backend infrastructures, orchestrating multi-language AI pipelines, and building deep automated QA suites to break the code and make it smarter. Why You Should Join the Guild Real Production Experience: Skip the basic todo-list apps. Work on raw, complex, collaborative codebases that you can proudly put on your resume. Founder Ecosystem: Meet fellow technical founders, bounce ideas off each other, and turn raw concepts into real tools. End-to-End Ownership: Learn what it actually takes to push code through CI/CD pipelines, configure metadata, handle security/QA audits, and go live. Let's Build Something Together! We are actively looking for software engineers, QA professionals, AI/ML enthusiasts, and designers who are ready to build, learn, and ship. Drop a comment below with your core tech stack, what you're passionate about building, or simply ask a question. Let's connect and get you plugged into the guild! Or check out our workspace directly at [sheinnov8.vercel.app]

AI coding agents are getting very good at writing code. They can build components, create APIs, fix bugs, and implement features from short prompts. But I kept noticing one issue: Working code does not always mean a good product. For example, if you ask an agent: “Add a delete button to every project.” It may technically do exactly that. But will it also think about: confirmation before deletion error handling undo options accessibility clear feedback to the user Those are not just coding problems. They are product judgment problems. That led me to experiment with a reusable instruction layer for AI coding agents at AudranLab. The idea is simple: Instead of only asking an agent, “Can you build this?”, also encourage it to ask, “Is this a good way to build it?” I want agents to consider things like accessibility, failure states, destructive actions, usability, and sensible defaults while they work. This does not magically turn an AI into a product designer. But I think it raises an interesting question: Can explicit product principles consistently improve the quality of software generated by coding agents? That is what I’m currently exploring. My next step is to test the approach across different coding tasks and compare the results with and without the additional product-judgment layer. If you’re interested in AI agents, LLM reliability, developer tools, or applied AI, I’ll be sharing more experiments here. AudranLab: https://www.audrantechlab.online/

How to run internal phishing simulations for your organization (free & self-hosted) Phishing is still how most breaches start. The single most effective defence isn't another mail filter — it's people who can spot a lure and report it. The way you build that instinct is internal phishing simulations : controlled, authorized fake-phishing tests of your own employees, paired with training the moment someone slips. This is a practical guide to doing that well — and doing it for free, on your own infrastructure, with an open-source tool. First rule: authorization, always Internal phishing simulation means testing people who have agreed to be tested — your own organization, or a client with a signed engagement scope. Point a phishing tool at anyone outside that and you're very likely breaking the law. Keep a record of your authorization, tell leadership and (per your policy/works-council rules) employees that a program exists, and never use captured data for anything but the training exercise. Good tools are built as trainers , not credential-harvesters — for example, they don't store the passwords people type into a fake login page by default. With that ground rule set, here's what a real program looks like. A good program is a loop, not a single test "Who clicked?" is where most free tools stop. A program that actually reduces risk runs four stages: Attack — send a believable lure and track engagement per person. Report — make it one click for employees to report suspicious mail, and give them credit when they do. Train — the moment someone clicks or submits, teach them what they missed. Measure — roll it all up into a human-risk score you can trend over time. You can assemble this from separate tools, or use one platform. Below I'll use VoltPhish , an open-source, self-hosted platform that does the whole loop from one Docker container. (If you only need email click-tracking, GoPhish is the classic minimal option; commercial suites like KnowBe4 or Proofpoint do all of

GitHub热门项目 | Scalable CLI | Stars: 427 | 20 stars today | 语言: Rust

GitHub热门项目 | Python toolkit for quantitative finance | Stars: 12,772 | 25 stars today | 语言: Python

GitHub热门项目 | "AI-Trader: 100% Fully-Automated Agent-Native Trading" | Stars: 21,730 | 155 stars today | 语言: Python

GitHub热门项目 | Drop in a screenshot and convert it to clean code (HTML/Tailwind/React/Vue) | Stars: 75,295 | 309 stars today | 语言: Python

GitHub热门项目 | GitNexus: The Zero-Server Code Intelligence Engine - GitNexus is a client-side knowledge graph creator that runs entirely in your browser. Drop in a git repository (Github, Gitlab, Azure, Local) or ZIP file, and get an interactive knowledge graph with a built in Graph RAG Agent. Perfect for code exploration | Stars: 46,029 | 189 stars today | 语言: TypeScript

The group infected more than 1,000 organizations in a relentless supply-chain attack campaign.

Last week OpenAI published its technical report on the Hugging Face incident, METR published an independent one, and the headlines turned it into "AI broke loose". It did happen. That part is real. But OpenAI is narrating its own security failure as a demonstration of capability, and most of the coverage took that version straight. I read the OpenAI post, the METR report and a few of the critical takes. Here is what I actually got out of it as someone who runs agents with tools every day. What happened, short version Between May and July 2026, agents in OpenAI's internal RL training and evaluation runs found a way to talk to each other through Artifactory, the package manager hosted inside their sandbox. They turned it into a message board. Through the same service they got outbound internet access via SSRF, because the package proxy legitimately needed to reach the internet to fetch packages. On July 4 the message board traffic took Artifactory down. Security rebuilt it, which wiped the board. Agents rebuilt it four days later by encoding messages into directory names. Then it escalated. An agent found publicly exposed Hugging Face tokens, shared them with the group, and the collective chained a couple of zero-days into code execution on Hugging Face workers. Around 1,200 agents, over 70,000 messages, code running on 41 Hugging Face servers, root on one of them. Hugging Face disclosed it on July 16. OpenAI admitted its models were behind it on July 21. Real incident, real zero-days, real third party affected. Nobody disputes that. Three things the headlines skip It was not a conspiracy of 1,200 minds. Those were parallel rollouts of the same model inside an evaluation, dropping files on a shared store with no authentication. The "secret message board" was directories in a package manager. Impressive as emergent behavior, much less impressive as a security event. It was not a plan, it was reward hacking. Out of 898 tasks in the ExploitGym benchmark, 198 had never be

GitHub热门项目 | Daily updated list of Tech Company OAs and Interview Problems. Save your time from finding them all over the internet. | Stars: 4,635 | 98 stars today | 语言: Python

I recently built and open-sourced Flaky HTTP , a small Java 11 library for deliberately making HTTP calls less reliable. That may sound like an unusual goal. Most of the time, we work hard to make HTTP calls reliable. We add retries, timeouts, circuit breakers, fallbacks, caches, and monitoring. But eventually we need to answer a more difficult question: How do we know any of that behavior actually works? The original idea was simple: wrap Java's standard HttpClient , add controlled latency or synthetic HTTP errors to selected requests, and leave the rest of the application unchanged. That simple idea led to a few interesting decisions around API design, asynchronous cancellation, response body handling, deterministic testing, and the boundary between application-level failure injection and real network chaos. This article goes beyond a launch announcement. I want to explain why I built the library, how it works internally, where it is useful, and where it is deliberately limited. TL;DR Flaky HTTP is a lightweight wrapper around Java 11's java.net.http.HttpClient . It can: add fixed or random latency; return synthetic HTTP errors with a configurable probability; target requests using a full-URI regular expression; handle synchronous and asynchronous calls; propagate cancellation for delayed asynchronous work; and run without runtime dependencies beyond Java 11. The Maven coordinate is com.tapadyuti:flaky-http:1.0.0 . The shortest useful test setup is a deterministic failure: FlakyConfig config = FlakyConfig . builder () . failureRate ( 1.0 ) . errorStatus ( 503 ) . build (); Every targeted call now returns an empty synthetic 503 response without reaching the network. Replace 1.0 with 0.0 and add LatencyStrategy.fixed(500) when the test should exercise slowness without an HTTP error. It is intended for integration tests, resilience tests, local development, and controlled demonstrations. It is not a replacement for a network proxy or a full chaos-engineering platform

GitHub Trending Digest — 28 Agustus 2026 Minggu ini, repo-repo di GitHub menunjukkan arah yang cukup jelas: AI agent menjadi semakin otonom dan ringan . Dari framework yang membuat agent berpikir hemat kode, hingga engine lokal untuk model MoE (Mixture of Experts) yang bisa berjalan di hardware apa pun, ekosistem open source terus mendorong batas apa yang mungkin dilakukan developer dengan sumber daya terbatas. Berikut rangkuman lima repository paling trending minggu ini. 1. deepseek-ai/deepseek-harness ⭐ 200.216 Bahasa: TypeScript DeepSeek Harness mengusung filosofi "Everything is a Plugin" . Repositori ini menawarkan kerangka kerja yang memungkinkan developer membangun pipeline AI secara modular, di mana setiap komponen—mulai dari preprocessing data, inference, hingga post-processing—dapat ditukar seperti lego. Dengan pendekatan berbasis plugin ini, tidak ada lagi lock-in ke satu library atau model tertentu. Mengapa repo ini trending? Karena komunitas sedang haus akan fleksibilitas. DeepSeek sendiri terus merilis model yang kompetitif dengan model besaran internasional, dan Harness memberi jalan bagi developer untuk mengintegrasikannya tanpa ribet. Use case praktis: Membangun sistem RAG (Retrieval-Augmented Generation) di mana Anda bisa mengganti embedding model, vector store, dan LLM backend tanpa mengubah logika inti aplikasi. 2. DietrichGebert/ponytail ⭐ 114.054 Bahasa: JavaScript Ponytail memperkenalkan pendekatan unik: membuat AI agent bersikap seperti "senior developer paling malas di ruangan" . Filosofi dasarnya sederhana—kode terbaik adalah kode yang tidak pernah kamu tulis. Ponytail mendorong agent untuk memaksimalkan reuse, meminimalkan boilerplate, dan menolak menulis ulang hal yang sudah ada. Trending karena resonansi budaya. Kalimat "the best code is the code you never wrote" langsung menyentuh pain point developer yang sering terjebak menulis ulang solusi yang sudah tersedia. Ponytail bukan sekadar tool, tapi semacam mindset yang dikodekan. Use case

God’s Eye View was the top project on GitHub Trending when we selected it for Jian AI Lab’s daily experiment. The pitch is immediately compelling. It brings aircraft, vessels, satellites, earthquakes, wildfire data, traffic, CCTV sources, and other feeds into one 3D globe. The repository also makes a serious effort to label data as live, modeled, reconstructed, or simulated. We tested commit b22573a9db28e47c324821ebdd4c67bdb241c0e1 on Linux with Node.js 24.19.0 and npm 11.9.0. Installation and security checks We first ran npm ci --ignore-scripts , reviewed the install-script sources, and then ran the normal npm ci . Both installations succeeded with 201 packages. The root project has no preinstall, install, or postinstall hook. Transitive install scripts come from esbuild, fsevents, Puppeteer, and sharp. npm audit --omit=dev reported no known vulnerabilities in production dependencies. A common secret-pattern scan did not find hard-coded live credentials. This is a limited check, not a full source audit. The project talks to many external services, including Google Maps, OpenAI, OpenSky, AISStream, NASA FIRMS, TomTom, CelesTrak, OSM, Open-Meteo, GDELT, and Radio Browser. It is local-first, but it is not offline. Server-side keys such as OpenAI and AISStream are read by the local Vite proxy. Google Maps and Cesium tokens are intentionally delivered to the browser. Users must restrict referrers and APIs and set provider budgets and quotas. 2,588 visible assertions passed The main test suite reported 2,587 passing assertions and zero failures. A separate focus-allocation check added one more passing assertion. The visible total was 2,588 passes and zero failures. The process did not exit after the summary. We waited more than 90 seconds and interrupted it manually. The final exit code was 130. The precise result is that all visible assertions passed, while the official test command did not complete with a clean exit in this environment. This may indicate an open handle

Your filesystem is already a database. Most tools just don't treat it that way. That's the core idea behind the Markdown Database Pattern — written up properly on The Way of Markdown , a site we've been contributing to that makes the case for building things on plain markdown instead of locked-in platforms. We think it's a pattern worth more attention, so here's the short version. Treat a folder of markdown files as a database. Each file is a record. Frontmatter fields are columns. Directories are tables. Tags, wikilinks, and tasks in the body become queryable relations. Filesystem Database ────────────────────────────────── markdown file → record frontmatter field → column directory → table #tag → tag relation [[wikilink]] → link relation - [ ] task → task relation You get portability, version control (git works perfectly on plain text), no framework lock-in, and full queryability. You give up scale and real relational joins — this isn't for millions of records. It's a lightweight database, honest about its limits. Once you name it, you start seeing it everywhere. Obsidian Bases and Dataview already do versions of this, half-consciously. A team wiki where every page has a status and owner field is one. A blog with date and tags in frontmatter is one — it just doesn't know it yet. Sweet spot: up to roughly 10k files. Past that, reach for a real database. Below it, this gets you almost everything a database gives you, at a fraction of the complexity, with none of the lock-in. The full writeup — the complete tradeoff analysis, a worked example with actual queries, how to implement it in a weekend, and the tool ( MarkdownDB ) that does it for you — is here: wayofmarkdown.com/markdown-database