标签：#rce

TL;DR — I've been building the Social Resource Floor: an open blueprint for coordinating one person's access to basic survival resources — food, housing, energy, healthcare, and more — across many independent providers, so that reaching those resources is grounded in being human rather than in financial access. The first blueprint version is now complete: language-neutral schemas, prose specifications, a reference implementation, and a first adapter. This post is about the engineering choices behind it, and the reasons for each — how it stays a contract rather than a product, how it keeps personal data out of the coordination layer, why it binds to existing standards instead of inventing new ones, and how I check that the contracts are implementation-independent rather than just claiming they are. The problem the Floor is trying to help with Today, for most people, survival routes through financial access. To reach food, housing, energy, or healthcare you generally need money, and to hold or move money you need banking, employment, or purchasing power. Financial access has become the gate standing in front of the resources a person needs to stay alive. The goal of the Social Resource Floor is narrow and specific: to help make it so that financial status is not the condition that determines whether a person can reach the basic resources required to survive. It does not try to abolish money, banks, or markets — money stays a first-class resource and delivery method. It aims at one thing: a floor beneath which no person should fall, defined locally, reachable regardless of financial circumstances. That's the mission. Everything technical below exists to make that mission buildable by the institutions — governments, municipalities, NGOs, cooperatives, community providers — that would actually run it, without asking any of them to give up their own systems or hand over their data. Where the Floor sits The delivery systems for social protection already exist and are stron

I have been an avid privacy advocate for quite some time now. It started with outright rejecting all "Big Brother" tech, and being hyper paranoid with every little detail, willing to sacrifice ease of use, in exchange for added privacy. However, as time went on, I slowly understood what is that I actually consider my "threat model" , and what exactly is my "sweet spot" between privacy and ease-of-use. I'm now back on multiple "Big Brother" tech, with some extra steps, to ensure I get the facilities they provide, while also being wary of my data. However, while I did make this compromise, I was very annoyed I had to make this compromise in the first place. In an ideal world, I would want the tech where everyone actually is, and is the standard for that particular domain, to have privacy features by default, and not be treated as a niche, or a luxury you have to go out of your way to avail. It was this annoyed version of myself, with my strong belief of privacy features and tools being the new norm, I started looking at everything with that lens. And that is how I got concerned about tracking in links and URLs. Try sharing any Instagram post, or YouTube video, by copying its URL, and you will see a bunch of garbage (garbage to you) in the link. Take for example this (fake) link: https://www.instagram.com/p/Cxyz123/?igshid=AbCdEf123456 These links contain something along the lines of utm_* (marketing attribution), or in this case, Ad-Click Identifiers, such as fbclid (Meta), gclid (Google), or igshid (Instagram). These pesky trackers help collect information regarding you, your device, and also help connect you across the internet, mapping your movement as you browse the web. The thing is, while there are good Samaritans who have built tools and websites to get rid of these trackers, and many privacy oriented browsers have introduced a "Copy Clean Link" option while copying the link from the browser, I believe there should be a tool which should not be restricted to a

I’ve been building an open-source project called TraceMotive. It started from a problem I kept running into with AI agents: When an agent run fails, the place where the error appears isn’t always where the execution first started going wrong. That makes debugging agent workflows harder than it looks. So I built TraceMotive, a local-first tracing and debugging tool for AI agent execution. What TraceMotive does The current v0.1 includes: Python SDK canonical traces and spans a local Collector backed by SQLite a React UI for inspecting agent runs optional OpenAI Agents SDK integration TraceMotive is local-first, and content capture is disabled by default. I’m intentionally keeping the first version small. I’m not trying to add replay, automatic root-cause analysis, cloud sync, or support for every agent framework yet. Why? I’d rather get real feedback before adding a lot of features. Right now I want people who actually build AI agents to try it and tell me: where setup is confusing what breaks what information is missing from traces what feels awkward in the API The longer-term direction is: “The causal debugger for AI agents.” Eventually, I want TraceMotive to help identify where an agent execution first started going in the wrong direction, instead of only showing where the final error appeared. But first, I want to make the basic observation and debugging layer solid. Try it PyPI: pip install tracemotive GitHub: https://github.com/doraemonfv-glitch/tracemotive If you build AI agents, I’d really appreciate you trying it for a few minutes and telling me what you run into. Even small feedback is useful.

GitHub: https://github.com/kaifcodec/user-scanner.git If you've spent any time mapping digital footprints or doing threat intelligence, you know the drill: run Holehe for email registration checks, jump over to Sherlock or Maigret for usernames, and manually piece together the findings. While Holehe set the benchmark for password recovery endpoint checks, modern targets use complex handles, and web anti-bot defenses have gotten aggressive. Lately, I've integrated user-scanner into my workflow—a high-concurrency Python CLI engine that merges email enumeration, username profiling, and automated cross-pivoting into a single execution stream. Here is a breakdown of how it holds up against legacy OSINT tools and why it’s worth adding to your toolkit. Tool Matrix: user-scanner vs. Traditional Registration Checkers Feature / Metric Holehe Sherlock / Maigret user-scanner Input Flexibility Email Only Username Only Dual Engine (380+ Vectors) Vector Split ~120 Email Sites Web Form Scrapers 155+ Email & 225+ Username Modules Target Pivoting Manual Manual Automated Recursive Cross-Scanning Infostealer Intel None None Built-In Hudson Rock API ( --hudson ) Networking Core Basic Async Standard Requests httpx + curl_cffi (TLS Impersonation) Output Options Text / JSON Text / CSV PDF (with Avatar Scrapes), JSON, CSV Package Support Pip Pip Pip, Virtualenv, Nix ( nix run ) Standout Technical Features 1. Automated Cross-Scanning & Pivot Chains ( --cross-scan ) The biggest time-saver is the pivot pipeline. Standard tools tell you whether a target exists on a platform and stop there. user-scanner parses profile metadata returned during a run—looking for linked accounts, published bios, handles, and public emails—and automatically launches follow-up scans across secondary modules. -e → Username Pivoting: Mines handles and linked profiles returned from an email lookup. -u → Email Pivoting: Harvests public email addresses listed on social profile pages. Configurable Chain Depth: Dial in how

X is expanding the open source code behind its 'For You' feed and launching new transparency tools that show users when its ranking systems have affected their accounts or posts.

See how the open source projects in Session 4 of the GitHub Secure Open Source Fund combined AI-assisted workflows, maintainer expertise, GitHub security tools, expert guidance, and funding to improve project security. The post What 50 open source projects taught us about security in the AI era appeared first on The GitHub Blog .

If you've been watching the open text-to-video space, MiniMax-H3 is one of the more interesting drops of the year. It generates short cinematic clips with a synced soundtrack from a text prompt, and you can drive it end-to-end without ever touching a GPU yourself. The easiest way to explain what that actually looks like is to point at the results people have been posting. My feed has been full of H3 recreations of famous TV moments — Breaking Bad lab scenes, Friends coffee-shop bits, mockumentary moments from The Office . // Detect dark theme var iframe = document.getElementById('tweet-2084562933162602866-755'); if (document.body.className.includes('dark-theme')) { iframe.src = "https://platform.twitter.com/embed/Tweet.html?id=2084562933162602866&theme=dark" } In this post I'll cover: What MiniMax-H3 actually is How you can run it yourself What is MiniMax-H3? MiniMax-H3 is a text-to-video model that produces short clips at cinematic resolutions. Two things make it stand out compared to earlier open video models: Sound comes out of the same model. Most open text-to-video pipelines output silent frames and you bolt on a separate audio model afterwards. H3 emits a soundtrack aligned with the visual content in one pass. // Detect dark theme var iframe = document.getElementById('tweet-2084353489061499021-723'); if (document.body.className.includes('dark-theme')) { iframe.src = "https://platform.twitter.com/embed/Tweet.html?id=2084353489061499021&theme=dark" } Keyframe conditioning. You can pass an optional first frame and/or last frame image and the model will interpolate a motion path between them. This turns it from a pure "vibe generator" into something you can actually direct. // Detect dark theme var iframe = document.getElementById('tweet-2084378446122319973-582'); if (document.body.className.includes('dark-theme')) { iframe.src = "https://platform.twitter.com/embed/Tweet.html?id=2084378446122319973&theme=dark" } The knobs are the ones you'd expect: Prompt — free f

GitHub热门项目 | Self-hosted, semantically-connected personal knowledge base | Stars: 1,785 | 44 stars today | 语言: Rust

GitHub热门项目 | 缠中说禅技术分析工具；缠论；股票；期货；Quant；量化交易 | Stars: 5,804 | 61 stars today | 语言: Rust

GitHub热门项目 | Full-stack web application template with FastAPI, React, SQLModel, PostgreSQL, Vite, Tailwind CSS, shadcn/ui, FastAPI Cloud, and Docker Compose. | Stars: 44,827 | 90 stars today | 语言: TypeScript

GitHub热门项目 | Desktop app to generate 3D models from images using local AI — runs entirely on your GPU | Stars: 5,165 | 70 stars today | 语言: TypeScript

GitHub热门项目 | Open-source All in One AI agent workspace. Run any agent — Claude Code, Codex — across your tools (100+ integrations + MCP), apps, browser, and files, with shared memory. Built-in models or BYOK. | Stars: 6,191 | 258 stars today | 语言: TypeScript

GitHub热门项目 | Virtual Machine for the Web | Stars: 17,219 | 14 stars today | 语言: JavaScript

GitHub热门项目 | An Industrial-Level Controllable and Efficient Zero-Shot Text-To-Speech System | Stars: 22,800 | 137 stars today | 语言: Python

GitHub热门项目 | holehe allows you to check if the mail is used on different sites like twitter, instagram and will retrieve information on sites with the forgotten password function. | Stars: 12,201 | 166 stars today | 语言: Python

I wanted one set of SQL checks to work in three places: while exploring a query, from a terminal and during code review. That became SQL Atlas. It is a local, deterministic SQL analyzer with a browser interface, a CLI and a GitHub Action. This article covers the interfaces, the CI contract and the limits of static SQL analysis. One analyzer, three interfaces The analyzer returns structured data instead of printing messages directly. Each interface decides how to present the same result: The browser explains findings and links them to learning material. The CLI returns text, JSON or Markdown and uses stable exit codes. The GitHub Action converts findings into file annotations and a job summary. Keeping presentation outside the analyzer prevents the CLI and Action from becoming separate implementations with different behavior. A CLI needs a contract The CLI accepts one or more files, or SQL through standard input: npx --yes sql-atlas@0.5.1 analyze query.sql echo "SELECT * FROM customers;" | npx --yes sql-atlas@0.5.1 analyze - It supports PostgreSQL, MySQL, Oracle, SQLite, SQL Server and a generic mode. Output can be text for a person, JSON for another program or Markdown for an issue or report. Exit codes are part of the interface: 0 means analysis completed and the configured policy passed. 1 means analysis completed but a severity or score threshold failed. 2 means the command or input was invalid. This distinction matters in CI. A policy failure is not the same as a broken invocation. Turning findings into pull request feedback The Action runs as a bundled Node 24 program and does not download dependencies at runtime. A minimal workflow looks like this: name : SQL review on : pull_request : paths : - " **/*.sql" permissions : contents : read jobs : sql-atlas : runs-on : ubuntu-latest steps : - uses : actions/checkout@v7 - uses : milekv/sql-atlas@v0.5.1 with : paths : | migrations/**/*.sql schema/**/*.sql dialect : postgresql fail-on : critical min-score : 60 Findin

Records obtained by WIRED detail hundreds of allegations of Customs and Border Protection workers misusing internal tools to look up romantic interests and track colleagues’ cell phones.

Being a developer, we all create many projects for learning, work, and experiments. Over time my machine started filling up — not with source code, but with generated junk : node_modules target dist / build framework caches like .next , .angular , .nuxt and more of the same across every cloned repo Every few months I would hunt folders manually, delete something, free a few GB, then the same problem would come back. Only learning about “clean your disk” tips doesn’t help much. Building something for the problem does. So I ended up building ArtifactSweep — a small open-source tool for this everyday developer issue. The real problem As developers we regenerate these folders all the time: npm install cargo build ng build They are not our source of truth. But they sit on the SSD for months. The painful part is not only size. It is: Finding them across many project roots Knowing how big they are before delete Not deleting the wrong folder by mistake I wanted something that could: Scan a folder tree Show sizes Let me clean with more control Work on my day-to-day machines (Windows, Linux, Mac) Step 1: Start with a CLI I started with the command line first. Why CLI? Fast to build and test Fits terminal-first workflow Easy to script and share The CLI is called sweep . Basic usage: # Safe: only list junk under a path sweep scan . # Preview deletes sweep clean . --dry-run # Delete sweep clean . On one of my project folders alone, it reclaimed nearly 5 GB . That was enough validation: this is not a fake problem. Every active developer hits it. Step 2: Then came the desktop app CLI is great when you already know the path and trust dry-run. But sometimes I wanted to: See a list of folders and sizes Filter by type Confirm before delete Click through without remembering flags So I added a desktop app on top of the same idea (same cleanup job, different UI). Flow is simple: Choose folder Scan Review results (and filters if needed) Clean with confirmation If you like GUIs for this ki

In my previous article, I talked about Train Track, the transit app I built around Metro Manila's railway systems. This project started with a completely different problem. I kept thinking about how difficult it can be to discover hackathons and coding competitions. Not because they don't exist. They do. The problem is that they're scattered everywhere. A university might announce one. A government agency might host another. A private company might run one. A developer community might post another. And suddenly you're checking multiple websites just to figure out: What can I actually join? So I built HackForPinas. What is HackForPinas? HackForPinas is a free, public, and open-source directory for Philippine: Hackathons Coding challenges Technology competitions The idea is pretty straightforward: Make opportunities easier to discover. Events can be filtered by: Region Format Organizer type Status Organizers are categorized as: Government University Private Instead of browsing through unrelated websites, users can explore opportunities in one place. But the more I worked on it, the more I realized that the directory itself wasn't the hardest part. The data was. The Data Problem Imagine trying to collect hackathons from different websites. One might have an RSS feed. Another might use WordPress. Another might expose an API. Another might have an ordinary HTML page. And another might not have anything structured at all. So HackForPinas uses multiple scraping strategies: WordPress REST API RSS GDG Community Eventbrite HTML + Cheerio The scraper runs through a background endpoint and collects events from different Philippine technology sources. The interesting part wasn't: "Can I scrape a website?" It was: Can I turn information from completely different sources into one consistent dataset? That became a much more interesting engineering problem. I Didn't Want Anyone to Publish Directly There's another problem with a public directory. If anyone can submit an event, what s

Ever since I joined the platform, I wanted to post about a topic I was really passionate about....