标签：#rce

Originally published at avalayer.com/writing , Field Notes 003. Last Sunday a piece of software posted to an IETF mailing list. Not through someone's account as a tool. Under its own signature: "Composed and sent by Elara, this project's AI maintainer, acting under its receipted on-chain mandate," followed by a receipt string you could write down. A reviewer on the list did what reviewers do. He declined to take the claims on faith and asked for manifests and reproducible vectors. The software shipped a corrected test-vector pair with a patch inside a day. A third participant then reproduced the whole thing independently, and along the way discovered that the mailing list itself had corrupted the patch in transit, normalized exactly those transport changes, and got the declared hash back. His summary was a model of saying only what you know: the reproduction establishes the artifact, he wrote, not adoption, and not the broader truth of the events the artifact records. So that happened. An agent that says its name, names its principal, and does the work, on the public record of a standards body. Meanwhile, in front of the same working group, there is a proposal to let automated clients prove they are trustworthy without ever saying who they are. It is called Anonymous Bot Authentication, and the mechanism is elegant. A bot registers with an entity called an Anchor, which checks that it complies with some published policy. The Anchor issues a credential. The bot presents that credential to a website, and the site learns exactly one thing: this client was vetted by that Anchor. Not which client. Not whether it has been here before. Not whether the request an hour ago came from the same machine. The cryptography is designed so the site cannot tell, and so the Anchor cannot follow the bot around either. The reflex, if you sell verification for a living, is to treat the masked agent as a threat and the named one as a relief. I want to argue that both reflexes are wrong in

A few months ago I got properly bitten by the Linux bug. Ubuntu became my daily driver, I started digging into terminal tools way past the point of “practical necessity,” and I got obsessed with an idea that wouldn’t leave me alone: old hardware doesn’t have to die just because it’s old. I work as an on-site IT coordinator, handling day-to-day IT operations for an industrial company. Between that and years of general sysadmin work, I’ve watched a lot of perfectly usable machines get pulled out of service and shipped off as e-waste — not because they were broken, but because someone decided they were “too old” for whatever OS they were running. A Core 2 Duo with a fresh SSD and a lightweight distro can still be a genuinely useful computer.That gap between “technically obsolete” and “actually still works great” is where a lot of my curiosity lives right now. The gap I kept running into The more I looked into the Norwegian Linux scene, the more I found — Skolelinux/Debian Edu has deep roots here, NUUG (Norwegian Unix User Group) has been active for decades, and there’s a project called PC-Aid that collects, wipes, and reinstalls Debian Edu on used PCs, then sends them to schoolchildren in Ukraine. It’s been running for a few years now, quietly doing real, tangible good. I wanted in. But when I looked for any of this activity near me — Sunnmøre, a district on Norway’s west coast (in Møre og Romsdal county, home to the town of Ålesund) — there was nothing. No local NUUG chapter, no meetup, no group. Just… a gap. (If you’re not from Norway, don’t worry, most Norwegians would need a map for this too.) So instead of waiting for someone else to fill it, I started SLUG — Sunnmøre Linux User Group. Reaching out, awkwardly, like you do Starting a group is the easy part. Getting it to mean anything is harder. So I did the obvious thing: I found people who’d actually been part of PC-Aid and reached out. First was someone who’d been active in the project early on. I sent a message

GitHub热门项目 | | Stars: 11,959 | 137 stars this week | 语言: TypeScript

GitHub热门项目 | Leading Git-based headless CMS. Successor to Netlify/Decap CMS. Modern UX, first-class i18n support, mobile support + numerous improvements. Hundreds of real-world examples. Framework-agnostic, open source & free. | Stars: 2,687 | 40 stars this week | 语言: JavaScript

GitHub热门项目 | Local-first desktop markdown editor | Stars: 1,265 | 76 stars today | 语言: TypeScript

GitHub热门项目 | Making ComfyUI more comfortable! | Stars: 3,326 | 7 stars today | 语言: JavaScript

GitHub热门项目 | Global MapleStory Server BeiDou(冒险岛GMS服务端北斗) | Stars: 615 | 2 stars today | 语言: JavaScript

GitHub热门项目 | Practical patterns, starters & CLI tools for loop engineering with AI coding agents. Design systems that prompt and orchestrate agents (inspired by Addy Osmani and Boris Cherny). Includes loop-audit, loop-init, loop-cost. | Stars: 10,105 | 83 stars today | 语言: JavaScript

GitHub热门项目 | Uncensored local AI studio for Windows, Linux, and macOS. Zero-setup GUI for Image Generation, GGUF LLMs, Text to Speech & Speech to Text | Stars: 882 | 35 stars today | 语言: JavaScript

GitHub热门项目 | DSPy: The framework for programming—not prompting—language models | Stars: 37,001 | 152 stars today | 语言: Python

GitHub热门项目 | The open-source app everyone uses to manage agents at work | Stars: 76,192 | 167 stars today | 语言: TypeScript

This is good : Post-quantum cryptography is now one pip-install away for the entire Python ecosystem. With funding from the Sovereign Tech Agency , we implemented support for ML-KEM, the NIST-standard key-establishment primitive, and ML-DSA, the NIST-standard digital-signature primitive, in pyca/cryptography. Remember, the reason to do this now is because there’s no emergency. And because you will make your systems crypto agile, which is always a good idea.

Anyone can port a library. Point a translator at the source, clean up the output, get it to compile, and you have something that looks like a port. The actual engineering problem is different and much harder: proving that the new code means the same thing as the old code, across thirty algorithms, hundreds of edge cases, and a test suite written by people who were not thinking about you. This is the story of porting textdistance , a Python library for measuring string similarity, to Rust. The result is textdistance-rs . The porting took a fraction of the time. Everything else: the differential fuzzing, the 140 divergences, the 35 year old threshold I violated, the floating-point drift at the 15th decimal place, is what this writeup is actually about. Thirty algorithms and one architectural bet The original textdistance covers a lot of ground: edit-based distances (Levenshtein, Damerau-Levenshtein, Hamming, Jaro-Winkler), token-based measures (Jaccard, Sørensen-Dice, cosine, Tversky), sequence-based methods (LCS, Ratcliff-Obershelp), phonetic algorithms (MRA, Editex), and compression-based distances built on normalized compression distance. Over thirty algorithms in total, all reimplemented in Rust. But before writing a single algorithm, I had to make the decision that shaped everything downstream: how does the existing Python test suite (397 tests I did not write) talk to the Rust code? The obvious answer is PyO3: wrap every algorithm in a #[pyclass] , build a native extension, and the Python tests import Rust directly. The answer I chose instead was a subprocess CLI. The Rust core is a standalone binary that speaks JSON over stdin/stdout, and a thin Python adapter shells out to it: // The entire cross-language surface is one struct. #[derive(Deserialize)] struct Request { algorithm : String , s1 : String , s2 : String , qval : Option < usize > , external : Option < bool > , } fn dispatch ( req : & Request ) -> Response { match req .algorithm .as_str () { "hamming"

Originally published on IFEELVOID . Play the song and count the pulse for 15 seconds. Multiply that number by four. If you counted 35 beats, the song is roughly 140 BPM. That is the fastest manual way to find the beat of a song. It is also where the confusion starts. A trap record at 140 BPM can feel like 70. A drumless intro can hide the pulse completely. A sample can drift. And knowing the tempo still does not tell you the musical key you need for bass lines, vocal tuning, remixes, or harmonic mixing. This guide gives you the manual method, the DAW method, and the faster analysis workflow I use when a session cannot stop for guesswork. First: what does “beat” mean? People use “beat” to describe three different things: The pulse: the steady count you nod your head to. The BPM: how many pulses happen in one minute. The instrumental: the drums, melody, bass, and arrangement behind a vocal. If you need the tempo and key so you can work with the audio, keep going. Method 1: count the BPM manually Find the strongest repeating pulse. In most trap and hip-hop records, start with the snare or clap. Count along for 15 seconds, then multiply by four. Start the song at a section where the drums are clear. Tap your foot or nod to the main pulse. Count every pulse for exactly 15 seconds. Multiply the count by four. Repeat once to make sure your count is stable. Twenty beats in 15 seconds is 80 BPM. Thirty beats is 120 BPM. Thirty-five beats is 140 BPM. Watch for half-time and double-time A beat can be represented at two mathematically correct tempos. A dark trap record may read as 70 BPM or 140 BPM depending on whether you count the slow backbeat or the faster production grid. Neither number is automatically wrong. Use the tempo that matches your purpose. Producers usually want the grid that makes drum placement and subdivisions easy. DJs may want the value that matches the rest of their library. Method 2: use tap tempo Most DAWs, DJ applications, and metronome tools include ta

Everyone demos a WhatsApp chatbot. Few run one in production with real customers sending real messages 24/7. After 18 months of running SARA — an open-source WhatsApp AI agent serving businesses across 20 industries — here's what we learned about architecture that survives contact with reality. Why WhatsApp? The numbers are simple: 2B+ monthly active users 60% of SMB customers prefer messaging over calling 98% open rate (vs 20% for email) But WhatsApp is NOT just another chat channel. It has unique constraints that break naive implementations. Architecture Overview WhatsApp (WAHA) → Bridge (:3008) → SARA API (:3006) → AI Provider Chain → Tool Dispatcher ↓ Groq → Cerebras → SambaNova → Mistral The Provider Fallback Chain Single-provider AI is a production risk. We use a 4-provider chain: Primary: Groq (fastest, free tier) ↓ fail Fallback 1: Cerebras ↓ fail Fallback 2: SambaNova ↓ fail Fallback 3: Mistral (paid, always works) Each provider gets 2 retries with exponential backoff before failover. Result: 99.7% uptime over 6 months with $0 inference cost (free tiers). Tool Calling: Not Just Chat SARA doesn't just answer questions. She executes actions: create_reservation — books a table with date normalization ("domani alle 8" → 2026-08-10T20:00) check_inventory — queries stock levels generate_invoice — creates a PDF from database records schedule_appointment — manages calendar slots The dispatcher maps 30+ tools to handlers with an autonomy gate: User message → Intent classification → Risk assessment → Tool execution ↓ Low risk: execute immediately Medium: execute + notify owner High: ask for confirmation first You do NOT want your AI agent booking a catering order for 500 people without human approval. PII Handling Messages contain names, phone numbers, addresses. Our pipeline: Anonymize before sending to LLM (replace "Mario Rossi" → "[PERSON_1]") Process with anonymized data De-anonymize tool calls only (the reservation needs the real name) Never log PII in plain tex

AWS introduced something this week that is close enough to the problem I have been working on that I do not think it should be casually labeled complementary. Amazon Bedrock AgentCore added temporal policies , along with an open-source policy language called Dogwood . Instead of asking only whether an individual tool invocation is allowed, the gateway can evaluate the sequence of actions that led to it. Consider a purchasing agent with this rule: purchases under $10,000 do not require escalation The agent makes six purchases of $9,000. Every individual action satisfies the rule. The sequence may violate the organization's intended limit. The same problem appears with approvals. An API call may be permitted only if a human approval occurred earlier in the workflow. Looking only at the final call cannot establish that condition. Something needs to remember the relevant execution history and evaluate policy against it. That is the class of problem temporal policy addresses. The interesting architectural choice is that this logic lives outside the agent. The model does not need to faithfully remember the constraint from its prompt. The runtime owns the control. More agent behavior is becoming explicit This is not the only sign that agent instructions are moving out of conversations and into inspectable artifacts. A recent ESEM 2026 study of Agent Plans screened 36,710 engineered GitHub repositories and found 85 Markdown plan files across 10 repositories. That is a very small population, so I would not interpret the result as evidence of broad adoption. But the content is interesting. Those plans commonly described implementation steps, specific files or locations, and testing or validation instructions. The agent's execution intent was being preserved as part of the repository. There is a similar pattern in distribution. Tenable's CyberAgents Exchange treats agents, skills, MCP servers, and multi-agent playbooks as separate reusable components. The ecosystem is graduall

Our AI Agent Failed 5 Times in One Day. Here is Why It Never Happened Again. LAO Runtime Protection in action — real failures, self-repaired, permanently prevented, zero repeats. August 9, 2026 · by the ZWISERFIT engineering team AI agents fail silently. LAO makes failures visible and fixable. On August 8, 2026, our agent orchestration system — LAO — ran a full 24-hour cycle under autonomous governance. The result: 5 distinct failures detected, repaired, anchored, and permanently prevented across 3 agents (Shuyu, Luna, Hermes) in 5 different failure modes. Not one error repeated. Not once did a founder intervene in the repair loop. That is the claim. Here is the evidence. The Philosophy: Errors Dont Reduce Trust — Hiding Them Does 错误不会降低信任，隐藏错误才降低信任。 Errors dont reduce trust. Hidden errors do. This isnt motivational rhetoric. Its an engineering constraint. Every event in our trust ledger follows the same chain: failure → detection → repair → prevention → anchor An anchor is the key word. Not a bug report that gets archived. A persistent, versioned rule that makes the same class of error structurally impossible going forward. Anchors are the immune memory of the system. All metrics below are verified from ledger data. Error 1: Feishu Hallucination + Skill Amnesia An agent pushed a platform integration the founder never asked for, then forgot the corrected instruction entirely. Correcting an agent without persisting the correction fixes nothing. Repair: Three immutable anchors locked output standards. Intent Validation Gate v2 now blocks any non-requested platform integration before it is attempted. Error 2: Port Confusion — Knowing ≠ Executing An agent understood the right pattern but executed the wrong port — twice. Knowing and doing diverged. Repair: Structural prevention, not a better prompt. Error 3-5: URL mishaps, gate collisions, and silent failures The same class of mistake hit multiple agents independently. One gate stopped all of them. The Numbers Metric Val

Hi. I made a small open source project called OTI. It is a simple way to share a message or a small .txt file through a link that can be opened once. I started it to learn more about AdonisJS 6 and browser encryption. I also wanted to leave a small useful project for other developers. The message is encrypted in the browser. The server only stores encrypted data. The private key stays in the link. The latest update adds a confirmation button before opening a secret, so chat previews do not use the link by accident. The secret is removed after the first real view. There is also a small creator receipt page, QR sharing, encrypted .txt files up to 100 KB, password protection and an expiry countdown. It is built with AdonisJS 6, TypeScript, MySQL, Redis, Edge and Vite. The code is MIT licensed. I used an AI coding assistant for parts of the implementation, review, formatting and documentation. I made the architecture and final decisions, reviewed the code and tested the changes myself. Demo: https://oti.karacabay.com/share Source: https://github.com/oguzhankrcb/OTI It is a small project and has not had a professional security audit. I hope it is useful to someone.

Giving an agent “web access” sounds like one feature. In practice, it is a stack of separate decisions: How does the system discover URLs? Which destinations can it contact? Does it need a browser, or is static HTTP enough? What turns the response into agent-ready data? Where are request, byte, depth, and time limits enforced? What evidence comes back with the extracted content? Treating all of that as one unrestricted browser capability makes systems difficult to reason about. A better approach is to choose the smallest acquisition surface that completes the job, then make its authority explicit. This article maps 50 current Cockroach Crawler capabilities into seven jobs. It is also a practical checklist you can use with another crawler: if a capability matters to your workflow, identify its input contract, output contract, failure behavior, and authority boundary before an agent depends on it. Disclosure: I’m Ajnas N B, the developer of Cockroach Crawler. The project is open source under the MIT license. Start with a finite crawl contract The next channel currently contains the reviewed 0.7.0-rc.1 prerelease. A bounded documentation crawl can start like this: npm install cockroach-crawler@next import { crawlDetailed } from " cockroach-crawler " ; const result = await crawlDetailed ({ seeds : [ " https://docs.example.com " ], allowedOrigins : [ " https://docs.example.com " ], include : [ " /guides/ " , " /reference/ " ], exclude : [ " /archive/ " ], traversal : " bfs " , obeyRobots : true , maxPages : 25 , maxRequests : 120 , maxDepth : 4 , maxTotalBytes : 10 _000_000 , maxDurationMs : 60 _000 , concurrency : 4 }); for ( const page of result . pages ) { console . log ( page . url , page . contentHash , page . markdown . length ); } The important part is not the number of options. It is ownership: the creator of the agent sets the origins and ceilings. Model-facing input can narrow that contract, but it should not be able to expand it. 1. Crawl and discover — 15 cap

GitHub热门项目 | 🤖 Headless UI for building powerful tables & datagrids for TS/JS - React-Table, Vue-Table, Solid-Table, Svelte-Table | Stars: 28,291 | 41 stars this week | 语言: TypeScript