标签：#rce

GitHub热门项目 | Local-first AI agent workspace for coding, writing, design, research, and automation — one runtime for desktop GUI and TUI. | Stars: 6,005 | 445 stars this week | 语言: TypeScript

GitHub热门项目 | Render JSX & HTML to image, SVG or PDF. 170+ CSS properties supported. Drop-in next/og replacement. | Stars: 2,737 | 15 stars today | 语言: Rust

GitHub热门项目 | A radically modular HTML/CSS rendering engine | Stars: 3,961 | 26 stars today | 语言: Rust

GitHub热门项目 | Developer-friendly OSS embedded retrieval library for multimodal AI. Search More; Manage Less. | Stars: 11,099 | 6 stars today | 语言: Rust

GitHub热门项目 | A one-of-a-kind resume builder that keeps your privacy in mind. Completely secure, customizable, portable, open-source and free forever. Try it out today! | Stars: 40,219 | 47 stars today | 语言: TypeScript

GitHub热门项目 | Next Generation Server Toolkit. Create web servers with everything you need and deploy them wherever you prefer. | Stars: 11,082 | 7 stars today | 语言: TypeScript

GitHub热门项目 | SD.Next: All-in-one WebUI for AI generative image and video creation, captioning and processing | Stars: 7,261 | 28 stars today | 语言: Python

GitHub热门项目 | Yet Another Document Translator | Stars: 9,225 | 69 stars today | 语言: Python

GitHub热门项目 | A benchmark built to evaluate and improve agent capabilities for supporting legal work. | Stars: 697 | 47 stars today | 语言: Python

GitHub热门项目 | Why is this running? Trace any process, port, container, or file back to what started it - CLI + TUI. | Stars: 20,264 | 556 stars today | 语言: Go

Authentication is often presented as a short sequence: Accept a username and password. Return a JWT. Protect a few endpoints. That is enough for a tutorial, but it is not an authentication lifecycle. Real applications must also answer harder questions: How is an email address verified without storing a reusable secret? What happens to existing sessions after a password reset? Can a user see and revoke a lost device? How do we prevent a rotated refresh token from being replayed? How should TOTP secrets and recovery codes be stored? How can an OIDC identity be linked without trusting email matching? I explored those questions while building FastAPI Production API v1.2.0 , a backward-compatible authentication lifecycle release for an open-source FastAPI backend foundation. This article explains the design decisions behind it—not just the endpoints that were added. 1. Model lifecycle tokens as scoped, single-use credentials Email verification and password recovery look similar from the outside: send a link, receive a token, and update an account. Treating them as interchangeable, however, creates unnecessary risk. The release uses account-action tokens with four important properties: Random: the token is generated as an opaque secret rather than derived from user data. Scoped: a verification token cannot be used as a password-reset token. Expiring: every token has a short, configurable lifetime. Single use: confirmation atomically marks the token as consumed. Only a hash of the token is persisted. The original value exists only long enough to be delivered to the user. This gives email verification and password reset a shared security primitive without making their policies identical. The main endpoints are: POST /auth/email-verification/request POST /auth/email-verification/confirm POST /auth/password-reset/request POST /auth/password-reset/confirm Both request operations return uniform responses. A caller should not be able to determine whether an email belongs to an a

AMD เปิดตัว Instella-MoE-16B-A3B — โมเดล AI ที่เทรนด้วย GPU ของตัวเอง ไม่พึ่ง Nvidia โดย Nokka (นก-กา) | 5 สิงหาคม 2569 AMD เพิ่งปล่อยโมเดล AI ตัวใหม่ที่สร้างความฮือฮาในวงการ เพราะไม่ได้เป็นเพียง "โมเดลฟรีอีกตัว" แต่มันคือการพิสูจน์ว่า GPU ของ AMD ก็เทรน AI ระดับท็อปได้จริง โดยไม่ต้องพึ่ง Nvidia [1][2] โมเดลชื่อ Instella-MoE-16B-A3B มีขนาด 16 พันล้านพารามิเตอร์ แต่จุดเด่นคือไม่ได้ใช้ทั้งหมดพร้อมกันทุกครั้งที่ประมวลผล ใช้จริงแค่ 2.8 พันล้านตัวต่อคำ [1][2] นี่คือหัวใจของสถาปัตยกรรมแบบ Mixture-of-Experts (MoE) เปรียบง่ายๆ เหมือนบริษัทที่มีผู้เชี่ยวชาญหลายแผนก แต่ละงานจะถูกส่งไปให้แผนกที่เกี่ยวข้องเท่านั้น ไม่ต้องเรียกทุกแผนกมาประชุมทุกครั้ง ทำให้ประมวลผลเร็วขึ้นโดยที่โมเดลยังมีความรู้กว้างเหมือนเดิม [2] ในบทความนี้ผมจะพาคุณไปทำความเข้าใจว่าโมเดลนี้คืออะไร ทำไม AMD ถึงต้องทำแบบนี้ และถ้าคุณเป็นนักวิจัยหรือคนสนใจ AI ควรรู้เรื่องอะไรบ้าง ทำไมเรื่องนี้ถึงเป็นข่าวใหญ่ ประเด็นหลักไม่ได้อยู่ที่ตัวเลขสเปก แต่อยู่ที่ AMD เทรนโมเดลนี้ตั้งแต่ต้นจนจบด้วย GPU ของตัวเอง (Instinct MI300X และ MI325X) โดยไม่ใช้ Nvidia เลย [1][2] ปกติงานระดับนี้ต้องพึ่ง CUDA ของ Nvidia แทบทั้งหมด การที่ AMD ทำได้สำเร็จจึงเป็นสัญญาณว่าทางเลือกที่ไม่ใช่ Nvidia เริ่มเป็นไปได้จริง แถม AMD ยังเปิดให้ดาวน์โหลด weight ของทุกขั้นตอนการเทรน พร้อมโค้ดเทรน และสูตรผสมข้อมูลแบบเปิดหมด [1][2] นี่คือสิ่งที่ทำให้เรื่องนี้กลายเป็นข่าวใหญ่ เพราะเป็นการ "เปิดไพ่ทั้งหมด" ให้วงการตรวจสอบและต่อยอดได้ สถาปัตยกรรมของ Instella-MoE โมเดลนี้ใช้การออกแบบแบบ decoder-only MoE ที่มีส่วนผสมของนวัตกรรมทางสถาปัตยกรรมและระบบ [1] รายละเอียด ค่า Parameters รวม 16B Parameters active ต่อ token 2.8B Decoder layers 27 Hidden size 2048 Shared experts 2 Routed experts (เลือก 6 จาก 64) 6/64 ต่อ token Pre-training tokens 7.1T Context window 4K → 64K จุดเด่นทางสถาปัตยกรรม 2 อย่าง [1] Gated Multi-head Latent Attention (Gated MLA) — เพิ่ม output gate แบบเรียนรู้ได้ให้กับ attention ทำให้โมเดลเลือก "ลดทอน" คำตอบของ attention ที่มีประโยชน์ต่ำสำหรับแต่ละ token ได้ เพิ่มความสามารถในการแสดงออกของโมเดลด้วยต้นทุนต่ำ FarSkip-Collective — ปรับการเชื่อมต่อของ M

Hello everyone! This is the second article about the development of RUSEON-core, a Zero-Copy video streaming server for AI platforms and Edge video infrastructure. In the first article , I talked about the fundamental reason why we decided to create our own server in the first place. I also covered the main problem with most similar solutions — the "thundering herd" — and how we managed to squeeze out 8 Gbps on a single CPU core. By the way, I forgot to mention in that article that besides simple streaming, we also record the streams in fMP4 format. It’s stored locally for N amount of time, and it can fly off to an S3 bucket (depending on how long the clients want to keep the recordings). This article is precisely about a non-obvious (well, at least to me, maybe for someone else it's an everyday thing) problem related to data storage and its specifics across all Operating Systems. So, let's dive in. We rolled out our first release to production (100 cameras), made the clients happy, and started working. About an hour passed, and the alerts started flying. I SSH into the server, open htop, and see there's only 100 MB of free RAM. Uh-oh. I should clarify that the production server had 32 gigs of RAM. The expected behavior was that the CPU is chilling, the network card is chewing through the traffic, RAM usage is around 250-300 MB, and the disks are not heavily loaded. So, when you see numbers like that in htop, you start blaming yourself and your crooked hands that wrote this piece of "garbage". But still, we decided to go to Google, ChatGPT, and the like. Fortunately, the answer was found quickly, and we stopped beating ourselves up. The code was absolutely not the culprit; Linux itself ate the memory. If you've ever written tons of data to a disk, I think you already know what’s going on. There is an "invisible enemy" known as the Page Cache. That was exactly the root of this problem. How does the Page Cache work and what to do with it? When your function that is su

Headline: Vercel Sandbox runs untrusted code — including code a model just wrote — inside an isolated, ephemeral microVM instead of inside my application's own process. I moved every "let the model write and execute a snippet" feature off ad-hoc child_process calls and onto Sandbox: one sandbox per execution, a hard timeout, an isolated filesystem, and no path back into my app's environment variables. Key takeaways Vercel Sandbox ( @vercel/sandbox ) runs code inside an isolated Firecracker microVM, not a container in your app's own process — a compromised sandbox can't read your Vercel Function's memory or environment variables. A sandbox is ephemeral: you create one, run commands, read the output, then stop it. There is no persistent state between runs unless you explicitly persist it yourself. sandbox.runCommand() executes a process inside the sandbox and returns stdout, stderr, and an exit code; sandbox.domain(port) exposes a running server on a public URL for a live preview. The two cases I actually reach for it: an LLM-authored script that needs to run and return a result, and a user-facing "run this code" feature like an AI-generated component preview. Sandbox is not the tool for trusted, first-party build or CI logic — that belongs in the deploy pipeline. Sandbox is for code you did not write and do not trust. Why can't I just run AI-generated code inside my own Vercel Function? A Vercel Function shares its process, filesystem, and environment with the rest of my app. Running an untrusted string as code in that same process — through child_process.exec or, worse, eval — puts every secret the function can see, API keys and database URLs included, inside the blast radius of whatever the model wrote. A generated snippet can read environment variables, open an outbound connection to exfiltrate them, or just spin the CPU and starve every other request the function is serving at the same time. I treat any code I did not author myself as untrusted by default, and th

When I started building Weather Experience , I wasn't planning to release an open-source project. I simply wanted to answer a question: Could I build a modern radar rendering pipeline using NOAA's publicly available MRMS data? That question led me down a rabbit hole of GRIB2 decoding, radar products, rendering pipelines, performance benchmarking, and ultimately the release of MRMS Renderer , the first open-source project from Taylor Creative Development. Why MRMS? NOAA's Multi-Radar/Multi-Sensor (MRMS) system provides an incredible amount of weather data. For my use case, I focused on the ReflectivityAtLowestAltitude product because it provides an excellent foundation for radar visualization. The challenge wasn't obtaining the data. The challenge was turning that data into something useful. The Pipeline MRMS Renderer performs the complete workflow: Discover the latest MRMS products directly from NOAA/NCEP Download and decompress GRIB2 data Decode the grid using ecCodes Process reflectivity values with NumPy Render transparent PNG radar frames Generate an animation manifest Display animated radar over OpenStreetMap using Leaflet Everything runs locally. The project intentionally does not provide a hosted radar service. Instead, it demonstrates how developers can work directly with NOAA's publicly available data. Performance One of the biggest questions I had at the beginning was performance. Could this realistically be done fast enough for a modern application? Rather than speculate, I wrote benchmarks. On my M4 Pro MacBook Pro over a standard Wi-Fi connection, the complete pipeline—from downloading the latest MRMS frame through rendering the finished PNG—consistently completed in around two seconds . The surprising result wasn't the renderer. The renderer itself was already highly optimized using NumPy vectorization. The largest source of latency turned out to be downloading the GRIB2 data itself. That finding helped shape later architectural decisions for Weather E

I built RepoTrek , a terminal-first GitHub source browser written in Rust. GitHub: https://github.com/yuna-r/repotrek crates.io: https://crates.io/crates/repotrek The basic idea is simple: I wanted a comfortable way to deeply explore GitHub repositories without constantly switching between the browser, terminal, and editor. RepoTrek is not intended to replace Git clients such as git , lazygit , tig , or gitui . Its focus is different: Git client ↓ operate on a repository RepoTrek ↓ explore and read a repository Why I built it When reading open-source projects on GitHub, I often move through a sequence like this: Code ↓ Blame ↓ Commit ↓ Diff ↓ File history ↓ Another file GitHub's web interface is excellent, but when I spend a long time reading source code, I prefer staying in the terminal and using the keyboard. So I started building a TUI specifically around source code exploration . No clone required You can open a repository directly from GitHub. For example: rust-lang/rust or: torvalds/linux RepoTrek retrieves the repository information through GitHub APIs, so you don't need to clone the entire repository just to inspect it. This is especially convenient for quickly looking through large projects. Features RepoTrek currently includes: Repository tree browsing Source code viewer with line numbers Syntax highlighting Dark / Light themes Commit history Commit diffs File history Git blame Branch switching File search Repository-wide code search Symbol navigation Definition search Pull Requests Issues GitHub Actions Releases Keyboard-based text selection and copy Source/diff wrapping HTML export for printing The interface is designed to make moving between these views fast without leaving the terminal. Source code browsing The main view works like a terminal-native repository browser. src/ ├── app.rs ├── auth.rs ├── export.rs ├── highlight.rs ├── provider/ └── ui/ Open a file and RepoTrek displays it with line numbers and syntax highlighting. Common languages such as

A year ago, connecting a model to your tools meant writing glue for that model , in that framework , with that vendor's function-calling format. Swap the model and you rewrote the glue. In 2026, that pain is mostly gone, and the reason has a boring name: the Model Context Protocol (MCP) . MCP is worth understanding not because it's clever, but because it's winning — and the reason it's winning tells you where the industry's center of gravity is moving. What MCP actually is Strip away the branding and MCP is a small client–server contract for connecting language models to the outside world. A server exposes three kinds of things: tools (functions the model can call), resources (data the model can read), and prompts (reusable templates). A client — your IDE, your agent, your chat app — speaks the same protocol and can talk to any compliant server. The analogy people keep reaching for is USB-C, and it's accurate. Before USB-C you had a drawer full of proprietary chargers. MCP is the drawer-emptying moment for AI integrations: write the connector once, and any MCP-aware client can use it. Why "model-agnostic" is the whole point Here's the shift that matters. For most of the LLM era, your tooling was coupled to a model . If you built your agent stack around one vendor's function-calling quirks, you were locked in — a new, better model meant a migration project. MCP decouples the tooling layer from the model layer. Your filesystem server, your database server, your ticketing-system server don't know or care which model is on the other end. When a new flagship drops — and in 2026 they drop every few weeks — you point your client at it and keep your entire tool ecosystem intact. That's a strategic hedge, not just a convenience. In a market where the "best model" changes monthly, the durable asset is your integration layer , and MCP is how you stop rebuilding it. What to build with it Practical entry points, cheapest first: Wrap an internal system as a server. Your team's de

Most AI coding tools fail before they write a single line of code. The prompt was vague, and the model quietly filled the gaps with assumptions you never agreed to. You ask for "a task management CLI." The model picks a data model, a priority scheme, a persistence layer — all reasonable, none of them yours. You find out three files in, during review, and you rework it. That's the loop most of us are stuck in: prompt, guess, rework, repeat. Ouroboros is an open-source Agent OS that fixes the input instead of the output. It's a local-first runtime layer that sits in front of Claude Code, Codex CLI, OpenCode, Gemini CLI, GitHub Copilot CLI, Kiro, Hermes, Pi, and Zcode, and replaces ad-hoc prompting with a five-stage, replayable workflow: interview, seed, execute, evaluate, evolve. The real problem is unclear intent Ouroboros' own framing of this is a simple table: Problem What happens Ouroboros fix Vague prompts AI guesses, you rework Socratic interview exposes hidden assumptions No spec Architecture drifts mid-build Immutable seed spec locks intent before code Manual QA "Looks good" isn't verification 3-stage automated evaluation gate The fix targets clarity, not capability. The loop Interview -> Seed -> Execute -> Evaluate ^ | +---- Evolutionary Loop ----+ Interview : Socratic questioning surfaces the assumptions you didn't know you were making. Seed : your answers crystallize into an immutable specification: acceptance criteria, ontology, constraints. Execute : the seed runs through a Double Diamond decomposition (Discover → Define → Design → Deliver). Evaluate : a 3-stage gate: Mechanical (free, deterministic checks) → Semantic → Multi-Model Consensus. Evolve : the evaluation output feeds back into the next generation's seed, and the cycle repeats until the system stops learning anything new. Each cycle is meant to converge, not just repeat. The stopping condition isn't a timer or a step count. It's math. The interview ends when the math says so This is the part I

Hey DEV community! 👋 If you've ever tried to embed a dynamic YouTube channel feed, a live stream detector, or playlist carousel on a client site, you've probably run into two major issues: Expensive SaaS widgets that slap watermarks on your site unless you pay a monthly fee. Leaking your YouTube API Key directly in the frontend script. To solve this, we built YT Widget —a free, self-hostable, dependency-free JavaScript library that handles YouTube feeds, playlists, channel stats, and live stream status seamlessly. 📦 Where to Get It The project is fully open-source and ready for your production projects: Source Code & Contributions: scott8462 / YT-Widget A free, self-hostable, dependency-free JavaScript library for embedding YouTube feeds, playlists, channel stats, single videos, and live stream status on any website. YT Widget — Free Open-Source YouTube Website Embed A free, self-hostable, dependency-free JavaScript library for embedding YouTube feeds, playlists, channel stats, single videos, and live stream status on any website — just like SociableKIT, but 100% free and open-source. Created and provided free to the developer community by R&S Development . ✨ Features 📺 5 Widget Types feed : Latest channel uploads grid or list live : Auto-detects live broadcasts and embeds the live player — shows a custom Offline Card with recent uploads when offline playlist : Show videos from any YouTube playlist stats : Channel metrics cards (Subscribers, Views, Videos count) single : Responsive single video player with metadata 🔒 Secure PHP Server Proxy ( proxy/ ) : Keep your YouTube API key hidden server-side with built-in CORS, rate limiting, and 5-minute response caching. 🎨 Full Color Customization Light & Dark themes Custom Accent / Button… View on GitHub Alternative Downloads & Mirrors: Download on SourceForge ✨ Core Features 📺 5 Widget Types: Switch layouts instantly ( feed grid/list, live stream detector, playlist fetcher, profile stats , or single responsive video). 🔒 Se

Mediax: FFmpeg's Cooler Cousin 🚀 FFmpeg is powerful, but the syntax? A nightmare. So I built Mediax. 36 intuitive verbs. Interactive TUI. One-line install. Convert, compress, trim, crop, rotate, add watermarks... all with simple commands. bash mediax convert input.mov output.mp4 mediax compress large.mp4 small.mp4 --quality medium mediax trim video.mp4 clip.mp4 --start 00:01:30 --duration 10 Just run mediax for the interactive terminal interface. One-line install curl -sSL https://raw.githubusercontent.com/robert-sarah/mediax/main/install.sh | sh Built with Go Single binary — no dependencies Cross-platform: Windows, macOS, Linux Open source (MIT) 36 verbs for everything Conversion: convert, compress, gif Audio: extract-audio, mute, volume, replace-audio Video: trim, crop, resize, rotate, flip, concat, split Effects: speed, reverse, blur, sharpen, fade-in, fade-out Advanced: watermark, subtitle, thumbnail, template, batch Examples Resize for Instagram mediax template video.mp4 insta_video.mp4 --platform instagram Extract audio from 1:30 to 1:40 mediax extract-audio video.mp4 clip.mp3 --start 00:01:30 --duration 10 Detect video issues mediax wtf video.mp4 Why I built it I was tired of copying FFmpeg commands from Stack Overflow and breaking files because I forgot a flag. Mediax makes FFmpeg accessible for beginners and faster for pros. Try it today Repo: github.com/robert-sarah/mediax Contributions welcome! 🙏