标签：#rce

Everyone's arguing about AI search visibility. Almost nobody is measuring the boring part: whether AI crawlers can fetch your pages at all . So I built a small open-source tool — geo-crawl-audit — that probes any site with the user-agents of every AI crawler that matters (GPTBot, OAI-SearchBot, ClaudeBot, PerplexityBot, ChatGPT-User, and friends), measures how each is treated versus a normal browser, and checks the thing most people never think about: how many words exist in the raw HTML before any JavaScript runs . Because here's the detail the industry keeps missing — GPTBot, ClaudeBot, and PerplexityBot don't execute JavaScript. For most sites, Googlebot (feeding Gemini) and Applebot are the only AI-adjacent crawlers that render it. A site can rank #1 in Google and be a blank page to nearly everything else. I pointed it at 18 major sites on August 7. Five findings worth your time. 1. Access patterns line up with the business relationships The Guardian — which has a content deal with OpenAI — serves my simulated GPTBot, OAI-SearchBot, and ChatGPT-User a clean 200 . The same request wearing ClaudeBot, PerplexityBot, or CCBot : 403 , and those names are in its robots.txt disallow list too. Policy and enforcement agree. The New York Times — in litigation with OpenAI — 403s nearly everyone: GPTBot, OAI-SearchBot, ClaudeBot, PerplexityBot, Common Crawl, meta-externalagent. Two user-agents got through: bingbot and Amazonbot. I want to be careful about the claim here: a status code tells you who is blocked , not why . Any individual 403 has mundane explanations. But when the allow/deny matrix maps this cleanly onto public deals and public lawsuits, the firewall config has become a business document — and it's readable by anyone with a terminal. 2. robots.txt is a polite sign. Some doors are unlocked anyway. Reddit's robots.txt blocks every AI bot in my list — fourteen tokens, no exceptions. Enforcement tells a different story: my GPTBot UA got a 403 and ClaudeBot and CCB

Originally published by InvisibleHill Research . This cross-post preserves the original research cut-off and source list. Research cut-off: July 30, 2026. Miner signaling is a live metric and may have changed after publication. BIP 110 begins with a problem that many Bitcoin users can recognize. A miner can collect a one-time fee for including an image, token payload, or other arbitrary data, while thousands of node operators absorb the cost of downloading, validating, and sometimes storing it. The proposal's authors see that mismatch as a subsidy for data storage and a threat to Bitcoin's use as money. Their answer is a temporary soft fork. For about one year, BIP 110 would make several currently valid transaction structures invalid under consensus rules. It would cap OP_RETURN outputs at 83 bytes, limit many data pushes and witness items to 256 bytes, restrict large output scripts and Taproot control blocks, and disable several Taproot upgrade paths and script features that can carry data. Adam Back agrees with the premise more than his opposition sometimes suggests. He has said that Bitcoin is about money and that spam has no place in its timechain. He also designed Hashcash to make spam costly. His objection is to the remedy. In Back's view, an annoyance that fits inside Bitcoin's existing block limit does not justify a contentious consensus change, especially one that can be bypassed, can interfere with legitimate scripts, and has not earned technical or economic agreement. That distinction is the center of the debate. BIP 110 asks whether Bitcoin should discourage an unwanted use through local policy and fees, or declare some forms of that use invalid for everyone. Back's case is stronger on this question. The proposal identifies a real externality, but it offers an asymmetric bargain: incomplete filtering in exchange for a new consensus precedent, a more complicated upgrade path, and a material risk of a minority chain. A policy dispute became a consensus pro

GitHub热门项目 | A library for building fast, reliable and evolvable network services. | Stars: 27,151 | 15 stars today | 语言: Rust

TL;DR Welcome back to Dev Opportunity Radar . This is a weekly series where I share opportunities, resources, communities, and interesting finds that I come across, with the goal of helping people discover things they might otherwise miss. This week's edition features the Claude Community Ambassadors Program , the YC Startup Internship Expo , Z Fellows , and CS329A: Self-Improving AI Agents , a free graduate-level Stanford course exploring the latest research behind modern AI agents. If you're new to the series, you can also browse previous editions, search past opportunities, and explore Community Finds , Reader Updates , and Resources Worth Checking Out on the Dev Opportunity Radar website . I've also written a short post about why I built it. You'll find links to both at the end of this article. This week's 🌟 Community Finds section features opportunities shared by Francis ( @francistrdev ) and Konark Sharma ( @konark_13 ) . I always love seeing readers help others discover opportunities they might otherwise have missed. If you've discovered something through the radar, I'd love to hear about it. Whether you applied to an opportunity, attended an event, joined a community, completed a program, built something, or found a resource you hadn't seen before, I'd be happy to feature your experience in a future 💙 Reader Updates section (with your permission). And if you've come across an opportunity, resource, community, program, event, or anything else you think deserves more attention, feel free to share it in the comments. If I feature one of your 🌟 Community Finds in a future edition, I'll always make sure to credit you. If you discovered it, that recognition belongs to you. Table of Contents ⚡ Quick Scan 🔄 Still Open From Previous Editions 📍 This Week's Opportunities 📌 Claude Community Ambassadors 📌 YC Startup Internship Expo 📌 Z Fellows 📚 Resources Worth Checking Out CS329A: Self-Improving AI Agents 🌟 Community Finds CALEC Volunteer and Internship Opportunities JP

Every new SaaS seems to embed ChatGPT these days. Most AI support solutions rely on third-party platforms, monthly subscriptions, and vendor lock-in. While they're great products, I wanted something different. I wanted complete ownership. I wanted to deploy everything on my own server, use my own OpenAI API key, customize every part of the experience, and embed the widget into any website with a single script tag. So I built my own self-hosted AI support widget using Spring Boot and Vanilla JavaScript. Why I Built It When building small products and websites, I realized that customer support quickly becomes a problem. Users have questions about pricing, features, returns, or simply get stuck. Most developers solve this by integrating services like Intercom, Crisp, or Tidio. Those platforms are excellent, but they also mean: Monthly subscription costs Vendor lock-in Customer conversations stored on third-party platforms Limited customization Another external dependency I wanted something that developers could completely own. The Goal The goal was simple. Build an AI-powered customer support widget that developers can deploy on their own server and integrate into any website in less than a minute. The widget should: Answer customer questions using AI Learn from a custom knowledge base Match the company's branding Store conversation history Allow human handoff Be easy to deploy Require only one script tag to embed Technology Stack Java 17 Spring Boot 3 Spring Security Spring Data JPA Thymeleaf Vanilla JavaScript H2 Database (MySQL supported) OpenAI API Architecture The overall architecture is intentionally simple. Visitor │ ▼ AI Chat Widget (Vanilla JavaScript) │ ▼ Spring Boot REST API │ ▼ OpenAI API │ ▼ Database (H2 / MySQL) Keeping the frontend framework-free makes the widget lightweight and easy to embed into virtually any website. One-Line Integration Adding the widget to a website only requires a single script. <script src="/widget/widget.js" data-api-base=""></sc

While contributing to Grafana, I picked up a memory issue in the Time Comparison feature — a follow-up to earlier performance work I had done in the same area. A comparison panel was consuming significantly more memory than expected. The interesting part: the extra memory wasn't coming from real data. This post covers how I traced it to the root cause and fixed it. Background Time Comparison overlays an earlier period onto the current one — for example, this week vs. last week. The comparison data is fetched from the earlier window and shifted forward before rendering: Query → DataFrame → Prepare frame → Shift → Render │ └─ Gap filling The important detail: gap filling ran before the comparison frame was shifted. The Problem I reproduced the issue with: Parameter Value Series 500 Window 6h Interval 20s Compare offset 24h A single-period panel contained roughly 540,000 points , so a comparison panel should be about 2× the baseline . Instead, the compare frame contained 3,240,500 points — ~6× the baseline — and consumed 76.4 MB . The question was: where did the extra points come from? Investigation I first verified the baseline to rule out the query returning unexpected data. It was correct. Then I used a reproducible browser harness and a heap snapshot to inspect the extra memory. Most of it was null rows introduced during gap filling — not real samples, not copies. Following the frame through the preparation pipeline revealed why. When gap filling ran, the compare frame still represented data 24 hours in the past , but the gap-filler was using the current time range as its reference: Compare frame Current range [===== 6h =====] [===== 6h =====] └─────────────── 24h ───────────────┘ gap-filler reads this offset as one gap At a 20-second interval, 24 hours is: 24 × 60 × 60 / 20 = 4,320 intervals So up to 4,320 null positions per series were introduced purely because the frame hadn't been shifted yet. The frame was then shifted forward, leaving most of that padding out

GitHub热门项目 | The free coding agent | Stars: 8,536 | 440 stars this week | 语言: TypeScript

GitHub热门项目 | GlazeWM is a tiling window manager for macOS and Windows inspired by i3wm. | Stars: 12,543 | 31 stars today | 语言: Rust

GitHub热门项目 | Payload is the open-source, fullstack Next.js framework, giving you instant backend superpowers. Get a full TypeScript backend and admin panel instantly. Use Payload as a headless CMS or for building powerful applications. | Stars: 44,041 | 27 stars today | 语言: TypeScript

GitHub热门项目 | AI-Engineering Foundation Framework built with AI and designed for AI. Hundreds of architectural and domain decisions (multi-tenancy, RBAC, event flow, pricing, sales pipeline,CRM/ERP processes) are already made conventions and specs so agents (Cursor, Claude Code, Codex) arch. decisions without reinventing. Ship production grade with AI Agents. | Stars: 1,572 | 12 stars today | 语言: TypeScript

GitHub热门项目 | Graph-Native Infrastructure for Context and Accountable AI Systems | Stars: 2,183 | 118 stars today | 语言: Python

GitHub热门项目 | A self-improving RLM agent for coding workflows and long-running autonomous tasks. | Stars: 5,231 | 2,271 stars today | 语言: TypeScript

I have been building machin for a while — a Go-flavored, type-inferred language that compiles through C to a single native binary. It has grown a lot recently, and I wanted to answer the obvious question honestly: does it beat Rust and Zig at anything? It does, at two things, decisively. But the first thing I found was not a win. It was my own benchmark quietly lying to me, and the number it was lying about was the best one I had. The benchmark was measuring the order I ran things in machin's repo has had a bench/native-speed suite for months: four compute kernels — recursive fib, a mandelbrot, a sieve, a big integer loop — written in machin, Rust and Zig, producing byte-identical output, so the timing compares the same computation three ways. The published result claimed machin won the integer loop by 20-25% . That claim also shipped inside machin guide , which is what every coding agent reads to learn the language. When I re-ran it, the margin was gone. Not shrunk — gone. So I read the harness instead of the output: for kernel in kernels : for lang in [ machin , rust , zig ]: for _ in range ( 5 ): # all 5 machin, THEN all 5 rust, THEN all 5 zig time ( binary ) It ran every sample of one language before starting the next. On a laptop that heats up and down-clocks during a three-second kernel, that does not measure the languages. It measures who had the misfortune of running last . Zig always went last. Zig always looked slowest. The fix is four lines — interleave the rounds, rotate who starts each one. Here is what my headline number did: intsum 10^9 before (blocked) after (interleaved) machin 2832 ms 3079.7 ms rust 3764 ms 3223.8 ms zig 3556 ms 3189.7 ms "machin +20-25%" machin +3% = a TIE A 20-25% win became a tie. I deleted the claim from the README and from machin guide . The harness now also refuses to declare a winner inside a 3% band, because the worst run-to-run spread I measured was 41% of the min sample. Calling winners inside that is how benchmarks start

npm has introduced staged publishing for Node.js, requiring maintainer approval before a version is installable. Versions are queued and must pass a two-factor authentication challenge for release. This feature aims to enhance security amid rising supply chain threats. It is available in npm CLI 11.15.0+ and Node 22.14.0+, alongside new configurable permission flags. By Daniel Curtis

A live production integration case study Introduction and Purpose of This Article This article is written for mid- and high-level managerial and technical decision makers. I am the author of the open-source Java library MgntUtils . The article presents an analysis of a real integration of the stacktrace-filtering feature from that library into a live commercial production environment. A few important clarifications up front: This is not a side-project pilot and not a lab demo. The feature was integrated into a production service of a company that serves a high volume of real customers. Due to legal constraints, I am not at liberty to name the company. This is not a how-to article for implementers. If you came looking for code samples or logging-framework wiring, please see the dedicated articles listed in the Disclaimer below. MgntUtils can be used in Java projects and in other JVM-based languages such as Kotlin. Before diving into the production numbers, it is worth stating briefly what the feature does and why those numbers matter. Server-side stacktraces are usually full of framework and infrastructure noise — proxies, filter chains, containers, thread pools, and similar boilerplate — while the few lines that actually explain the failure are easy to lose in the pile. The MgntUtils filtering utility keeps the application frames and the exception / Caused by chain, and collapses that noise. The result is a much shorter stacktrace without losing the information you actually need . When those stacktraces are later consumed — sent to an LLM for analysis, or opened by an engineer — that reduction can mean: Substantial AI token savings Typically more accurate AI root-cause answers , because the model has less framework noise to latch onto and hallucinate about A meaningful productivity boost for human triage The rest of this article focuses on what was observed after integrating this feature in production: the measured benefits, how to interpret them, and the integratio

The AI leaderboard just had a seismic shift. Qwen3.8 Max, Alibaba's latest open-weight model, has been ranked as the best overall model by the Artificial Analysis Agentic Index — beating out GPT-5.6 Sol from OpenAI, Claude Opus 4.5 from Anthropic, and Gemini Ultra 2 from Google. This isn't just a benchmark win. It's the first time an open-source model has topped a comprehensive agentic intelligence index that measures real-world task performance, not just test scores. What Is the Agentic Index? The Artificial Analysis Agentic Index is an independent benchmark that evaluates AI models on their ability to complete agentic tasks — multi-step reasoning, tool use, code generation, and real-world problem solving. Unlike traditional benchmarks (MMLU, HumanEval) that test static knowledge, the agentic index measures whether a model can actually do things . The index evaluates models across multiple dimensions: Intelligence Index : Composite score across reasoning, coding, math, and instruction following Speed : Output tokens per second under production load Cost : Weighted average cost per intelligence task Endpoint Accuracy : Whether provider endpoints match reference model quality Qwen3.8 Max: The Specs Qwen3.8 Max represents Alibaba's most capable model to date: Parameters : 240B (MoE architecture, ~35B active during inference) Context : 256K tokens native, 1M extended Training : Trained through November 2025 data cutoff Licensing : Open weights for research and commercial use (with restrictions for users in restricted jurisdictions) What makes Qwen3.8 Max notable isn't just raw intelligence — it's the combination of high performance with competitive pricing and speed. The model scores near the top on intelligence while maintaining cost per task well below premium alternatives. Why This Matters for Developers 1. Open-Source is Catching Up — and Pulling Ahead For two years, the gap between open-source models (Llama, Qwen, Mistral) and proprietary frontier models (GPT, Cla

I build software with AI all day. A reading app for dyslexic kids. A map that lives on your desktop. A meditation app. A fox in my menu bar. Some of it with Claude, some with Gemini, some at 2am with whatever model was awake. The code was never the problem. The problem was six months later, opening a file and having no idea what we were thinking. Not what it does — the code says that. Why it's like that. What we tried that didn't work. What we weren't sure about. That part evaporated the moment the editor closed. So we started leaving a note. It's called MurphySig , and it's not a tool — it's a comment: // Signed: Kev + claude-sonnet-5, 2026-07-14, Confidence 0.5 (spike; // compiles, on-device run pending), Prior: Unknown // Review: claude-fable-5, 2026-07-14 — the on-device run HAPPENED same // day: gemma-4-12B-it-4bit loads + describes the app icon correctly, // 265 prompt tokens/image, 7333MB peak. Confidence now 0.9 for the // instrument itself (measured live). That's a real one, from M1K3 's codebase. Signed 0.5 in the morning, reviewed 0.9 the same evening, measurement attached. Confidence as a live value, not decoration. The one that sold me on my own convention My favourite signature lives in Cartogram's map engine. Three models worked that file across two months. In June, one of them recorded a performance overhaul: drift updates moved to "1s intervals," 52% CPU down to zero. In July, a newer model read that note, saw the shipped constant was 0.1s, took the mismatch for a bug, and "fixed" it. On hardware, every longer interval was stop-motion. So it reverted — and then wrote this into the file: So 0.1s was not a regression; it is load-bearing, and the 1s in the 06-21 note is the part that was wrong. [...] the standing lesson is that drift cost needs Instruments, not reasoning. The confident note turned out to be the bug. The code was innocent. And the correction is now part of the file's memory, so nobody — human or model — "fixes" that constant again. That

GitHub热门项目 | Claude Code toolkit - agents, commands, skills, rules, and hooks for productive AI-assisted development | Stars: 982 | 143 stars this week | 语言: JavaScript

Google's Custom Search JSON API is closed to new customers, and existing customers have until 2027-01-01 to move off it. That deadline takes searchType=image with it. I maintain cse-bridge , a small self-hosted service that speaks Google's customsearch/v1 wire format on top of your own SearXNG instance, so migrating is a base-URL change rather than a rewrite. Web search shipped first. This week I added image search — and it turned out to be much less mechanical than "map some more fields", because two of the assumptions that hold for web results are actively wrong for image results. Both are worth knowing whether or not you ever use my code. If you are writing anything that normalises image search results, you will hit them. Trap 1: link is not the page For a web result, Google's link is the URL of the page. Easy. For an image result, link is the image file itself , and the page it was found on lives in image.contextLink : { "link" : "https://facts.net/wp-content/uploads/2020/08/AdobeStock_209028852.jpeg" , "displayLink" : "facts.net" , "image" : { "contextLink" : "https://facts.net/nature/animals/red-panda-facts" , "thumbnailLink" : "https://ts1.mm.bing.net/th?id=OIP.I_aIcVvl98DbktQmP297ugHaE7&pid=15.1" , "width" : 4000 , "height" : 2666 } } SearXNG has it the other way round: the result's url is the page, and the image is in a separate img_src field ( documented here ). So the naive mapping — reuse the web mapper, add an image object — produces items whose link points at an HTML document. That fails silently , which is what makes it nasty. Your JSON still validates. Your item count is right. Every field is a well-formed URL. But every client that does <img src={item.link}> — which is the entire point of image search — renders nothing, and it looks like the images are broken rather than like your mapper is wrong. The fix is a rule, not a patch: if a result has no image URL, drop the whole result . Never fall back to the page URL to keep the count up. export functio

eBay touted an increase in eBay Live's gross merchandise volume as it plans to expand it to more international markets in the coming weeks and months.