今日已更新 172 条资讯 | 累计 37723 条内容
关于我们

标签：#rce

找到 2434 篇相关文章

AI 资讯

OpenWorker: Andrew Ng's Local-First AI Coworker, Explained for Developers

OpenWorker shipped in late July 2026. It is MIT-licensed, runs on your own machine, and takes your API key instead of selling you inference. The pitch is narrow and worth repeating exactly: it is an agent that hands you finished work , not a chat transcript. A drafted document on disk. A Slack reply with the real numbers in it. A calendar that has actually been rearranged. There are a lot of desktop agents right now. This post is about what makes this one structurally different, what state it is actually in, and how to get it running. What it is in one paragraph OpenWorker is a desktop app: a Tauri shell around a React UI, sitting on top of a local Python agent server. You give it an outcome ("prepare a customer brief from these three files and the Jira tickets"). It decomposes that into steps, reaches into your files, terminal, and connected SaaS apps, and produces an artifact. Before anything consequential happens - sending a message, running a shell command, writing to your calendar - it stops and asks. The engine is built on aisuite , Ng's provider-agnostic LLM library. That matters more than it sounds like: OpenWorker is explicitly positioned as a reference implementation of what you can build on aisuite, so the codebase doubles as a worked example if you are building your own harness. The four things that actually distinguish it 1. There is no OpenWorker inference service You paste a key, or you point it at Ollama and use none at all. The curated list covers OpenAI, Anthropic, Google, plus OpenAI-compatible vendors like DeepSeek, GLM, Kimi, Qwen, MiniMax, Mistral, and Grok, plus open-weight models through Together and Fireworks. Roughly thirty models are marked as verified for tool-calling work; you can point it at any other model string and accept the risk yourself. The practical consequence: your cost is your provider bill, and swapping models is a dropdown, not a migration. 2. The permission model is typed, not a confirmation dialog This is the part I would

2026-07-29 原文 →
AI 资讯

What Replacing Calendly Taught Me About Trusting Open Source

cal.com, Calendly, zcal... booking SaaS isn't short on options, and most of them are genuinely decent. Free tiers cover the basics for a lot of freelancers. The catch: you're the product (nothing's really free), and your customer data lives somewhere you don't fully control and can't fully audit. A dysfunction I ran into on another SaaS tool was the trigger. Trusting a third-party service by default, just because it's widely used and billed monthly, doesn't always hold up. That episode was enough to make me reconsider every external service this site was relying on for functionality that's actually simple to self-host — and the booking widget, running on Calendly, was one of them. Nothing wrong with Calendly specifically. It worked fine. But structural friction had been building regardless: a recurring subscription for something as simple as displaying open slots and recording a choice, a hard dependency on a third party for a component with nothing exceptional about it technically, and customization capped by whatever the vendor exposes in settings — no way to go further if a need falls outside that box. On top of that, an integration constraint that mattered more than any of the above: the site runs on Astro, generating lightweight static pages by design, specifically to avoid the weight of third-party scripts and dependencies — the exact opposite of what embedding a SaaS widget implies. So: could a self-hosted alternative match the experience, without the monthly bill and without handing a core commercial function (people booking a call with me) to an external vendor? This is the write-up of that search, the codebase audit that came out of it, and the production rollout. The landscape Four self-hosted candidates stood out as genuinely comparable — not just UI skins sitting on top of someone else's API, not just internal-scheduling tools with the public-facing UX as an afterthought. CloudMeet — Svelte + TypeScript, deployed on Cloudflare Pages/Workers/D1, free-tie

2026-07-29 原文 →
AI 资讯

From Burnout to Balance: Building an AI Overtraining Detector with HRV and Isolation Forest

Are you a data nerd who loves fitness? If you wear an Oura Ring or an Apple Watch , you’re sitting on a goldmine of biometric data. Specifically, Heart Rate Variability (HRV) —the secret sauce for understanding your nervous system's recovery status. But how do you know if a low HRV score is just a fluke or a serious sign of overtraining? In this tutorial, we are going to build a personalized HRV Anomaly Detector . Using Machine Learning , specifically the Isolation Forest algorithm from Scikit-learn , we will transform raw time-series data from the Oura Cloud API into an early-warning system for stress and burnout. This type of anomaly detection is essential for anyone looking to optimize their performance without hitting a wall. The Architecture 🏗️ Before we dive into the code, let's visualize how the data flows from your finger to our machine learning model. graph TD A[Oura Ring / Apple Watch] -->|Syncs| B(Cloud API / HealthKit) B -->|Fetch JSON| C[Python Script] C -->|Pandas Clean| D{Feature Engineering} D -->|HRV & Sleep Duration| E[Isolation Forest Model] E -->|Predict| F[Anomaly Flag: Overtrained?] F -->|Plot| G[Matplotlib Visualization] G -->|Insight| H[Rest or Push?] Prerequisites 🛠️ To follow along, you'll need the following stack: Python 3.9+ Scikit-learn : For our machine learning heavy lifting. Matplotlib : To visualize our "danger zones." Pandas : For time-series manipulation. Oura Cloud API : You'll need a personal access token (available at the Oura Cloud portal ). Step 1: Fetching Your HRV Data 🛰️ First, let's grab our data. If you don't have an Oura ring, you can export your Apple Watch data as a CSV, but the Oura API is much more convenient for automation. import requests import pandas as pd # Replace with your actual Personal Access Token TOKEN = ' YOUR_OURA_TOKEN ' url = ' https://api.ouraring.com/v2/usercollection/daily_readiness ' headers = { ' Authorization ' : f ' Bearer { TOKEN } ' } params = { ' start_date ' : ' 2023-01-01 ' , ' end_date '

2026-07-29 原文 →
AI 资讯

Run and Compare AI Evaluations with a CLI for Developers and Coding Agents

TL;DR: This walkthrough shows how developers and coding agents can use Quantiles , an open-source AI evaluation platform licensed under Apache 2.0, to quickly run, analyze, and compare AI evaluations locally. We'll use the SimpleQA Verified benchmark as an example throughout this post, letting you follow the commands, inspect the evaluation results, and configure your own model for the same workflow. Running an AI evaluation is rarely as simple as sending prompts to a model. Developers must connect datasets, model APIs, scoring logic, result storage, and comparison tooling before they can answer a basic question: did the system get better? When those pieces are spread across scripts, notebooks, and logs, every rerun becomes harder to reproduce and diagnose. A score alone cannot reveal whether the model changed or whether the dataset, prompt, scorer, or sample set changed with it. Quickstart: Run an example benchmark The Quantiles CLI is called qt on the command line. A simple curl ... | bash command supports macOS and Linux on X86-64 and Arm64 systems. First, use it to install the CLI: curl -fsSL https://cli.quantiles.io/install.sh | bash If you don't want to run code directly sourced from the internet, see the install.sh source code first. Next, let’s run a built-in benchmark from start to finish using a single command. SimpleQA Verified is a 1,000-prompt benchmark created by Google DeepMind and Google Research. It re-curates questions from OpenAI's SimpleQA benchmark to reduce problems such as incorrect labels, topical bias, redundant questions, and ambiguous source evidence. Each example includes a short factual question in problem , its reference answer , topic and answer-type metadata, and supporting URLs. Use the following command to run simpleqa-verified using the built-in Quantiles demo model, which doesn't incur any usage charges: qt run simpleqa-verified Results from the demo model are intended only to demonstrate the evaluation workflow because its output

2026-07-29 原文 →
AI 资讯

Meet FLASH CLI, a Free Local AI Agent for Your Terminal

Cloud AI coding tools are powerful, but they also come with a bill, an API key, and a quiet upload of your source code to someone else's servers. What if your AI assistant ran entirely on your own machine instead? That is FLASH CLI (Fast Local Agent SHell): an AI-powered command-line assistant that talks to local or self-hosted Ollama models and can actually run shell commands for you. No API key. No subscription. No cloud. Why FLASH is different 100% local. It connects to an Ollama server, by default on localhost, so your code and prompts stay on your hardware. No keys, no bill. Ollama needs no API key, so there is nothing to pay for and nothing to leak. Truly agentic. FLASH does not just chat. It runs a real tool loop: it inspects your system, runs commands, searches the web, and shows its reasoning as it works. Model freedom. Point it at llama3.1, qwen2.5, mistral, or any tool-capable Ollama model, and swap with one setting. Local or remote. Set OLLAMA_HOST and the same client talks to a GPU box on your network or a server behind a reverse proxy. The four main tools FLASH gives the model a tight, powerful toolset: shell: run any command, non-interactively, with a timeout. web_search: pull live results from DuckDuckGo, built in. get_os: detect the operating system so it picks the right command every time. reason: surface a line of its thinking without ending the turn. It loops through plan, act, and observe until the job is done, then answers in rendered Markdown with syntax highlighting. Configuration Optional configuration lives in ~/.flash.env: MODEL=llama3.1 OLLAMA_HOST=http://localhost:11434 What it feels like Ask a question and let it work: [Flash]> what are the biggest files here? Thinking: check the OS, then find the largest files Retrieving operating system information Executing shell command: du -ah . | sort -rh | head -3 … Run a command yourself with the ! prefix, no AI in the loop: [Flash]> !git status On branch main nothing to commit, working tree cle

2026-07-29 原文 →
AI 资讯

We Open-Sourced Both Halves of Our Security Stack — Detection and Deliberation

We Open-Sourced Both Halves of Our Security Stack — Detection and Deliberation AEGIS catches the threat. ENLIL decides what it means. Both are free, and we want to know if they actually help you. We've written before about each of these projects separately — AEGIS's post-quantum forensic logging and why ENLIL runs 9 LLMs in parallel instead of one . This post is about why they're actually one system, and why we're not gatekeeping either half of it. Two different jobs AEGIS is an intrusion detection/prevention system. It watches traffic, correlates signals across nine layers (from crypto-level filtering to adaptive moving-target defense), and decides — fast, locally, without calling out to anything — whether something is an attack. It's deliberately narrow: detection and containment, nothing else. No counterattacks, no active reconnaissance, one process, deployable on a standard VPS. ENLIL does the opposite job. It's slow by design — it convenes a council of independent LLMs, lets them reason in isolation (no model sees another's answer until synthesis), and produces a signed Decree: the majority view, the dissents, and a final verdict. It's built for the decisions where being fast and wrong is worse than being slow and right. Neither one replaces the other. AEGIS shouldn't spend 30 seconds deliberating about whether a SYN flood is a SYN flood. ENLIL shouldn't be making split-second network decisions. But there's an obvious seam between them: what happens when AEGIS catches something that isn't a simple yes/no — a pattern that's ambiguous, or severe enough that you want more than one model's opinion before you act on it? The Bridge That seam is a small connector: when AEGIS's detector layer flags something at high or critical severity, it fires a signed event at ENLIL's API. ENLIL convenes a tier of the council sized to the severity — a lighter tier for routine escalations, the full council (including the most expensive model) only for the things that deserve it. The

2026-07-29 原文 →
AI 资讯

Pilum: From Launch to Production-Ready in 3 Months

Github URL: https://github.com/SID-Technologies/Pilum In December 2025, I open-sourced Pilum , a multi-cloud deployment CLI that deploys to Cloud Run, Lambda, Azure, Cloudflare Pages, npm, Homebrew, and Docker Hub from a single pilum.yaml . The announcement post covered the architecture: recipes, ingredients, handlers, wave-based execution. That was the "it compiles and the tests pass" version. Three months and 40+ pull requests later, Pilum deploys all of SID Technologies , platform-core, Torch, Statio, every website, every npm package, and itself. This post is about everything that broke between "it works" and "it ships production software." ( Update: * there's now a seven-months-in addendum at the bottom. It's mostly about what stopped breaking.)* The Timeline Dec 2, 2025 : First commit. Baseline CLI with recipe system. (#1) Dec 4 : Homebrew release workflow. Pilum dogfoods its own deployment. (#2-#4) Dec 31 : Service graph, --only-changed , file embedding support. The "I need this for real" features. (#22-#24) Jan 3-12 : Documentation and bug fixes. The quiet "oh, this doesn't actually work" phase. (#25-#29) Feb 6-7 : The big feature sprint — 8 features in 48 hours. Wave deployments, npm recipe, Cloudflare Pages, Azure Container Apps, Cloud Run Jobs, environment variables, JSON output, history command. (#30-#38) Feb 8-12 : The big fix sprint — YAML parsing, package manager issues, build failures, error swallowing, GCP secrets, Cloudflare execution. Everything from the feature sprint broke something. (#42-#49) Feb 24 : Security hardening and npm publishing fixes. (#51-#53) Mar-Apr : Memory-based worker allocation, wave ordering bug, orchestrator rewrite. The "I thought this was done" phase. (#58-#62) The pattern is clear: features ship fast, fixes ship faster, and the real bugs show up a month later. Wave-Based Deployments Were Broken Wave-based deployment was the headline feature in #31. Services declare dependencies, Pilum builds a dependency graph, topological

2026-07-28 原文 →
← 上一页 下一页 →