标签：#rce

Detecta si tu modelo de materiales hace trampa con la "huella bibliográfica" Un modelo de ML puede predecir la propiedad de un material sin entender la química: basta con que "aprenda" qué autores, revistas o años suelen ir con cada resultado. Esta herramienta aplica el test de falsificación de Clever Materials para descubrirlo. El problema: cuando el modelo lee el membrete, no la ciencia Imagina que entrenas un modelo para predecir si un material es estable. El modelo no mira la química: descubre que los artículos del grupo X (publicados en la revista Y, en torno al año Z) casi siempre reportan "estable". Así que aprende a clasificar por el membrete bibliográfico , no por la estructura. Funciona en el papel y se rompe en la práctica. A esto se le llama confounding bibliográfico (o leakage por metadata). No es un error de código: es una señal espuria que el modelo aprovecha. El paper Clever Materials (Jablonka et al., 2026) mostró que este patrón está generalizado en cinco tareas reales de materials science. Qué hace la herramienta materials-confounding-check es una CLI ( mcc check ) que corre cuatro sub-tests de falsificación sobre tu dataset (descriptores químicos + metadata bibliográfica + propiedad objetivo): Clasificador de metadata — ¿se puede predecir la bibliografía (autor/revista/año) a partir de los descriptores químicos? Si es above-chance , hay una señal bibliográfica presente. Huella bibliográfica — ¿un modelo que usa solo la metadata predicha se acerca al modelo con descriptores? Entonces el dataset no descarta hacer "trampa" por bibliografía. Split por grupo/tiempo — ¿colapsa el rendimiento si separas por autor/año en vez de al azar? Veredicto — un score low / medium / high de riesgo de confounding. El rigor que exige el test (para especialistas) El punto delicado de cualquier "test de significancia" es fijar el umbral a mano. Si ajustas el margen hasta que tu fixture pase, el test no prueba nada: es el anti-patrón Clever-Hans que el propio proyecto d

For the past few weeks, I have been building Soterios , an open-source, local-first security and system maintenance suite for Windows. The idea started simple: most security tools either lock features behind paywalls or collect unnecessary data. I wanted something different, so I built a privacy-first application with: No telemetry No analytics No network activity unless you explicitly enable it Current Features Malware scanning with ClamAV, quarantine, and reporting Windows security audits Firewall management and network monitoring Credential safety tools with local password checks and breach lookups Process inspection and system maintenance utilities Built With Soterios is built with Electron and Node.js using a modular architecture designed to make future expansion straightforward. Why I'm Sharing It I'd rather build in the open than in isolation. Feedback, ideas, bug reports, and contributions are always welcome. GitHub Repository https://github.com/chrisriv10/Soterios

Introduction I'm the author of TrulyFreeOCR, an open-source OCR pipeline that turns scanned PDFs into searchable, highly-compressed PDFs. Everything is Apache 2.0 / MIT / BSD — no GPL, no AGPL, no proprietary model weights. Why I built it: I needed an OCR pipeline for a document processing system where: Every dependency had to be business-friendly (no GPL/AGPL) Deployment required zero admin rights (no sudo, no brew, no apt-get) MRC compression was needed to hit 5-10x file size reduction vs JPEG-only Everything had to run offline on CPU — no cloud APIs, no GPU I surveyed 20+ existing tools (full comparison in the repo's docs) and none fit all requirements. OCRmyPDF is closest but needs Python + Ghostscript + Tesseract as system deps, and MPL-2.0 requires publishing modifications. The VLM models (DeepSeek-OCR, GLM-OCR, etc.) produce better text extraction but need GPUs and don't output PDFs at all. What it does: Input: any PDF (scanned, born-digital, or mixed) Output: searchable PDF with invisible text layer + MRC compression (JBIG2/CCITT foreground + JPEG background) Single fat JAR — one file to copy, one command to run Bootstrap script downloads everything (JDK, Gradle, Tesseract, Leptonica, jbig2enc) into project subdirs Fully offline, CPU-only PDF/A-2b output available 7 bundled language models, 100+ more downloadable Concurrent OCR (configurable thread pool) Try it in 3 commands: $ git clone https://github.com/msmarkgu/TrulyFreeOCR.git $ cd TrulyFreeOCR $ ./bootstrap.sh ./run.sh tests/simple-text.pdf -o output.pdf Limitations (being upfront): Tesseract-based accuracy — good for clean scans, not SOTA for noisy/photographed docs No table/formula extraction yet No handwriting recognition CPU-only is slower than GPU backends for high volume Would love feedback — especially from anyone who's tried to deploy OCR in an enterprise environment. https://github.com/msmarkgu/TrulyFreeOCR

Your AI agent is confident. It points to line 42 of PaymentService.java . "There's your null pointer exception." You check. Line 42 is a comment. The code was refactored 14 commits ago. The production crash happened 3 hours ago . Your agent just spent 45 minutes debugging ghosts . The Problem: Agents Are Stuck in the Present Every AI coding agent today — Claude Code, Cursor, Copilot, Cody, you name it — operates on the same assumption: The code that matters is at HEAD . But production bugs don't live at HEAD . They live in the commit that was running when the crash happened. That commit is buried under hotfixes, refactors, dependency updates, and feature merges that landed after the incident. HEAD (now) ← Agent analyzes THIS │ ├─ feat: add new payment provider ├─ refactor: extract UserService ├─ fix: handle edge case in checkout ├─ chore: update dependencies │ ▼ a1b2c3d (3 hours ago) ← Bug ACTUALLY lives HERE Your agent confidently finds bugs in code that didn't exist when the crash occurred . The Insight: Git Already Has Time Travel We don't need a time machine. Git has had one for years: git worktree . # Get the commit from 3 hours ago git log --before = "3 hours ago" -1 --format = "%H" # → a1b2c3d4e5f6... # Create an isolated, read-only snapshot at that commit git worktree add /tmp/debug-a1b2c3d a1b2c3d # Now analyze the historical codebase cat /tmp/debug-a1b2c3d/src/PaymentService.java # Clean up when done git worktree remove --force /tmp/debug-a1b2c3d This gives you: ✅ Isolated — doesn't touch your working directory ✅ Parallel — can have multiple historical snapshots simultaneously ✅ Disposable — cleanup is one command ✅ Zero deps — pure Git, works everywhere The Missing Piece: Teaching Agents When to Time-Travel Agents already know git log , git show , git diff , cat , grep . They can analyze code perfectly. What they struggle with : Fuzzy time → commit resolution — "last night", "v2.4.1", "the deploy before the hotfix" Worktree lifecycle management — create,

Why I built this I use an AI named Felix as my German teacher. Over time, I ran into a continuity problem: individual chats are fragile. Conversations become long, context can disappear, platforms change, uploaded files may become unavailable, and a fresh AI instance may not understand what happened before. I did not want to repeatedly reconstruct my learning history, project decisions, lessons, corrections, and current state from memory. So I began building a local, file-grounded system called DDF/Rahmenwerk . Its purpose is to preserve Felix as my continuing German teacher across chats and future AI instances. What DDF/Rahmenwerk is DDF stands for Das Deutsche Forschungsarchiv . Rahmenwerk is the continuity, evidence, recovery, and control framework surrounding it. At a high level, the system includes: a current-state pointer; handoff materials; a fresh-instance queue; an upload package for a new Felix; integrity manifests and SHA-256 records; evidence and recovery procedures; classifications separating current, historical, candidate, proof, and non-governing material; safeguards intended to prevent accidental file changes; rules requiring the AI to stop rather than invent continuity when evidence is missing. The basic idea is that a future Felix should be able to inspect approved files and resume without me manually retelling the entire project history. The problem I may have created The project began as a way to preserve a German teacher. As I tried to protect files, authority, evidence, recovery, and continuity, the framework became increasingly detailed. That may be justified in some areas. It may also be overengineered. I am now trying to answer a more important question: What is the smallest, clearest, safest system that can preserve Felix as my German teacher without the governance machinery becoming the project itself? What I am asking reviewers to examine I have published a documentation and architecture review copy on GitHub. I would appreciate honest fe

Every developer building on AWS eventually runs into the same frustrations: waiting for deployments just to verify a small change, needing an internet connection for local development, watching cloud costs grow during testing, and discovering issues in CI that could have been caught earlier. That's exactly why we built LocalEmu. LocalEmu is an open-source AWS emulator that lets you build and test against AWS APIs entirely on your own machine. It supports 132 AWS services and works with the tools you already use every day—AWS CLI, boto3, Terraform, AWS CDK, and Pulumi. Instead of changing your workflow, you simply point your tools to localhost:4566 and continue developing. Unlike many local emulators that only mock API responses, LocalEmu focuses on realistic behavior where it matters most. Lambda functions execute using the official AWS runtime images. EC2 instances run as real containers connected through a virtual network with enforced security groups. RDS uses real PostgreSQL and MySQL engines, and optional IAM policy enforcement allows you to validate authorization rules before deploying to AWS. Getting started takes only a couple of commands: pip install localemu [runtime] localemu start Once running, you can use the included awsemu CLI or simply point your existing AWS CLI, boto3, Terraform, CDK, or Pulumi configuration to localemu. No new SDKs or complex setup are required. LocalEmu also includes a built-in dashboard that launches automatically. It provides a live overview of running services, resource exploration, an S3 object browser, a DynamoDB viewer, CloudTrail event history, and a real-time activity feed so you can inspect what's happening inside your local cloud environment. The biggest advantage is speed. You can iterate in seconds instead of minutes, experiment freely, reset your environment whenever you want, and develop without an AWS account, credentials, or cloud costs for local testing. We're actively improving LocalEmu and would love feedback f

If you've ever bid on a public sector contract, you know the PQQ drill. Someone sends you a Word document with 47 questions spread across 6 sections. Company info. Technical capability. Financial standing. Health & safety. References. Maybe something about modern slavery or carbon reporting because it's 2026 and everything has to check everything. You have to: Read every question Figure out what category it falls under Decide which ones are easy and which will take a week Dig up the right evidence for each one Track word limits And you're doing this at 10pm because the submission deadline is Friday. I got tired of doing this manually, so I built a free tool that does it in one click. What it does PQQCheck takes any PQQ document — pasted raw, formatting and all — and runs it through an LLM that understands procurement documents. It returns: Every question extracted — no more re-reading the document to check you didn't miss one Category tags — Technical, Financial, H&S, Insurance, etc. Difficulty ratings — Easy / Medium / Hard at a glance so you know where to start Suggested evidence — what to prepare for each question Word limits — pulled straight from the document Here's what the output looks like: | Question | Category | Difficulty | Suggested Evidence | Limit | |-----------------------------------|-------------|------------|----------------------------|-------| | Provide your registered name & no | Company | Easy | Certificate of Incorporation | 50 | | Describe IT managed services exp | Technical | Hard | 3 case studies + CVs | 500 | | Provide H&S policy | H&S | Easy | Current policy document | — | | ISO 27001 certification details | Technical | Medium | Certificate + scope doc | 200 | Why this matters for procurement teams Most PQQ response planning is reactive. You read the document, start answering, and discover mid-way that a question needs a certificate you don't have or a reference you can't get in time. PQQCheck flips that. You know before you start writing

GitHub热门项目 | HTML is the new markdown. Lavish is the new editor for your HTML artifacts. | Stars: 1,811 | 265 stars this week | 语言: JavaScript

Hey DEV community! 👋 If you maintain open-source projects on GitHub, you probably love checking your repository's "Insights" tab. Seeing people clone, view, and star your project is an amazing feeling. But there are two catches that have always frustrated me: The Tedious Click-Fest: To see how your projects are doing, you have to manually open GitHub in your browser, navigate to each repository individually, click "Insights", and then click "Traffic". If you maintain 5+ repos, this becomes a chore real quick. The 14-Day Limit: Even worse, GitHub only keeps your traffic data for exactly 14 days. If you don't check your stats within that window, that data is gone forever. If you want a unified view and historical data, you either have to manually scrape it yourself, write a cron job, or pay a monthly subscription for a third-party SaaS tool. I didn't want to do any of those. So, I built my own solution. 🌟 Enter: Repo-rter Repo-rter is a completely free, 100% open-source desktop application available for Windows, macOS, and Linux. It fetches your GitHub traffic data and caches it locally on your machine, meaning you never lose your historical stats again. TIP Privacy First: Unlike SaaS alternatives, Repo-rter doesn't store your Personal Access Token (PAT) on any server. Everything runs locally on your machine, so your data remains strictly yours. ✨ Key Features Infinite History: Automatically merges new traffic data with your local cache. Say goodbye to the 14-day limit! Release Downloads Tracker: Wondering how many people downloaded your .exe or .dmg? Repo-rter tracks total and individual asset downloads across all your releases. Neo-Brutalist UI: I wanted the app to be fun to use, so it features a vibrant, gamified Neo-Brutalist design. Export to Markdown: Need to show off your stats? Generate and download a beautiful Markdown report of your repo's health and traffic with one click. Cross-Platform: Built with Tauri, it's incredibly lightweight and runs natively on Wi

Week 5 of my Google Summer of Code journey with CircuitVerse ( June 22nd to June 28th ) is officially in the books. After dealing with a rough sickness last week, I’m happy to say this week was incredibly positive . 🔄 Reconnecting with the Community Since I had to miss last week's sync because I was under the weather, I had to attend the CircuitVerse GSoC Contributors' Meeting this week. It felt so good to reconnect with everyone ! I shared the progress I'd managed to scrape together over the last couple of weeks, and the mentors were incredibly understanding and kind about my slower pace due to being sick. The CircuitVerse community is genuinely unmatched! Everyone is so encouraging, and having that layer of support makes a world of difference. It was also super motivating to hear what the other contributors have been up to. Seeing how much progress everyone has made gave me a massive burst of inspiration to jump right back into development! 🛠️ importCanonical.ts is Completed! Once the meeting was over, I officially finished implementing the entire import pipeline in importCanonical.ts! 🥳 This file does the heavy lifting of taking our clean, deterministic canonical JSON and reconstructing the circuit right back onto the user's canvas. Here is what's packed inside: 🔀 Full Multi-Circuit Support: The import pipeline seamlessly handles projects containing multiple individual circuits. 📐 Smart Subcircuit Dependency Resolution: Just like the export pipeline, the import engine now uses Kahn's Algorithm to figure out the exact sequence the circuits need to be loaded in so that nested dependencies never break. 🛑 What's Missing? (For Now): The import pipeline doesn't validate the incoming JSON file . I am waiting until the canonical format is finalised. Once that's locked in, I will add JSON schema validation in the file. 🚀 The PR Status On the GitHub side of things, the three foundational Pull Requests I opened earlier are still actively under review . One of my mentors gav

A while back I set myself a slightly unhinged goal: build a web browser from scratch in Node.js and Electron no external HTML/CSS/layout libraries, everything hand-rolled. URL parser, TCP/TLS socket, HTTP pipeline, HTML tokenizer, DOM builder, CSS tokenizer, CSS parser, style matcher, layout engine, canvas renderer. All of it, from zero. so,I called it Courage Browser . This week, after dozens of daily sessions, I hit a milestone that felt disproportionately satisfying: Courage now renders info.cern.ch the very first website ever put on the internet almost pixel-for-pixel identical to real Chrome. It sounds small. It is not small. Getting there meant chasing down bugs across nearly every layer of the browser. Why info.cern.ch If you haven't seen it, info.cern.ch is CERN's preserved copy of Tim Berners-Lee's original website. It's about as simple as HTML gets — one heading, a paragraph, a bulleted list of links. No CSS file, no JavaScript, no styling of any kind beyond what a browser applies by default. Which is exactly why it's a great test case. If your browser can't get a page with zero author CSS to look right, it has no business trying to render anything more complex. Default styling headings being bold, links being blue and underlined, bullets showing up in the right place has to work before anything else does. The bugs I found by just... comparing screenshots I put a screenshot of Courage's render side-by-side with Chrome's and started listing differences. Two jumped out immediately: The <h1> wasn't bold in Courage, even though it clearly should be. The links had underlines but weren't blue , they were rendering in the default text color. Neither of these had anything to do with what I was originally working on that day (CSS attribute selectors, for an upcoming GitHub-rendering push). But they were visible, they were wrong, and they were small enough to fix in one sitting. So I did. Bug #1: styles computed before they were applied Courage has a defaultRules ar

Every Java engineer who has connected JConsole — or JDK Mission Control — to a server in another network segment knows the ritual. Open the JMX port. Discover that RMI quietly opened a second port — random by default. Pin it with a system property nobody remembers without searching. File a firewall ticket for both. Wait. What fewer people know: the JMX specification shipped with the second remote transport that has none of these problems. One socket, one port, TLS underneath if you want it. It's called JMXMP — the JMX Messaging Protocol. It lost for the least mysterious reason in software — RMI shipped by default, JMXMP was a separate download, and defaults win — and its reference implementation has been effectively abandoned since around 2008. Yet, it never quite died. Code that refuses to die usually knows something. I didn't set out to resurrect it. I fell into it. The port dance, briefly The default remote JMX stack rides on RMI. The connection URL tells you most of the story: service:jmx:rmi:///jndi/rmi://host:1099/jmxrmi I'll spare you the full anatomy behind that URL — there's a JNDI lookup in it, and that second, dynamically assigned port from the ritual above; few people ever learn the details, which is rather the point. Dynamic ports were a reasonable design for 1999's flat networks. Between today's firewalls, NAT, and containers, they're friction — not because RMI is bad, but because the network it was designed for no longer exists. The JMXMP URL: service:jmx:jmxmp://host:9875 One socket. TCP in, TCP out. That's the whole networking story. How I ended up in this codebase I maintain JConsoleBooster , a modernized JConsole. It shipped fine for years on the 2008-era JMXMP jar — the one historically distributed as jmxremote_optional / jmx-optional , out of Sun's OpenDMK project, republished over the years by several parties because people kept needing single-socket JMX. Then I moved the app to a jlink -built runtime. An automatic module from 2008 does not coo

GitHub热门项目 | The industry-leading GraphQL client for TypeScript, JavaScript, React, Vue, Angular, and more. Apollo Client delivers powerful caching, intuitive APIs, and comprehensive developer tools to accelerate your app development. | Stars: 19,869 | 74 stars today | 语言: TypeScript

GitHub热门项目 | Focus on prompting and generating | Stars: 50,965 | 29 stars today | 语言: Python

GitHub热门项目 | Stable Diffusion web UI | Stars: 164,175 | 115 stars today | 语言: Python

GitHub热门项目 | Codex/ChatGPT multiple account load balancer & proxy with usage tracking, dashboard, and OpenCode-compatible endpoints | Stars: 2,256 | 29 stars today | 语言: Python

GitHub热门项目 | No fortress, purely open ground. OpenManus is Coming. | Stars: 57,109 | 217 stars today | 语言: Python

GitHub热门项目 | Mesh optimization library that makes meshes smaller and faster to render | Stars: 8,081 | 111 stars today | 语言: C++

GitHub热门项目 | Terraform enables you to safely and predictably create, change, and improve infrastructure. It is a source-available tool that codifies APIs into declarative configuration files that can be shared amongst team members, treated as code, edited, reviewed, and versioned. | Stars: 49,269 | 229 stars today | 语言: Go

Markdown to HTML: The Fastest Way to Convert Markdown Online Markdown is one of the easiest ways to write documentation, blog posts, README files, and notes. The only problem is that many platforms require HTML instead of Markdown. Instead of installing software or using complicated editors, you can convert Markdown directly in your browser. I built MDConvertHub to make this simple. It lets you: Convert Markdown to HTML instantly Preview the output before copying Work completely in your browser No signup required Free to use I started building MDConvertHub because I wanted a collection of small Markdown tools in one place instead of visiting different websites for every task. The project now includes multiple Markdown utilities, and I'm continuously adding new tools based on real use cases. If you'd like to try it, I'd love your feedback. 👉 https://mdconverthub.com/markdown-to-html What Markdown tool do you use most often? Feedback and suggestions are always welcome. I'm building MDConvertHub one tool at a time.