GitHub热门项目 | A self-hosted CPA / CLIProxyAPI management panel and observability dashboard for requests, usage, cost, quota, failures, and account health. | Stars: 1,907 | 393 stars this week | 语言: TypeScript

GitHub热门项目 | Incremental engine for long horizon agents 🌟 Star if you like it! | Stars: 10,904 | 52 stars today | 语言: Rust

GitHub热门项目 | A lightweight WebAssembly runtime that is fast, secure, and standards-compliant | Stars: 18,382 | 17 stars today | 语言: Rust

GitHub热门项目 | Super Productivity is an advanced todo list app with integrated Timeboxing and time tracking capabilities. It also comes with integrations for Jira, GitLab, GitHub and Open Project. | Stars: 20,717 | 28 stars today | 语言: TypeScript

GitHub热门项目 | runs anywhere. uses anything | Stars: 30,148 | 31 stars today | 语言: TypeScript

GitHub热门项目 | Business intelligence as code: build fast, interactive data visualizations in SQL and markdown | Stars: 6,656 | 57 stars today | 语言: JavaScript

GitHub热门项目 | Chrome Extensions Samples | Stars: 17,673 | 4 stars today | 语言: JavaScript

GitHub热门项目 | WIFI / LAN intruder detector. Check the devices connected and alert you with unknown devices. It also warns of the disconnection of "always connected" devices | Stars: 2,695 | 18 stars today | 语言: JavaScript

GitHub热门项目 | GenBI (Generative BI) for AI agents, an open-source, governed text-to-SQL through an open context layer that turns natural-language questions into trusted dashboards, charts, and SQL across 20+ data sources, such as BigQuery, Snowflake, PostgreSQL, ClickHouse, Amazon Redshift, Databricks and more. | Stars: 16,057 | 96 stars today | 语言: Python

GitHub热门项目 | A Flexible Framework for Experiencing Heterogeneous LLM Inference/Fine-tune Optimizations | Stars: 18,166 | 328 stars today | 语言: Python

GitHub热门项目 | The new Windows Terminal and the original Windows console host, all in the same place! | Stars: 104,032 | 13 stars today | 语言: C++

GitHub热门项目 | AI Agent Assistant & development framework that integrates lots of IM platforms, LLMs, plugins and AI feature, and can be your openclaw alternative. ✨ | Stars: 36,595 | 62 stars today | 语言: Python

Jurig (Sundanese: ghost ) — an autonomous AI agent that haunts your binaries. .-. ██ ██ ██ ██████ ██ ██████ (o o) ██ ██ ██ ██ ██ ██ ██ | u | ██ ██ ██ ██████ ██ ██ ███ | | ██ ██ ██ ██ ██ ██ ██ ██ ██ '~-~' █████ ██████ ██ ██ ██ ██████ autonomous reverse-engineering agent · android · binary · frida Point it at an APK, XAPK, or native binary and it plans, decompiles, searches, hooks, captures traffic, and writes you a report — by itself. In one live run it took a real Android loan app, auto-extracted the XAPK, decompiled 13,367 classes , grepped the sources, and surfaced a hardcoded AES key with a zero IV plus the full API endpoint map — then asked me whether it should go dynamic with Frida. This post is the build story: the architecture, the design bets, and the three bugs that genuinely fought back. Repo: https://github.com/ReverserID/JURIG Why build another agent? Existing "AI reverse engineering" is mostly a pile of MCP servers you wire into a chat client. That's fine, but I wanted something opinionated: Autonomous , not chat — it drives a real toolchain end to end. A single portable binary — no Python venv soup, no MCP daemons. Multi-model — my Claude subscription, OpenRouter, local Ollama, Kimi, Qwen. A TUI that feels like a hacker tool , not a log dump. So: Go. Charmbracelet for the TUI (Bubble Tea + Lipgloss + Glamour). And a hard rule — no MCP . Every capability is a native Go function that shells out to a portable RE binary, or does the work in pure Go. Architecture ┌─ agent loop ─┐ plan → ask scope → recon → locate → dynamic → report │ │ │ LLM router │ anthropic · openai-compat (openrouter/ollama/kimi/qwen) · claude-cli │ │ │ 25+ tools │ jadx · apktool · radare2 · ghidra · frida · adb · proxy │ │ + secret_scan · url_extract · manifest · elf/pe_info · search_code │ │ │ TUI │ animated ghost header · code cards · model picker · NET panel └──────────────┘ One wire format, many providers The whole thing speaks the Anthropic Messages protocol internally. A router a

Python quickstart: nutrition data in 10 lines You can search Dietly's public nutrition catalog with one GET request to https://api.getdietly.com/search . The response is a JSON array of foods, not an object with a results property. Install requests , run the example below, and you have a working nutrition lookup. The rest of this page turns that single call into something dependable: a client class, correct field handling, and retries that respect the rate limit. Make your first request The only required parameter is q (minimum two characters). Use limit to cap results between 1 and 50. Ten is plenty while you explore. import requests r = requests . get ( " https://api.getdietly.com/search " , params = { " q " : " greek yogurt " , " limit " : 5 }, timeout = 10 ) r . raise_for_status () foods = r . json () for food in foods : print ( food [ " name " ], food . get ( " protein_g " )) Understand the fields you get back Each result is a flat object. Nutrient values are per 100 g of the product unless noted, and any nutrient can be null when the source label did not list it. Treat null as unknown, never as zero. Field Meaning id Stable Dietly food ID, used for direct lookups name , brand Product name and brand when known calories_kcal Energy per 100 g protein_g , fat_g , carbs_g Macronutrients per 100 g fiber_g , sugar_g , saturated_fat_g , sodium_mg Detail nutrients per 100 g, often null serving_size_g , serving_desc One serving in grams and its label wording, when provided source , confidence Where the record came from and how sure Dietly is static_url Path to the food's page on getdietly.com, when one exists To convert a per-100 g value to a portion, multiply by grams and divide by 100. For a 150 g serving of a food with 10 g protein per 100 g, that is 10 * 150 / 100 = 15 g. Read the result defensively An empty search is [] , which is a normal outcome rather than an error. Guard for it, and keep null nutrients as null in your own model. food = foods [ 0 ] if foods else

Introduction Linux is the backbone of modern infrastructure. From cloud servers and firewalls to SIEM platforms and security tools, Linux runs silently behind most enterprise environments. For a Security Operations Center (SOC) analyst, understanding Linux is not optional — it is a core skill. One of the most critical security mechanisms in Linux is its file permission and ownership model. Attackers abuse permissions to execute malware, hide persistence, escalate privileges, and erase evidence. SOC analysts rely on permission analysis to detect anomalies, investigate incidents, and build accurate timelines. Become a Medium member This article covers Linux File Permissions and Ownership in deep detail from a SOC analyst’s perspective. It is designed to take you from absolute beginner to security-aware professional, with real-world examples, attack scenarios, and investigation insights. Why Linux File Permissions Matter in SOC In SOC operations, analysts constantly deal with: Authentication logs System logs Application logs Scripts and binaries Configuration files Evidence files during incident response Every one of these objects is protected by Linux permissions. From a SOC perspective: Incorrect permissions = security risk Permission changes = potential indicator of compromise Executable permissions = possible malware Ownership changes = possible log tampering Understanding permissions allows SOC analysts to: Detect unauthorized access Identify privilege escalation Spot malware execution Preserve forensic evidence Reconstruct attacker activity Understanding Linux File Permission Basics Linux follows a Discretionary Access Control (DAC) model. This means: The owner of a file controls who can access it Permissions define what actions are allowed Every file and directory in Linux has: A type Permissions An owner (user) A group These attributes decide: Who can read the file Who can modify it Who can execute it Viewing Permissions Using ls -l The most common command to i

I don’t log in to my LinkedIn account anymore, haven’t done so in years. “AI first this, AI driven that,” alright, alright, I get it! You guys absolutely love AI, and I can’t stand the fact that after almost 5(!!!) years, people still talk about it like it’s the best thing since chicken nuggets. Back when LLMs have started showing somewhat positive results when it came to generating less-than-average code, I came to a devastating conclusion: My friends and colleagues might not actually enjoy coding at all. Maybe they just didn’t enjoy coding the way I do—but either way, I was extremely sad and actively burnt out to find that everybody around me jumped on the prompting bandwagon without giving it much of a critical second thought. I could argue that it was partially because of their employers, but it was definitely because they chose and wanted to. They pressed me “It’s the future, aob2f, we don’t need to write code anymore.” “I just tell Claude to do it, and it’s done.” “I don’t write a single line of code anymore, don’t be left behind.” Some even outrageously claimed “Yeah I reviewed Claude’s 40k lines PR in two days, it was good.” I was baffled. Was I in this sick, absent-minded Truman show spinoff? Were these the same smart, even genius individuals that have built and driven the world’s innovation in the past 30 years with their own hands and minds? It got to a point where I started doubting myself. Maybe it’s really that good? I genuinely gave it a thought. Eventually, I reluctantly gave in and tried vibe coding for the first time… You see, up until then I exclusively used AI as a sophisticated search engine. I asked a technical question—got an answer. More than 50% of the times it was inaccurate or a full-on hallucination, and then I validated the result through trial and error. Admittedly it was better than blindly googling niche bugs and finding nothing but a lonely and vague question from 8 years ago on Stack Overflow. But matter of fact—vibe coding was a mi

A few weeks back I picked up google-gemini/gemini-cli issue #28090: the shell tool was forwarding a command's entire stdout/stderr straight into the model's context, with no cap unless you opted into an LLM-based summarization step. Run one noisy build command and you'd hand the model tens of thousands of tokens of log spam it never asked for. The fix sounded trivial: cap the output before it goes into llmContent . I had a one-liner in my head before I'd even opened the file. That one-liner is exactly the kind of "obviously correct" fix that ships bugs. The one-liner The naive version looks like this: const MAX = 32 * 1024 ; // 32 KiB function truncate ( output ) { if ( output . length <= MAX ) return output ; return output . slice ( 0 , MAX ) + ' \n ...[truncated]... \n ' + output . slice ( - MAX ); } It compiles. It passes a quick manual test with a big ASCII log file. It looks done. I almost committed it as-is before writing the actual test suite. The problem is what .slice() is slicing. JavaScript strings are sequences of UTF-16 code units, not bytes and not Unicode codepoints. Most characters in typical shell output (letters, digits, punctuation) are one code unit each, so .slice() looks safe in casual testing. But the moment real-world command output contains anything outside the Basic Multilingual Plane — an emoji in a commit message, certain box-drawing/progress-bar characters some CLIs use, non-Latin filenames — that character is represented as a surrogate pair : two 16-bit code units that only mean something together. Slice between them and you don't get an error. You get one dangling unpaired surrogate on each side of the cut, silently baked into the string that gets sent to the model. No exception. No lint warning. JSON.stringify on the payload can even throw later, in a completely unrelated part of the request pipeline, for a reason that has nothing to do with where the bug actually is. Or worse: it doesn't throw, and the model just receives a slightly