标签：#Git

GitHub: https://github.com/abrownfox0/abrownfox001-twap60-prediction-trigger-system YouTube walkthrough: https://www.youtube.com/watch?v=XzhugRL6BV4 This is a new 4-part series comparing the two venues that actually matter for short-horizon BTC direction: Part 1 — Settlement design: Polymarket TWAP60 vs Kalshi 60s average (this post) Part 2 — Product shape: 5-minute specialist vs 15-minute regulated stack Part 3 — What a directional bot must change when crossing venues Part 4 — Where edge survives, and where it dies Live profile: @abrownfox001 The Real Split Is Not “On-Chain vs Regulated” People compare Polymarket and Kalshi as if the important difference is KYC, geography, or chain vs centralized matching. For a short-horizon BTC bot, those matter later. The first difference is simpler: What exact number decides Up vs Down? If you get that wrong, every signal, backtest, and scratch rule is solving the wrong problem. Two Venues, Two Official Averages Both platforms moved away from “whatever the last print was.” Both now settle short BTC contracts on a one-minute average . They do not use the same average. Polymarket crypto Up/Down Kalshi BTC short contracts Shortest liquid product 5-minute Up/Down 15-minute Up/Down ( KXBTC15M ) Settlement idea Time-weighted average 60-second simple average Official source Chainlink TWAP CF Benchmarks Real-Time Index (BRTI family) Window 60 seconds for current 5m / 15m / 4h crypto Final 60 seconds before close , sampled ~1s Open reference Matching TWAP at slot start Strike / floor set by the contract Feed path for bots Polymarket RTDS or Chainlink Data Streams Kalshi market fields + CF Benchmarks index Market structure On-chain CLOB Centralized CFTC-regulated exchange Same word — “60-second average.” Different index. Different sampling. Different product clock. Why Both Platforms Converged on 60 Seconds Snapshot settlement created the same failure mode everywhere: A brief push into one venue’s book A wick at the exact close Retail on

GitHub热门项目 | Daily updated list of Tech Company OAs and Interview Problems. Save your time from finding them all over the internet. | Stars: 4,635 | 98 stars today | 语言: Python

GitHub Trending Digest — 28 Agustus 2026 Minggu ini, repo-repo di GitHub menunjukkan arah yang cukup jelas: AI agent menjadi semakin otonom dan ringan . Dari framework yang membuat agent berpikir hemat kode, hingga engine lokal untuk model MoE (Mixture of Experts) yang bisa berjalan di hardware apa pun, ekosistem open source terus mendorong batas apa yang mungkin dilakukan developer dengan sumber daya terbatas. Berikut rangkuman lima repository paling trending minggu ini. 1. deepseek-ai/deepseek-harness ⭐ 200.216 Bahasa: TypeScript DeepSeek Harness mengusung filosofi "Everything is a Plugin" . Repositori ini menawarkan kerangka kerja yang memungkinkan developer membangun pipeline AI secara modular, di mana setiap komponen—mulai dari preprocessing data, inference, hingga post-processing—dapat ditukar seperti lego. Dengan pendekatan berbasis plugin ini, tidak ada lagi lock-in ke satu library atau model tertentu. Mengapa repo ini trending? Karena komunitas sedang haus akan fleksibilitas. DeepSeek sendiri terus merilis model yang kompetitif dengan model besaran internasional, dan Harness memberi jalan bagi developer untuk mengintegrasikannya tanpa ribet. Use case praktis: Membangun sistem RAG (Retrieval-Augmented Generation) di mana Anda bisa mengganti embedding model, vector store, dan LLM backend tanpa mengubah logika inti aplikasi. 2. DietrichGebert/ponytail ⭐ 114.054 Bahasa: JavaScript Ponytail memperkenalkan pendekatan unik: membuat AI agent bersikap seperti "senior developer paling malas di ruangan" . Filosofi dasarnya sederhana—kode terbaik adalah kode yang tidak pernah kamu tulis. Ponytail mendorong agent untuk memaksimalkan reuse, meminimalkan boilerplate, dan menolak menulis ulang hal yang sudah ada. Trending karena resonansi budaya. Kalimat "the best code is the code you never wrote" langsung menyentuh pain point developer yang sering terjebak menulis ulang solusi yang sudah tersedia. Ponytail bukan sekadar tool, tapi semacam mindset yang dikodekan. Use case

This blog was originally published by Brian Tant on the Raxis blog January 21, 2026 GitHub has become the backbone of modern software development, hosting over 100 million repositories and serving millions of developers worldwide. But this massive scale and inherent trust have created an irresistible target for cybercriminals. What we’re seeing now is a sophisticated evolution in attack methodologies: threat actors are weaponizing GitHub’s infrastructure to distribute malware on an unprecedented scale. The numbers are staggering. Recent investigations have uncovered campaigns affecting nearly one million devices, with attackers creating hundreds of malicious repositories designed to fool even experienced developers. We’re not talking about a few bad actors uploading sketchy code: these are well-orchestrated, long-term campaigns that exploit fundamental assumptions about code repository security. The Scale of GitHub-Based Attacks The most significant wake-up call came from Microsoft’s analysis of the Storm-0409 malvertising campaign, which infected close to one million devices worldwide. But that’s just the tip of the iceberg. Security researchers have identified over 1,300 GitHub repositories vulnerable to RepoJacking attacks, where attackers can hijack existing repositories and inject malicious code into projects that developers already trust. Far from random or opportunistic attacks, these are systematic campaigns that demonstrate deep understanding of developer workflows, supply chain dependencies, and the psychological factors that make developers trust certain repositories over others. Major Attack Campaigns: A Technical Deep Dive THE GITVENOM CAMPAIGN: LONG-TERM DECEPTION AT SCALE Analysis of the GitVenom campaign revealed a masterclass in social engineering and technical sophistication. Attackers created hundreds of repositories over several years, each carefully crafted to appear legitimate. They featured professionally written README files (possibly generat

God’s Eye View was the top project on GitHub Trending when we selected it for Jian AI Lab’s daily experiment. The pitch is immediately compelling. It brings aircraft, vessels, satellites, earthquakes, wildfire data, traffic, CCTV sources, and other feeds into one 3D globe. The repository also makes a serious effort to label data as live, modeled, reconstructed, or simulated. We tested commit b22573a9db28e47c324821ebdd4c67bdb241c0e1 on Linux with Node.js 24.19.0 and npm 11.9.0. Installation and security checks We first ran npm ci --ignore-scripts , reviewed the install-script sources, and then ran the normal npm ci . Both installations succeeded with 201 packages. The root project has no preinstall, install, or postinstall hook. Transitive install scripts come from esbuild, fsevents, Puppeteer, and sharp. npm audit --omit=dev reported no known vulnerabilities in production dependencies. A common secret-pattern scan did not find hard-coded live credentials. This is a limited check, not a full source audit. The project talks to many external services, including Google Maps, OpenAI, OpenSky, AISStream, NASA FIRMS, TomTom, CelesTrak, OSM, Open-Meteo, GDELT, and Radio Browser. It is local-first, but it is not offline. Server-side keys such as OpenAI and AISStream are read by the local Vite proxy. Google Maps and Cesium tokens are intentionally delivered to the browser. Users must restrict referrers and APIs and set provider budgets and quotas. 2,588 visible assertions passed The main test suite reported 2,587 passing assertions and zero failures. A separate focus-allocation check added one more passing assertion. The visible total was 2,588 passes and zero failures. The process did not exit after the summary. We waited more than 90 seconds and interrupted it manually. The final exit code was 130. The precise result is that all visible assertions passed, while the official test command did not complete with a clean exit in this environment. This may indicate an open handle

GitHub热门项目 | A spy satellite simulator in your browser, except the data is real. Live open source spatial intelligence on a photorealistic 3D globe. | Stars: 7,705 | 1,984 stars today | 语言: JavaScript

We build GPTree with several coding agents working the same repository at once: Claude Code, Codex, and Cursor, each in its own git worktree. The failure that finally made us build tooling for it was small and completely silent. One session was told to replace PaymentService with a Stripe-specific implementation. Another was told to add PayPal support to PaymentService . Different worktrees. Different files. Zero textual conflict. Git merged both branches cleanly, and the second change now depended on an extension point the first had deleted. Nothing in the toolchain had an opinion about it at any moment. Git compares diffs. It cannot compare plans. Worktrees isolate files, not plans Worktrees became the standard answer to parallel agents for a good reason: two sessions editing one checkout will overwrite each other's files and poison each other's context. Isolated checkouts fix that completely. But three failure modes survive file isolation, because they were never about files: Destructive versus additive. One agent removes or replaces a thing another agent is building on. The example above. Merges clean, breaks the design. Duplicate work. Two agents solve the same problem from different angles because nothing assigned ownership. You pay twice and then pay again to reconcile. Contract drift. One agent changes an API, a schema, or a config contract while another codes against the old shape. Compiles, runs, disagrees at runtime. A shared task list helps with the second one, if every agent reads it, every time. Nothing in that setup catches the first or third, because the collision is between intentions, and intentions live in prompts, not in any file a tool can watch. Declare the work before doing it Foremerge is the internal tool we built for this, open-sourced this week. It is a coordination protocol that sits above Git: agents declare what they are about to do, before they do it, in a form precise enough to check. A declaration is an intent with one or more semant

GitHub热门项目 | Open-source personal finance manager. Self-hosted, privacy-first. | Stars: 2,324 | 617 stars this week | 语言: Python

GitHub热门项目 | A smarter cd command. Supports all major shells. | Stars: 38,927 | 70 stars today | 语言: Rust

GitHub热门项目 | Apache OpenDAL: One Layer, All Storage. | Stars: 5,341 | 4 stars today | 语言: Rust

GitHub热门项目 | Where people and agents build in tune. | Stars: 3,495 | 48 stars today | 语言: TypeScript

GitHub热门项目 | Hand-crafted Claude Code Skills focused on improving agent results quality. Compatible with OpenCode, Cursor, Antigravity, Gemini CLI, and others. Includes CodeRabbit open-source alternative. | Stars: 1,415 | 16 stars today | 语言: TypeScript

GitHub热门项目 | Let AI agents use your real, logged-in browser without interrupting your work. CLI + extension for browser automation across any shell-capable AI agent. | Stars: 1,395 | 29 stars today | 语言: TypeScript

GitHub热门项目 | ConardLi's open-source Skills collection, featuring web design, knowledge retrieval, image generation, and more. | Stars: 11,178 | 413 stars today | 语言: CSS

GitHub热门项目 | Help AI coding agents write modern Go | Stars: 1,885 | 314 stars today | 语言: Go

GitHub热门项目 | Alternative Twitter front-end | Stars: 13,657 | 63 stars today | 语言: Nim

drainscan vs gitleaks vs trufflehog: Why Web3 Needs Its Own Secret Scanner Benchmarked on 500+ web3 repositories. Generic scanners miss 73% of web3-specific key leaks. The Problem: Generic Scanners Don't Speak Web3 You run gitleaks detect or trufflehog filesystem on your Solana/Ethereum repo. Green checkmark. You ship. Three months later: $2.3M drained from a private key committed in docker-compose.yml that neither tool flagged as high-confidence. Why? Generic scanners match patterns (regex/entropy). They don't understand web3 key semantics : Blind Spot gitleaks trufflehog drainscan BIP-39 checksum validation ❌ ❌ ✅ Offline address derivation ❌ ❌ ✅ Live balance checks ❌ ❌ ✅ Phantom JSON export detection ❌ ❌ ✅ Solana base58 seed (64-byte) Partial Partial ✅ Token-2022 extension context ❌ ❌ ✅ Entropy + context dedup Generic Generic Web3-aware SARIF 2.1.0 ✅ ✅ ✅ Benchmark: 500+ Web3 Repos Scanned Methodology : Cloned top 500 repos by stars from solana , ethereum , defi , web3 topics. Ran each scanner with default + aggressive configs. Manual verification of findings. Results Summary Metric gitleaks trufflehog drainscan Free Total findings 1,847 3,291 2,156 High-confidence true positives 312 401 687 Web3-specific true positives 89 112 487 False positive rate (high) 34% 41% 3% False negative rate (web3 keys) 73% 68% 4% Avg scan time (500 repos) 12m 47m 8m Key Finding: The 73% Gap Generic scanners missed 73% of web3-specific key types : Phantom/Solflare JSON exports (64-byte arrays) — gitleaks: 0, trufflehog: 12, drainscan: 234 BIP-39 mnemonics with valid checksum — gitleaks: 45 (many false), trufflehog: 67, drainscan: 156 (all validated) Solana base58 seeds — gitleaks: 23, trufflehog: 31, drainscan: 189 EVM keys in .env / .yaml / .toml context — gitleaks: 189, trufflehog: 223, drainscan: 298 Entropy-detected foreign-chain keys (Cosmos, Sui, Near, ed25519 hex) — gitleaks: 0, trufflehog: 0, drainscan: 87 Why drainscan Wins on Web3 1. BIP-39 Checksum Validation = Near-Zero Fal

📝 Originally published (in Japanese) at forge.workstyle.tech . In a previous article , we introduced an environment for parallel execution of coding agents using Git worktrees. This article is a follow-up. As we progressed with parallelization, we ended up with 3-5 Claude Code sessions simultaneously developing the same microservices . What happened was no longer just "parallel execution of tools" but actual "team development" . All the issues that arise in human teams—miscommunication, deployment conflicts, and territorial overlaps—occur here as well. And the practices that work for human teams work almost identically here. We’ll share seven recipes that emerged from actual operations, along with real-life close calls. Real-Life Story: Averting a Deployment Rollback Disaster at the Last Minute One day, while Session A (responsible for voice functionality) was in the middle of a major refactor, Session B (responsible for streaming functionality) sent this message: "We’re about to build the frontend as version 1.0.399 (based on main)." At first glance, this seemed fine. However, in this repository, the authoritative branch for the production environment was not main but a dedicated deployment branch . The latest features from the past few dozen versions were only in the deployment branch, while main was outdated. If Session B had deployed an image based on main, weeks’ worth of features would have been rolled back in production . Session A immediately sent a warning, and Session B halted the build before pushing. Session B then cherry-picked their changes into the deployment branch and rebuilt the image, avoiding the disaster entirely. All this communication was handled autonomously between the agents via session-to-session messages . I (the human) only learned about it later from the logs. This incident highlights two things: parallel agents can cause the same accidents as human teams , and with proper communication channels and rules, they can prevent accidents jus

MyZubster Is Not Trying to Build Another App — We're Exploring a Verifiable Digital Ecosystem For years, software development has largely followed the same pattern: User → Application → Database → Service AI changed part of that equation. IoT changed another part. Blockchain introduced new models for provenance and ownership. But there is still a difficult problem connecting all of them: How can a digital system verify what actually happened in the real world? This is one of the questions driving the development of MyZubster. MyZubster is an Italian open-source digital ecosystem currently under development. It hasn't reached its final public form yet. And that's important. Because we're not presenting a finished platform. We're documenting how the architecture evolves. From application to ecosystem Calling MyZubster simply an "app" increasingly feels incomplete. The architecture we're exploring connects several layers: MYZUBSTER ┌─────────────────┐ │ REAL WORLD │ │ people / places │ │ devices / events│ └────────┬────────┘ │ ▼ ┌─────────────────┐ │ DATA │ │ sensors / users │ │ external sources│ └────────┬────────┘ │ ▼ ┌─────────────────┐ │ PROVENANCE │ │ source / time │ │ context / proof │ └────────┬────────┘ │ ▼ ┌─────────────────┐ │ AI │ │ interpretation │ │ automation │ └────────┬────────┘ │ ▼ ┌─────────────────┐ │ EVIDENCE │ │ verification │ │ reproducibility │ └────────┬────────┘ │ ▼ ┌─────────────────┐ │ DIGITAL SERVICES│ └─────────────────┘ The goal isn't to put every technology imaginable into one application. The interesting part is the connection between these layers. AI needs evidence Generative AI can produce extraordinary outputs. But generation and verification are fundamentally different operations. An AI system can say: "This intervention reduced water consumption by 30%." But where did that number come from? What sensor produced the original measurement? What period was compared? What methodology was used? Was the dataset modified? Can somebody repro

Today's two tasks are both about a new base. A feature branch that needs to sit on top of a master that has moved. A database instance that needs to come back from a snapshot taken when things were fine. In each case, the interesting question is the same: what carries over, and what do you have to say out loud? One Git task, one AWS task. Rebase a feature branch onto master without creating a merge commit, then snapshot an RDS instance and restore it into a new one. The tasks come from the KodeKloud Engineer platform. Rebase: not moving commits, replaying them The requirement was specific, and the specificity is the lesson. A developer's feature branch was behind master. Bring it up to date without losing any feature work, and without a merge commit. That second clause rules out git merge master . Merge joins two histories and records the join, which is the merge commit. Rebase does something else entirely. cd /usr/src/kodekloudrepos/media git branch git log --oneline --graph --all --decorate git checkout feature git rebase master git log --oneline --graph --decorate Git's own documentation describes what happens under git rebase master : it lists the commits on your branch that are not on master, checks out master, and then replays each of your commits on top of it, one at a time, in a way it compares to running git cherry-pick for each one. Replays. Not moves. Every commit that comes out the other side has a new hash, because a commit's identity includes its parent, and the parent is different now. Your work is preserved, the commits carrying it are not the same objects they were. That is exactly why there is no merge commit. Rebase does not join two histories, it rewrites yours so it looks like it was always based on master's current tip. You get a straight line, at the cost of a history that is no longer a record of what actually happened. Two things I had to be deliberate about. Direction. Rebase applies to the branch you are standing on and takes the branch yo