标签：#Python

I’ve been writing my project - Python port scanner for 9 months now. You might be wondering, “Why is it taking so long?” Most of the time was spent figuring out how raw sockets work, how to write a function for manually assembling a packet, calculating the checksum, packing the IP packet bytes, the TCP header, the pseudo-header using struct.pack, sending the packet, and how SYN scanning works. Why did I decide to take such a complicated route instead of just using Scapy? I’m a principled person and have a very exhausting yet useful skill—understanding everything. That’s how I got acquainted with big-endian, or “network byte order.” I won’t go into the details of big-endian logic, to be honest, I’m already mentally exhausted It took several evenings and nights to analyze and understand the principles—watching videos, reading RFCs, and looking at GitHub code (which I didn’t understand)—but what bothered me most was that I had to ask gemini for an explanation. As I mentioned above, I’m very principled; I can’t just copy code without understanding it, so I ask gemini for a prompt like this: “Don’t write the code for me. If I end up asking you for an example because I’m tired, explain it line by line.” Yesterday I realized I don’t fully understand Python (basics)—I don’t remember REPL—so I went to ask Gemini for advice; I don’t have anyone competent who could help me with advice. I’m not very sociable, and the only thing that’s interested me for the last four years is IT. I used to make music. Lately, something strange has been going on with my health, the day before yesterday I woke up because of a nosebleed; this has happened before, but on a larger scale. I stopped working on the scanner yesterday and decided to try writing a backup script in Python. I found an article and jotted down in Obsidian what the project should and shouldn’t do. Previously, the project used Docker, Prometheus, and Grafana. My questions: Am I a good developer, and am I even one at all? Should

Most RAG tutorials I found were either "pip install langchain and you're done" or 50-page academic papers. I wanted something in between — a pipeline I could actually explain in an interview, where I understood every line. So I built one from scratch. No LangChain, no LlamaIndex, no frameworks. Just FastAPI, FAISS, sentence-transformers, and an LLM API. Here's what I built, what worked, and what broke. The architecture PDF --> extract text (pypdf) --> chunk (500 char, 50 overlap) --> embed (MiniLM-L6-v2) | v question --> embed --> FAISS top-k search --> build prompt with chunks --> LLM --> answer + sources Five Python files, ~300 lines total: File Responsibility main.py FastAPI app, 3 endpoints, prompt engineering pdf_loader.py PDF text extraction via pypdf rag.py Chunking + embedding store.py FAISS vector store wrapper llm.py Swappable LLM client (Groq / OpenAI / Anthropic) How the upload works When you POST a PDF to /upload , three things happen: 1. Text extraction — pypdf reads each page and returns the raw text. Pages with no extractable text (scanned images) are skipped. 2. Chunking — each page is split into ~500-character chunks with 50 characters of overlap. The overlap prevents losing context at chunk boundaries. CHUNK_SIZE = 500 CHUNK_OVERLAP = 50 def chunk_pages ( pages ): chunks = [] chunk_id = 0 for text , page_num in pages : start = 0 while start < len ( text ): end = min ( start + CHUNK_SIZE , len ( text )) chunk_text = text [ start : end ]. strip () if chunk_text : chunks . append ( Chunk ( chunk_id = chunk_id , text = chunk_text , page = page_num )) chunk_id += 1 if end == len ( text ): break start = end - CHUNK_OVERLAP return chunks 3. Embedding — each chunk is embedded into a 384-dimensional vector using all-MiniLM-L6-v2 . This runs locally on CPU, no API call needed. Vectors are normalized so we can use inner product as cosine similarity. def embed_texts ( texts ): model = get_embed_model () # lazy-loaded singleton vectors = model . encode ( texts

This is the concrete, runnable walkthrough for Post 1 of the Portway series . The goal: stand up a single model behind an OpenAI-compatible endpoint on hardware you already own, call it from the official OpenAI SDK, and internalize the stateless contract. Everything here runs locally for $0. What this post covers A demo.py script with two blocks: Round-trip — one chat call via the OpenAI SDK, printing the content and the usage object. Stateless proof — the same final question sent as a 1-turn message and as the last turn of a 5-turn fabricated history; both prompt_tokens values are printed alongside an explanation of the delta. Engine choice on this machine Apple Silicon Mac, 48 GB unified memory, Ollama already installed. The demo uses Ollama's OpenAI-compatible endpoint at http://localhost:11434/v1 and the gpt-oss:20b model (~14 GB). The wider Portway series uses llama.cpp on Mac (Ollama is called out as problematic for Qwen3.5 in Post 2). For Post 1 — one model, prove the contract — Ollama is fine and already on the box. Model options by available RAM The demo script works with any Ollama-served model — just substitute the model name in demo.py . The table below covers machines from 9 GB unified memory upward. Model Pull command Approx size Min RAM Notes llama3.2:3b ollama pull llama3.2:3b ~2 GB 8 GB Fastest; good for testing the contract gemma3:4b ollama pull gemma3:4b ~3 GB 8 GB Google; solid instruction-following mistral:7b ollama pull mistral:7b ~4.1 GB 8 GB Classic 7B baseline llama3.1:8b ollama pull llama3.1:8b ~4.7 GB 9 GB Best quality under 10 GB qwen2.5:7b ollama pull qwen2.5:7b ~4.4 GB 9 GB Strong at instruction + reasoning gpt-oss:20b ollama pull gpt-oss:20b ~14 GB 24 GB Used in this post's sample output On a 9 GB machine, replace gpt-oss:20b in demo.py with llama3.1:8b or qwen2.5:7b — the contract demonstration is identical. Prerequisites Ollama running locally ( curl -s http://localhost:11434/api/tags should return JSON) uv installed ( uv --version )

GitHub热门项目 | Skills Catalog for Codex | Stars: 20,894 | 975 stars this week | 语言: Python

GitHub热门项目 | Apache Airflow - A platform to programmatically author, schedule, and monitor workflows | Stars: 45,602 | 13 stars today | 语言: Python

GitHub热门项目 | Eagle: Frontier Vision-Language Models with Data-Centric Strategies | Stars: 1,556 | 124 stars today | 语言: Python

GitHub热门项目 | VoxCPM2: Tokenizer-Free TTS for Multilingual Speech Generation, Creative Voice Design, and True-to-Life Cloning | Stars: 22,616 | 658 stars today | 语言: Python

Criei um gerenciador de downloads desktop em Python e quero feedback da comunidade! O PyFlowDownloader é um app desktop feito com Python + PySide6 que usa yt-dlp para baixar vídeos e áudios de forma assíncrona do youtube. Algumas coisas que ele já faz: Fila de downloads com progresso em tempo real Cancelamento de downloads ativos ou pendentes Suporte a MP4 e MP3, de 144p até 1080p Histórico com exportação para CSV Interface desktop com tema visual via QSS Build para Windows via PyInstaller + pipeline de release no GitHub Actions Está na versão v0.3.0 e ainda tem muito espaço pra crescer. Repositório: https://github.com/Vinny00101/PyFlowDownloader Se você puder **testar e deixar sua opinião nos comentários, ficaria muito grato! Quer saber: O que achou da experiência de uso? Algum bug que encontrou? O que você adicionaria ou melhoraria no projeto? Todo feedback é bem-vindo!

Quark’s Outlines: Python User-Defined Functions Overview, Historical Timeline, Problems & Solutions An Overview of Python User-Defined Functions What is a Python user-defined function? You can define your own function in Python using the def keyword. A Python user-defined function is made when you write a def block in your code. When Python runs this block, it creates a function object. A function object has special parts. These include its name, its list of default values, and its code. It also keeps a link to the global names from the file where it was made. You can use this object to call the function later with any valid input. Python lets you create named function objects with the def keyword. def greet ( name = " friend " ): return " Hello, " + name print ( greet ()) print ( greet ( " Mike " )) # prints: # Hello, friend # Hello, Mike The function greet is now a user-defined function. Python stores its name, code, and default values for later use. What are the special parts of a Python function? A Python function holds many facts about itself. These are called attributes. For example, __name__ holds the function name. __defaults__ is a tuple of default values. __globals__ holds the global names it can see. __code__ is a special object that stores the function’s bytecode. Python functions store their details in special attributes. def square ( x = 2 ): return x * x print ( square . __name__ ) print ( square . __defaults__ ) print ( square . __code__ . co_varnames ) # prints: # square # (2,) # ('x',) These parts let Python understand and run your function later. A Historical Timeline of Python User-Defined Functions Where do Python’s user-defined functions come from? User-defined functions in Python build on ideas from earlier languages. They let you name blocks of code and reuse them. Over time, Python added new parts to function objects—like closures, default values, and metadata—to make them more powerful. People designed ways to name and reuse logic 1958 — Fu

The .txt File as the Soul of a Personal AI — FileRAG Memory Architecture By Dharanidharan J (JD) Full Stack & AI Engineer | Building Jarvix The Problem Nobody Talks About Every chatbot tutorial teaches you the same thing: history = [] history . append ({ " role " : " user " , " content " : message }) And that works — until it doesn't. After 500 turns, your dict has forgotten who the user is. After 1000 turns, you're hitting token limits. After a restart, everything is gone. Redis helps with persistence but still buries early facts under noise. Vector DBs help with retrieval but bloat storage and need infrastructure. What if the memory itself was just a file? The Idea Every conversation a user has gets distilled into a plain .txt file. That file is the brain. On every new query, a hybrid BM25 + semantic RAG retrieves the most relevant chunks from it and injects them as context. users/ └── jd.txt ← the soul file The soul file looks like this: [Turns 1-5] - User's name is JD, software engineer - Building FileRAG, a novel memory architecture - Uses Pop!_OS with Fish shell and NVIDIA GPU [Turns 6-10] - Has a cat named Pixel who distracts during coding - Paused TaskNest due to burnout - Now focused on AgenticMesh Human readable. Editable. Yours. Why This Is Different Most memory systems store messages . FileRAG stores a relationship . System What it stores Dict / Redis Raw message objects Vector DB Embeddings of messages FileRAG Distilled understanding of the user The longer you use it, the more the AI understands you — not because it has more messages, but because it has a better summary of who you are. The Architecture User message ↓ Topic drift check (cosine similarity) ├── Drift detected → distill current buffer immediately └── No drift → continue ↓ Hybrid retrieval (BM25 + ChromaDB) from soul file ↓ Inject context → LLM responds ↓ Append to turn buffer ↓ Every 5 turns → distill → append to soul file → update ChromaDB ↓ Emergency distillation on exit (SIGINT/SIGTERM)

I came across Scrapling through a recommendation on X and decided to put it through its paces — not against a demo page, but against Lazada Singapore, a production site with Google reCAPTCHA and a custom slider verification. The setup: a single 4GB VPS, no residential proxies, no credits, just open-source tools. Here's the full journey: installation pitfalls, wiring it into an AI agent, choosing the right browser for the job, and the real-world benchmarks that followed. What Is Scrapling? Scrapling is an adaptive web scraping framework for Python (BSD-3, v0.4.8). It handles everything from single HTTP requests to full-scale concurrent crawls. What sets it apart from the BeautifulSoup/Scrapy world: Adaptive element tracking — saves fingerprints of targeted elements and relocates them after site redesigns using similarity scoring. Your scrapers survive CSS changes without maintenance. Three fetchers, one API — HTTP ( Fetcher , curl_cffi), browser ( DynamicFetcher , Playwright Chromium), and stealth ( StealthyFetcher , Chromium + anti-bot patches). Swap with one line. Spider framework — Scrapy-like API with async, concurrent crawling, Ctrl+C pause/resume via checkpoint persistence, multi-session support. MCP server — 14 tools exposed natively for AI coding agents. Your agent can call mcp_scrapling_get , mcp_scrapling_fetch , mcp_scrapling_stealthy_fetch directly. It's open source, pip-installable, and designed to be the backbone of a scraping stack — not just another tool in the toolbox. Installation on a 4GB VPS This is where the real story starts. The VPS has 4GB RAM, 2 vCPUs, 77GB disk, and runs an AI agent gateway (615MB baseline). Every browser installation decision matters. What we installed pip install scrapling[fetchers,ai] # HTTP + Chromium + MCP server scrapling install # Downloads Playwright browsers This pulls in Playwright Chromium, Firefox, and WebKit (~1.3GB disk), plus curl_cffi for HTTP requests and patchright (Playwright fork) for browser automation.

If you manage PostgreSQL databases across multiple environments, you've probably done this: SSH to the DB host (or connect via psql ) Run CREATE USER jsmith CONNECTION LIMIT 20 PASSWORD '...' Slack the password to the developer Forget to log it anywhere Repeat for every environment, every onboarding, every access request It's tedious, error-prone, and leaves zero audit trail. Here's a better way. What I Built pg-user-api is a lightweight Flask REST API that wraps PostgreSQL user provisioning in clean HTTP endpoints. You register your databases once in a SQLite inventory, then any tooling — CI pipelines, internal portals, Ansible playbooks, or a plain curl — can create and manage users across environments without ever touching psql . GitHub: pcraavi/PostgreSQL-user-creation-API The Problem It Solves In teams that span dev, QA, UAT, and prod, you end up with different patterns of users: App service accounts — named after the host/port combo ( web01_8080 ) Kubernetes workload accounts — named after env prefix + farm ( dv_gearservice ) Individual dev/QA accounts — low connection limits, scoped to non-prod Read-only analyst accounts — prod only, no DDL DBA accounts — CREATEDB CREATEROLE LOGIN , rarely provisioned Each type has different CONNECTION LIMIT values, privilege levels, and naming conventions. Encoding these patterns in an API means the rules are consistent, repeatable, and auditable. Architecture The project is intentionally small — five Python files and a requirements list: pg_user_api/ ├── app.py # Flask app — all endpoints ├── auth.py # HTTP Basic Auth (constant-time compare) ├── database.py # SQLite registry + audit log ├── notifications.py # Notification stubs (Webex / Slack / Email) ├── seed_db.py # One-time setup: creates DB + sample records └── requirements.txt Two credential pairs, clearly separated: PG_API_USER / PG_API_PASS — who can call this API (your team/tooling) PG_ADMIN_USER / PG_ADMIN_PASS — the PostgreSQL DBA role that executes DDL The DBA cr

Anthropic's Mythos model can autonomously find zero-day vulnerabilities. Their CVD disclosure process uses manual SHA-3-512 hash commitments to prove findings existed. I built something that automates that in one line of Python. What AetherProof does One function call generates a 128-byte Ed25519-signed receipt that proves: What model ran — FNV-1a hash of provider/model ID What it produced — hash of the output When — cryptographic nanosecond timestamp Tamper-evident — flip any byte anywhere → INVALID python import aetherproof receipt = aetherproof.for_anthropic( "Find vulnerabilities in this binary.", finding_text, model="claude-mythos-preview" ) receipt.save("CVE-2026-001.receipt") print(receipt.verify()) # True Try it in 30 seconds pip install aetherproof python -c " import aetherproof r = aetherproof.for_anthropic('question', 'answer') print(r.verify()) # True print(r.pretty()) " The unusual part — invisible Unicode watermarking Receipts embed invisibly into any text using Unicode Private Use Area codepoints (U+E000–U+E0FF). AI output carries its own audit trail. Works in any language — Arabic, Chinese, Devanagari, Hebrew, Thai, Japanese all tested. signed_output = aetherproof.embed(ai_response, receipt.to_bytes()) # Text looks identical. Receipt is inside. aetherproof.verify_embedded(signed_output) # True Numbers 187 tests, 0 failures 128/128 byte flips all detected 1000/1000 tamper probes pass Cross-language: Python generates, Rust CLI verifies 15,446 receipts/sec (Python) · 5,472/sec (Rust) Why AGPL-3.0 Free for open source. Commercial use needs a license. This is the compliance layer under your AI stack — it should be open, auditable, and not vendor-locked. GitHub https://github.com/pulkit6732/aetherproof Built by Pulkit. Feedback welcome.

What Happened Last month, the UK Government's AI Safety Institute merged AgentThreatBench into their official inspect_evals framework — the same framework they use to evaluate frontier AI models from OpenAI, Anthropic, and Google DeepMind. AgentThreatBench is an open-source adversarial benchmark I built that contains 200+ attack payloads specifically designed to test whether AI agents can resist memory poisoning attacks. Why This Matters AI agents are increasingly being deployed with persistent memory — they remember past conversations, user preferences, and context across sessions. This creates a new attack surface: memory poisoning . An attacker who can inject malicious content into an agent's memory can: Exfiltrate sensitive data on subsequent sessions Override safety instructions persistently Manipulate agent behavior without the user's knowledge The OWASP Agentic Security Initiative identified this as ASI06 — Agent Memory Poisoning . What AgentThreatBench Tests The benchmark covers 5 attack categories: Category Payloads Description Prompt Injection 40+ Instructions disguised as memory content Protected Key Tampering 40+ Attempts to overwrite system-level keys Sensitive Data Leakage 40+ PII/credential exfiltration via memory Size Anomaly 40+ Memory inflation / resource exhaustion Behavioral Drift 40+ Gradual personality/instruction shifts How to Use It pip install agentthreatbench # Run the full benchmark against your agent atb run --target your_agent_endpoint --output results.json # Or use individual attack categories atb run --category prompt_injection --target your_agent_endpoint The BEIS Validation The UK Government's AI Safety Institute uses inspect_evals to: Evaluate frontier models before deployment decisions Benchmark safety mitigations across providers Track regression in safety properties over time Having AgentThreatBench merged into this framework means it's now part of the official government toolkit for AI safety evaluation. Links GitHub : github.co

GitHub热门项目 | Memory library for building stateful agents | Stars: 4,467 | 599 stars this week | 语言: Python

GitHub热门项目 | Turn any PDF or image document into structured data for your AI. A powerful, lightweight OCR toolkit that bridges the gap between images/PDFs and LLMs. Supports 100+ languages. | Stars: 78,940 | 148 stars today | 语言: Python

GitHub热门项目 | PentestAgent is an AI agent framework for black-box security testing, supporting bug bounty, red-team, and penetration testing workflows. | Stars: 2,489 | 30 stars today | 语言: Python

GitHub热门项目 | Deep Eye orchestrates multiple AI providers (OpenAI, Claude, Grok, Gemini, OLLAMA, Groq, Mistral, OpenRouter, LiteLLM, LM Studio) for intelligent payload generation, scans targets for 45+ vulnerability types, and produces professional reports with compliance mapping. | Stars: 1,562 | 42 stars today | 语言: Python

GitHub热门项目 | 自动化上传视频到社交媒体：抖音、小红书、视频号、tiktok、youtube、bilibili | Stars: 11,582 | 185 stars today | 语言: Python

GitHub热门项目 | A platform for reproducible world model research and evaluation | Stars: 1,058 | 346 stars today | 语言: Python