标签：#Rust

If you are an enterprise architect working on Microsoft Entra and AI agents, your first overdue job is not another policy wizard, another dashboard, or another governance steering committee. It is schema design. Specifically, it is deciding how you classify non-human identities with custom security attributes in Microsoft Entra . Not eventually. Up front. I keep seeing the same pattern across customers of every size: teams move quickly on agent experimentation, they onboard identities, they test controls, and then they realize they have no consistent attribute language for policy scope. At that point, every policy becomes a naming convention problem in disguise. That is backwards. The control plane starts with classification Custom security attributes are not decorative metadata. They are tenant-scoped key-value classifications you can assign to users, enterprise applications (service principals), and agent identities that are modeled as a service principal subtype, with dedicated role and permission boundaries for who can define and assign them ( overview , Graph model , agent identity service principal model ). That alone should change how architects think about them. This is not "nice to have taxonomy." This is policy input. Microsoft Entra Conditional Access for agents supports attribute-driven targeting with custom security attributes, and policy evaluation happens during token issuance and refresh, not just at policy authoring time ( Conditional Access for agents ). In other words: if your classification is sloppy, your runtime decisions are sloppy. Why agents raise the stakes You can say "an agent identity is still a service principal" and be technically correct. Microsoft Entra Agent ID is built on service principal infrastructure ( agent identities, service principals, and applications ). You can also miss the point. Agent identity introduces a blueprint-centered model where one blueprint can represent many agents, where blueprint-level policy decisions can

Meta's React library has integrated a Rust version of the React Compiler into its main repository, aimed at enhancing build speed and compatibility with the Rust-based JavaScript toolchain. This port, which memoizes components automatically, demonstrates significant performance improvements, boasting up to 50% faster compilation. The public API remains unchanged to facilitate easy upgrades. By Daniel Curtis

GitHub热门项目 | | Stars: 1,130 | 395 stars today | 语言: Rust

Workflows is a Rust library crate (not a hosted service; the crate name on crates.io/GitHub is tinyflows) that models an automation as a WorkflowGraph: a directed graph of typed nodes and edges. You build or generate that graph, it gets structurally validated, compiled into an opaque CompiledWorkflow, and lowered — once per run — onto tinyagents, a state-graph execution engine, via engine::run. model::WorkflowGraph -> validate -> compiler::compile -> engine::run (typed graph) (structural) (validated handle) (lowers onto tinyagents, drives to done) Run state is a single JSON value shaped like { "run": { "trigger": … }, "nodes": { "": { "items": [ … ] } } }. A merge reducer folds each node's output under its own id, so independent branches never collide — which is what keeps parallel fan-out deterministic. The node catalog Kind What it does trigger Entry node that starts the workflow (exactly one per graph); firing mode is host-driven agent Runs an LLM agent turn, with optional chat-model / memory / tool / output-parser sub-ports tool_call Invokes one specific integration action deterministically, no LLM involved http_request Outbound HTTP request code Sandboxed user code (JavaScript or Python) output_parser Parses/validates an upstream agent's output into a structured shape sub_workflow Runs another workflow as a nested sub-graph and returns its output condition Two-way IF, emits on true/false switch Multi-way branch keyed by an expression result merge Fan-in barrier — waits for every wired predecessor before running split_out Fan-out — emits one item per element of a list transform Pure, expression-based field mapping over the run state Data flows between nodes as arrays of items shaped { json, binary?, paired_item? } — closer to n8n's item-based model than a plain function-composition DAG — and node config can reference the run scope with =-prefixed expressions like =item.name. The part I actually want to talk about: host-agnosticism Every place this engine would n

GitHub热门项目 | A hive mind communication platform | Stars: 3,079 | 2,720 stars this week | 语言: Rust

GitHub热门项目 | RustDesk Server Program | Stars: 10,102 | 10 stars today | 语言: Rust

GitHub热门项目 | CLI proxy that reduces LLM token consumption by 60-90% on common dev commands. Single Rust binary, zero dependencies | Stars: 72,532 | 274 stars today | 语言: Rust

GitHub热门项目 | Empowering everyone to host fast and efficient Minecraft servers. | Stars: 8,141 | 96 stars today | 语言: Rust

GitHub热门项目 | Control what your AI can see. LeanCTX (Lean Context) is the context intelligence layer for AI agents — one local Rust binary that decides what they read, remembers what they learn, guards what they touch, and proves what they save. 60–90% fewer tokens as the receipt. 76 MCP tools, 30+ agents, local-first. | Stars: 3,326 | 14 stars today | 语言: Rust

Building a Decompiler Pipeline in Rust: Why Fission Separates NIR and HIR Decompiler output often looks simple from the outside. A binary goes in. Pseudocode comes out. But between those two points, a decompiler must recover several different kinds of information: instruction semantics register and memory effects control flow stack variables calling conventions data types expressions loops and conditionals readable source-like structure Trying to represent all of this in one intermediate representation quickly becomes difficult. While building Fission , a reverse-engineering and binary decompilation workspace written primarily in Rust, I decided to separate the decompiler pipeline into two main intermediate representations: NIR , a lower-level representation intended to preserve machine semantics HIR , a higher-level representation intended to express recovered, human-readable program structure This article explains why that separation exists, what each representation owns, and why it makes decompiler development easier to reason about. Correctness and readability want different things A decompiler has at least two responsibilities. First, it must preserve the behavior of the original machine code. Second, it must produce output that a human can understand. Those goals overlap, but they are not identical. Consider a simplified fragment of machine-level behavior: tmp0 = RAX tmp1 = tmp0 + 1 RAX = tmp1 flags = update_flags(tmp0, 1, tmp1) A human reader may prefer to see: rax ++ ; The concise form is easier to read, but it omits details that may still matter elsewhere in the pipeline. The flags update could affect a later conditional branch. The operation width may matter. The source and destination could alias. The operation may have originated from an instruction with additional side effects. If the decompiler converts everything into source-like syntax too early, it becomes easy to discard evidence. If it keeps everything at machine level until the final rendering st

A judge partially granted the request from a dozen state attorneys general to temporarily place the $110 billion merger of Paramount and Warner Bros. Discovery on hold, as reported by Variety and Reuters. US District Judge Araceli Martínez-Olguín said that based on the new company's market share, "the Court is persuaded that it can presume […]

GitHub热门项目 | Self-hosted AI coding assistant | Stars: 33,768 | 13 stars today | 语言: Rust

The line between editorial content and paid promotion has been eroding for years. On most major retail platforms, in countless lifestyle publications and across the breadth of social media, content that presents itself as independent assessment is frequently underwritten by the very brands being assessed. This is not a new problem, but it is a worsening one. The consequences are practical. Consumers who believe they are reading a review and acting accordingly may be making purchasing decisions on the basis of what is, in effect, an advertisement. The financial cost of that mistake is modest in most individual cases. The cumulative effect on consumer trust is not. Understanding what separates a genuine review from disguised promotional content requires more than checking for a disclosure label. It requires looking at structure, incentive, methodology and language - and recognising that some of the most effective adverts are those that most convincingly resemble reviews. What a Review Is Actually Supposed to Do A review serves one primary function: to help a reader make an informed decision about a product, service or brand. That function is incompatible with advocacy. A reviewer who is trying to help a reader decide cannot simultaneously be trying to persuade that reader to buy. This distinction sounds obvious. In practice, it collapses quickly when the person writing the review has a financial relationship with the brand, when the product was provided free of charge without conditions, or when the publication depends on advertising revenue from the sector it covers. None of those arrangements automatically invalidates the content produced. But each one creates a structural incentive that pushes in a specific direction - and that direction is rarely towards harder scrutiny. The Disclosure Problem Regulatory frameworks in the UK, including guidance from the Advertising Standards Authority and the Competition and Markets Authority, require that paid-for content be clea

GitHub热门项目 | A lightweight WebAssembly runtime that is fast, secure, and standards-compliant | Stars: 18,382 | 17 stars today | 语言: Rust

GitHub热门项目 | Incremental engine for long horizon agents 🌟 Star if you like it! | Stars: 10,904 | 52 stars today | 语言: Rust

Three weeks from now I will open a terminal, ready to ship another program to mainnet-beta, and I will pause. What was the order again? Did the IDL go up before or after the authority transfer? Was there a flag that saved me from a stalled deploy last time? This checklist exists because I just walked the entire path devnet to mainnet, deploy to IDL to frontend to error handling, and I wrote it down while the details are still fresh. It is the document I wish I had on day one of that process. Run it top to bottom before every mainnet launch. Why a checklist at all? A Solana mainnet deploy is full of irreversible steps. The wallet that signs the deploy quietly becomes the program's upgrade authority. A buffer account left mid-deploy can strand real SOL. A plain anchor build after a verifiable build can produce a different hash and break verification later. None of these are complicated. They are all easy to forget under pressure. A checklist is not a crutch; it is the habit that lets you ship calmly instead of improvising each time. Phase 1: Pre-flight on devnet Do all of this while mistakes are still free. [ ] Every test passes against the final build. Run anchor build && cargo test --package <your-program> one last time. The binary you test must be the binary you ship. [ ] End-to-end run on devnet. Call every instruction through the actual frontend, not just the test suite. The frontend is a different caller than LiteSVM and will surface different failure modes. [ ] Produce a verifiable build. Run anchor build --verifiable . This pins the build environment so the on-chain bytecode can later be matched to your source code. Once you have this artifact, do not touch it with a plain anchor build or cargo build-sbf ; those can produce a different hash and silently break verification. [ ] Measure rent before you spend it. Run: solana rent $( wc -c < target/deploy/.so ) Your deploy wallet must hold this amount plus a margin for transaction fees. There is no airdrop on the

Every few weeks I hit the same wall: I have a 300 MB screen recording, and something on the other end wants it under 8 MB . Discord, an email attachment, a bug tracker, a form that silently rejects anything bigger. The usual advice is "just use HandBrake" or "run ffmpeg with a lower CRF." But CRF doesn't take a target size — it takes a quality knob . So you export, check the size, it's 11 MB, nudge the knob, export again, now it's 5 MB and looks like a potato, nudge back… It's a binary search you run by hand, one full encode per guess. The thing is, hitting an exact size isn't a guessing game at all. It's arithmetic you can do before you encode. I ended up wrapping that arithmetic into a little Rust CLI ( DeepShrink ), but the math is the interesting part, and almost nobody writes it down. So here it is. The one insight everything rests on File size is (roughly) bitrate × duration . A bitrate is bits per second. A duration is seconds. Multiply them and the seconds cancel, leaving bits — the size of the file. That's it. That's the whole trick. Normally you treat bitrate as the input and size as whatever falls out. Flip it around: fix the size, measure the duration, and solve for the bitrate. You know the duration (ffprobe will tell you), and you know the size you want (the platform's limit). The only unknown is the bitrate — and now it's a single division away. bitrate = size_in_bits / duration_in_seconds Everything below is just this equation with the real-world messiness added back in. Building the budget, step by step Say I want a 60-second clip to fit Discord's 8 MB limit. 1. Turn the target size into bits. Sizes are in bytes, bitrate is in bits, so multiply by 8. (I'll use 1 MB = 1,000,000 bytes here to keep the mental math clean; if your platform means mebibytes, same method, different constant.) target_bits = 8_000_000 bytes × 8 = 64_000_000 bits (64 Mbit) 2. Reserve a little for container overhead. An .mp4 isn't pure video and audio — there's a container, a m

GitHub热门项目 | An unofficial desktop client for Jellyfin | Stars: 1,174 | 95 stars this week | 语言: Rust

GitHub热门项目 | FFmpeg GUI | Stars: 1,628 | 56 stars today | 语言: Rust

This is a submission for DEV's Summer Bug Smash: Clear the Lineup . Project Overview Typst is the Rust-based markup typesetting system that's been quietly eating LaTeX's lunch for the last couple of years — you write plain-text markup, Typst compiles it to PDF (or HTML) with a real incremental compiler underneath instead of a multi-pass macro soup. Part of what makes it pleasant is that it exposes its own evaluator to itself: a document can call #eval("some typst code") and get back whatever that code produces, at runtime, inside the document being compiled. It's a small feature, but it opens up a surprisingly deep rabbit hole, which is exactly where this bug was hiding. Bug Fix or Performance Improvement The problem: typst/typst#8632 reports that Typst crashes instead of erroring when #eval is used to recursively re-import the file it's running in. The repro is one line. Save this as overflow.typ : #eval("import \"overflow.typ\"") Then: $ ./target/debug/typst compile overflow.typ overflow.pdf thread 'main' (750833) has overflowed its stack fatal runtime error: stack overflow, aborting No PDF, no diagnostic, no exit code you can act on — just a native stack overflow and a SIGABRT. Typst has had cyclic-import detection since forever; a normal top-level import "overflow.typ" inside itself gets caught cleanly with an error: cyclic import message. Something about routing the import through #eval specifically was bypassing that check. The hunt I'll be upfront about how this investigation actually went: I worked through it with Claude (Anthropic's coding agent) rather than solo. The triage pass it did before I sat down with the code had already narrowed the search to one function — eval_string in crates/typst-eval/src/lib.rs — and named the suspect line. That's a big head start, but a named suspect isn't a confirmed root cause, so the actual work was reading that function next to its sibling, the file-level eval() a few lines above it, and checking the claim against the s