标签：#open

How to turn struct-tag validation failures into a standard "application/problem+json" response — the RFC 9457 format — with one method call, no hand-rolled error envelope. Most Go APIs invent their own validation error shape. One team returns {"errors": [...]} , another {"field_errors": {...}} , a third just a flat {"error": "message"} and hopes the client parses it. Every one of those is a private contract the client has to learn from your docs, because there's no shared shape for "here's what's wrong with your request." RFC 9457 — Problem Details for HTTP APIs — is the IETF standard that fixes this: a application/problem+json body with type , title , status , and room for problem-specific extensions. Checker now builds one of these directly from a failed struct validation, via CheckErrors.ProblemDetails() . The shape RFC 9457 defines four base members — type , title , status , detail , instance — and lets a specific problem type add its own. For validation errors, RFC 9457 §3.1 sketches exactly this extension: an invalid-params array listing which fields failed and why. That's what Checker produces. From a failed struct to a problem+json body Take a struct with a missing required field: type Person struct { Name string `checkers:"required"` } person := & Person {} errs , ok := checker . CheckStruct ( person ) if ! ok { data , _ := json . Marshal ( errs . ProblemDetails ()) fmt . Println ( string ( data )) } { "type" : "about:blank" , "title" : "Your request parameters failed validation." , "status" : 400 , "invalid-params" : [ { "name" : "Name" , "reason" : "Required value is missing." , "code" : "REQUIRED" } ] } One method call — errs.ProblemDetails() — turns the same CheckErrors you'd otherwise call .JSON() on into a *ProblemDetails value, ready to marshal. type defaults to "about:blank" (RFC 9457's own default for "no more specific problem type registered"), status defaults to 400 , and each invalid-params entry carries the field name , a localized human-readab

🇪🇸 Leer este post en Español I spent months watching my agent re-solve the exact same problems, over and over, because I never sat down and wrote them up once so anyone else could reuse them. That's the kind of technical debt nobody ever puts on a roadmap. So I published alpha-skills : eight installable Agent Skills and my first MCP server on npm . Where the published skills live The installable catalog lives in skills/ , split into three categories: external/ for third-party APIs, local/ for homelab and workflows, and general/ for cross-project utilities. All three are public: one skill in external/ , one in local/ , and six in general/ . local/ describes the use case. skills/ ├── external/ │ └── nextdns-api/SKILL.md ├── local/ │ └── progressive-search/SKILL.md └── general/ ├── agent-context-generator/SKILL.md ├── nestjs-iam-patterns/SKILL.md ├── nestjs-advanced-patterns/SKILL.md ├── nestjs-graphql/SKILL.md ├── tuning-claude-code/SKILL.md └── obsidian-second-brain/SKILL.md <DIAGRAM 02: 02-public-skills-structure-en.png> The eight skills Three categories: external/ for third-party services, local/ for homelab infrastructure and personal workflows, general/ for cross-cutting utilities that don't depend on any one service. Skill Category Use it for nextdns-api external NextDNS API progressive-search local Code and documentation search agent-context-generator general Project context nestjs-iam-patterns general Authentication and permissions nestjs-advanced-patterns general NestJS internals and architecture nestjs-graphql general Code-first and schema-first GraphQL tuning-claude-code general Claude Code configuration obsidian-second-brain general Note organization and review Each command installs one skill. Run the command for the one you need. 1. nextdns-api A full reference for the NextDNS REST API: profiles, security/privacy/parental-control settings, denylist and allowlist management, analytics, query logs. This is the one the MCP server below is built directly agai

🇺🇸 Read this post in English Llevo meses haciendo que mi agente resuelva los mismos problemas una y otra vez porque nunca me tomé el tiempo de escribirlos una sola vez, bien, y dejar que otros los reusaran. Ese es exactamente el tipo de deuda técnica que nadie pone en un roadmap. Así que publiqué alpha-skills : ocho Agent Skills instalables y mi primer servidor MCP en npm . Dónde están las skills publicadas El catálogo instalable vive en skills/ , separado en tres categorías: external/ para APIs de terceros, local/ para homelab y flujos de trabajo, y general/ para utilidades transversales. Las tres son públicas: una skill en external/ , una en local/ y seis en general/ . local/ describe su ámbito de uso. skills/ ├── external/ │ └── nextdns-api/SKILL.md ├── local/ │ └── progressive-search/SKILL.md └── general/ ├── agent-context-generator/SKILL.md ├── nestjs-iam-patterns/SKILL.md ├── nestjs-advanced-patterns/SKILL.md ├── nestjs-graphql/SKILL.md ├── tuning-claude-code/SKILL.md └── obsidian-second-brain/SKILL.md Las ocho skills Tres categorías: external/ para servicios de terceros, local/ para infraestructura de homelab y workflows propios, general/ para utilidades transversales que no dependen de ningún servicio en particular. Skill Categoría Para qué sirve nextdns-api external API de NextDNS progressive-search local Búsqueda de código y documentación agent-context-generator general Contexto de proyecto nestjs-iam-patterns general Autenticación y permisos nestjs-advanced-patterns general Internals y arquitectura de NestJS nestjs-graphql general GraphQL code-first y schema-first tuning-claude-code general Configuración de Claude Code obsidian-second-brain general Organización y revisión de notas Cada comando instala una skill. Ejecuta el de la que necesites. 1. nextdns-api Referencia completa de la API REST de NextDNS: perfiles, seguridad/privacidad/control parental, listas de bloqueo y permitidas, analíticas, logs de consultas. Es la que respalda al MCP server que desc

A six-week journey through source builds, CI pipelines, and one package pacman never mentioned. TL;DR: pacman -S whisper-cpp ggml-vulkan . That's it. That's the whole answer. Here's why it took me several weeks to find it. The setup I use whisper.cpp for local speech-to-text and as a part of my projects. I have a GPU utilization monitor permanently visible in my GNOME panel via the Vitals extension — so when whisper.cpp started detecting my GPU but running everything on CPU anyway, I noticed immediately. Went to fix it. What followed was several weeks of googling, building from source, writing a custom PKGBUILD, setting up CI, publishing an AUR-style repo — and eventually discovering that the actual fix is a single extra package that pacman never once mentioned to me. The investigation First thing I checked: is the official extra/whisper-cpp package compiled with Vulkan support? All search results said no — -DGGML_VULKAN is explicitly OFF, GPU code is absent from the binary. The app sees your GPU through vulkan-icd-loader but has no code to actually use it. That matched exactly what I was seeing. So the binary itself was the problem. At the time, a separate whisper-cpp-vulkan package had existed in the repos but kept appearing and disappearing — and right then it was gone from both extra and AUR. AUR pushes were also temporarily restricted due to a supply-chain incident. So the "just install the vulkan variant" path was closed, though it used to be available sometime. The obvious move: build from source with -DGGML_VULKAN=ON , package it up, done. I published whisper-cpp-vulkan-arch with a PKGBUILD and prebuilt binaries, wired up CI to track upstream releases automatically and rebuild correspondingly, and wrote a Reddit post explaining the situation. The post was dated August 13, 2026. The twist A few weeks later, someone commented on the post. They suggested installing ggml and vulkan-icd-loader . I started writing a detailed reply explaining why this was wrong: gg

Hi DEV! I was fed up picking up my phone to type a six digit code into the machine I was already sitting at. The desktop authenticators I tried either wanted an account, synced my secrets to their cloud, or both, which rather defeats the point of the thing being under my control. AuthGeek is a TOTP and HOTP authenticator that keeps everything local: Secrets in a local vault, encrypted with Argon2id Add accounts by scanning a QR code off the screen, or paste the secret Encrypted backup and restore, so you are not locked into one machine No account, no sync, no telemetry Why I built it The design brief was one sentence: nothing about my second factor should require somebody else's server. I want to be straight about the trade though. Keeping codes on the same machine you log in from is weaker than a separate phone. If your PC is compromised, both factors are on it. For a lot of threat models that is fine, for some it is not. If it is not, keep using your phone, and I would rather say that than pretend otherwise. Tech stack .NET 8, net8.0 Avalonia for the UI Konscious.Security.Cryptography.Argon2 for the vault key derivation ZXing.Net for QR decoding Argon2id over PBKDF2 because the whole value proposition here is the vault, and memory hard is the right default in 2026. Honest caveat The installer is not code signed yet, so SmartScreen may warn on first run. For a security tool I appreciate that is a worse look than usual. It is on the list. Links Site: https://techygeekshome.info/authgeek/ Source: https://github.com/techygeekshome/AuthGeek Video: https://youtu.be/HtrjpdrUe-g If you spot something wrong in the crypto, please open an issue rather than being polite about it.

Two more news organizations are suing OpenAI and Microsoft over the supposed use of their journalism to train AI.

Building StudySift Without Third-Party Dependencies Introduction What if a useful study tool could be built without installing a single third-party package? For the Zero Dependency Hackathon, I built StudySift , a command-line tool that converts lecture transcripts into structured, revision-friendly study notes. The idea is simple: give StudySift a transcript and automatically extract useful information such as keywords, definitions, examples, and important points. The interesting part was the constraint. The project had to run using Python's standard library only , with no third-party runtime dependencies. The Problem Lecture transcripts can be long and difficult to revise. Important definitions, examples, keywords, and important statements can be spread throughout the transcript. Students often have to manually read the entire transcript, identify important sentences, and create their own notes. I wanted to reduce this manual work. StudySift takes a text transcript as input and processes it into organized notes. The basic workflow is: Lecture Transcript ↓ StudySift ↓ ┌─────────────────┐ │ Definitions │ │ Important Points│ │ Examples │ │ Keywords │ └─────────────────┘ **What I Built** StudySift is a Python command-line tool. The user provides a transcript file: python src/main.py examples/lecture.txt StudySift processes the transcript through several stages: 1. Read the input file 2. Split the text into sentences 3. Extract words 4. Remove common words 5. Count word frequencies 6. Detect definitions 7. Detect examples 8. Identify important sentences 9. Score sentences 10. Sort sentences by importance 11. Generate structured notes The goal is not to pretend that a collection of simple rules is a complete natural-language understanding system. Instead, StudySift is a lightweight and transparent approach to turning transcripts into useful revision material. **The Zero-Dependency Challenge** The biggest constraint was that StudySift could not depend on third-party runt

OpenAI has officially introduced GPT-6 Astra , a new model it describes as its most capable and aligned to date. The launch centers on advanced computer use, software engineering, browsing, cybersecurity tasks and professional knowledge work. Astra is initially rolling out to a limited group of organizations, followed by availability for paid ChatGPT users and developers across the OpenAI API, Microsoft Azure and AWS Bedrock . The formal release supersedes earlier speculation around a potentially "special" model rollout. OpenAI’s official GPT-6 Astra announcement establishes the substantive news: a staged, multi-platform deployment with defined API pricing, large context capacity and capabilities aimed at completing more complex digital tasks. For businesses, the important question is less whether Astra is unusual and more whether its computer-use functions can reliably reduce manual work in existing processes. OpenAI positions the model for tasks such as filling forms, updating CRM records, managing calendars, researching the web, installing and troubleshooting software, and producing documents, spreadsheets and presentations that follow a user’s templates and style. What GPT-6 Astra adds Astra is designed to work across tasks that ordinarily require moving between software interfaces, web pages and business documents. That is a significant expansion from using a language model solely to draft text or answer questions. In the right workflow, a model that can navigate authorized tools and complete multi-step tasks could help teams reduce repetitive administrative work. OpenAI also highlights Astra’s performance in code generation and professional knowledge work. Its stated ability to install, test and troubleshoot software points toward more autonomous technical workflows, while its document-generation capabilities could be relevant for recurring reports, proposals, analysis packs and operational templates. The model’s published limits and access paths are also nota

OpenAI acknowledged its role in a recently reported incident where AI agents took over a German wiki forum.

The problem that wouldn't leave me alone A few months ago I was auditing a client's site and had five tabs open: Hotjar for heatmaps, Ahrefs for SEO, a spreadsheet for tracking fixes, ChatGPT for "why is this page not converting," and a half-finished Notion doc trying to tie it all together. Somewhere around tab four, it hit me: none of these tools talk to each other, and none of them tell you what to actually do . Hotjar and FullStory show you that people bounce off a page. They don't tell you why , and they definitely don't hand you a fix. Ahrefs and SEMrush dump a spreadsheet of 300+ "issues" with no prioritization. Which one do you fix first? Good luck. And increasingly, a growing slice of search traffic isn't coming from the 10 blue links at all — it's coming from ChatGPT Search, Perplexity, and Google AI Overviews summarizing an answer and (maybe) citing a source. Almost nothing measures whether your page is even citable in that world. So I did what any reasonable/unreasonable person does with a Saturday and too much caffeine: I built the tool I wished existed. It's called Plyxo , and it's free, open-source, and self-hosted. Repo: https://github.com/pixelfogg/Plyxo-CRO-SEO-AIO-AEO-GEO What Plyxo actually does Plyxo isn't a single-purpose tool — it's three audits that usually live in three different paid products, combined into one: 1. Visual CRO auditing Plyxo takes a screenshot of your live page and overlays bounding boxes around conversion friction points — a CTA buried below the fold, a form with too many fields, contrast that fails accessibility and readability at the same time. For each one, it estimates the dollar impact of the friction and generates a ready-to-paste React/Tailwind fix , so you're not just told "this is bad," you get the actual patch. 2. Technical + semantic SEO audit Under the hood, Plyxo checks the boring-but-critical stuff: schema.org markup validity, Core Web Vitals, broken/dead links (crawled with SSRF protections so it's safe to po

GitHub热门项目 | The open-source observability database. One columnar engine for metrics, logs, and traces, on object storage. | Stars: 6,625 | 11 stars today | 语言: Rust

GitHub热门项目 | Personal AI Toolbox | Stars: 1,377 | 19 stars today | 语言: Rust

GitHub热门项目 | | Stars: 4,187 | 6 stars today | 语言: TypeScript

GitHub热门项目 | A list of tools that are open-source, in-browser, and require no-signups! | Stars: 2,671 | 50 stars today | 语言: TypeScript

GitHub热门项目 | 🤗 The largest hub of ready-to-use datasets for AI models with fast, easy-to-use and efficient data manipulation tools | Stars: 21,899 | 5 stars today | 语言: Python

GitHub热门项目 | High-Quality Voice Cloning TTS for 600+ Languages | Stars: 9,811 | 83 stars today | 语言: Python

GitHub热门项目 | | Stars: 2,487 | 1,141 stars today | 语言: TypeScript

The hook A few months back I shipped mcpscan , a static analyzer that scans MCP (Model Context Protocol) servers for the vulnerability classes that keep showing up in this ecosystem: command injection, SSRF, and path traversal. Rule MCP007 was supposed to be the path traversal catch-all. This week I sat down with my own research notes and ran a simple gut-check: would MCP007 have caught the four real path-traversal CVEs disclosed against MCP servers this year? It would have missed every single one. Including the worst one. Real-world context Here is what actually shipped as CVEs in 2026, all in MCP servers, all sharing the same root cause: CVE Server Sink Impact CVE-2026-40576 excel-mcp-server file write Path traversal CVE-2026-84201 appium-mcp-server write_file Path traversal CVE-2026-44336 PraisonAI MCP Python .pth write RCE via site-packages injection CVE-2026-27825 mcp-atlassian confluence_download_attachment CVSS 9.1 , unauthenticated RCE (chained with SSRF CVE-2026-27826 to overwrite ~/.ssh/authorized_keys or drop a cron entry) Four different maintainers, four different tools, the exact same blind spot: a file path built from caller-controlled input, written without a directory-boundary check. The bug in mcp-atlassian is the nastiest: no auth needed, no restart needed, straight to a shell. So I opened my own rule file and read the docstring out loud: MCP007: path traversal in file-reading tools. There it is. My rule was scoped to reads from day one, and every real-world exploit this year happened on the write side. A scanner whose entire job is catching this bug class was structurally blind to the half of it that is actually landing CVSS 9+ scores. Architecture: how MCP007 actually works The rules in mcpscan are simple on purpose: line-scan regex matching without an AST, so they run fast across any language mcpscan supports. Each rule has three regex layers: ┌─────────────────────────────────────────────┐ │ 1. SINK: does this line call a │ │ file-open/read fun

OpenAI says it needs to overhaul how and when it reports instances of AI models attacking real-world targets. The acknowledgement comes as the company manages the fallout from reports that a swarm of its out-of-control agents hijacked a German wiki site. Regarding the "'wiki incident,' where our agents wrote to several internet sites," OpenAI wrote […]

Who hasn't built a full-stack app on AWS before, we all know the drill. You need an API (usually Lambda with API Gateway), a frontend, some authentication (Cognito) wired up, and IaC (CDK) to help deploy the app. On their own, none of that is hard, but wiring it up all together, especially in a team where every developer has their own style, always takes an amount of time before you even get to write a single line for the business logic. Nx Plugin for AWS ( @aws/nx-plugin ), an AWS Labs open source project, tackles that problem with code generators built on top of Nx . Instead of once again writing out boilerplate for every new service or website, you can just run a generator (CLI), answer a few questions, and get production-ready application code plus the CDK or Terraform to deploy it. This article introduces what the plugin does, the core concepts, and how to scaffold a complete full-stack app. What sets Nx Plugin apart from just another scaffolding tool? A note on versioning: at time of this article the plugin was pre-1.0, currently working through a 1.0.0-rc.x release candidate series with regular updates. Commands and generator names below were accurate at time of writing, check npm view @aws/nx-plugin version before you start, given the pace, it's likely to have moved on since this article published. A quick primer on Nx For the uninitiated Nx is a toolkit specifically for monorepos. Two things define Nx: A dependency graph across projects. Nx knows how the individual parts of your projects relate to each other (which website depends on which API, which library is shared where), and it uses that graph to only build, test, or lint the things actually affected by a change, with results cached so recurring CI/CD runs should be fast. Generators. Nx has a plugin system where a package can register generators, scripts that scaffold or modify code in your workspace, invoked via the nx g (or nx generate ) command. This is the bit @aws/nx-plugin builds on. Nx is not AW