标签：#open

GitHub热门项目 | Reverse Engineering / Authorized Penetration Testing / Security Research Skill Router Pack AI-powered routing + On-demand toolchain bootstrapping + Self-evolving knowledge base Supports Claude Code, Kiro, Cursor, Cline, and other AI coding clients 逆向/渗透/安全技能路由包 - AI 自动路由 + 按需自举工具链 + 自动进化经验库 | 支持 Claude Code / Kiro / Cursor / Cline 等代码 AI 客户端 | Stars: 10,112 | 612 stars today | 语言: PowerShell

This is a submission for DEV's Summer Bug Smash: Clear the Lineup powered by Sentry . You are migrating a 50,000-message Slack workspace to Zulip. Somewhere around message 31,000 the import dies with KeyError: 'ts' . Annoying, but here is the uncomfortable part: that is the lucky outcome. The unlucky one is "ts": "NaN" , where nothing dies, nothing warns, and your company's message history quietly comes out in the wrong order. TL;DR: Zulip's Slack importer used float(message["ts"]) unguarded, both as a sort key and as date_sent . One message with a missing or malformed ts aborted the entire import; a non-finite value like "NaN" did not even raise, it silently broke the sort. My fix ( zulip/zulip#39813 ) skips such messages with a warning and requires ts to parse to a finite float via math.isfinite . The regression test fails with KeyError: 'ts' on the old code. Project Overview Zulip is an open-source team chat server (Django/Python, ~25k stars) with an unusually strict engineering culture: near-total backend test coverage, strict mypy, and a commit discipline of "each commit is a minimal coherent idea". The code I touched lives in zerver/data_import/ : the subsystem that converts exports from Slack, Microsoft Teams, and Mattermost into Zulip's format. This subsystem has one property that should shape every line in it: the input is another tool's output. Import is a long batch process over data of arbitrary quality, and the admin running the migration has no way to "fix" what Slack's export tool produced. A pipeline that dies on record 31,207 of 50,000 is strictly worse than one that skips record 31,207 with a warning. Bug Fix or Performance Improvement get_messages_iterator() in zerver/data_import/slack.py streams every message of the export, sorting each day's messages by timestamp: yield from sorted ( messages_for_one_day , key = get_timestamp_from_message ) where the sort key was simply: def get_timestamp_from_message ( message : ZerverFieldsT ) -> float : retur

phpBB is an open-source forum application for building discussion communities — user registration, moderation, permissions, and multiple boards in one interface. This guide deploys phpBB on Ubuntu 22.04 with an external MySQL database, an Apache virtual host, and Let's Encrypt TLS. Prerequisites: an Ubuntu 22.04 server with the LAMP stack installed, non-root sudo user, an external MySQL database, a subdomain A record (e.g. phpbb.example.com ). Create the Database $ mysql -h your-db-host -P 3306 -u dbadmin -p mysql > CREATE DATABASE phpbbdb ; mysql > USE phpbbdb ; mysql > CREATE USER 'phpbbuser' @ 'localhost' IDENTIFIED BY 'securepassword' ; mysql > GRANT ALL ON phpbbdb . * to 'phpbbuser' @ 'localhost' ; mysql > FLUSH PRIVILEGES ; mysql > EXIT ; Install phpBB 1. Install PHP modules: $ sudo apt install php-mysql php-xml php-mbstring -y 2. Download and extract — check the releases page for the current version: $ wget -O phpbb.zip https://download.phpbb.com/pub/release/3.3/3.3.11/phpBB-3.3.11.zip $ unzip phpbb.zip $ sudo mv phpBB3 /var/www/html/phpbb 3. Set ownership and permissions: $ sudo chown -R www-data:www-data /var/www/html/phpbb $ sudo find /var/www/html/phpbb -type d -exec chmod 755 {} \; $ sudo find /var/www/html/phpbb -type f -exec chmod 644 {} \; Configure Apache $ sudo nano /etc/apache2/sites-available/phpbb.conf < VirtualHost *:80 > ServerAdmin admin@example.com DocumentRoot /var/www/html/phpbb ServerName phpbb.example.com < Directory /var/www/html/phpbb > Options FollowSymlinks AllowOverride All Require all granted </ Directory > ErrorLog ${APACHE_LOG_DIR}/phpbb_error.log CustomLog ${APACHE_LOG_DIR}/phpbb_access.log combined </ VirtualHost > $ sudo a2ensite phpbb $ sudo a2enmod rewrite $ sudo systemctl restart apache2 Secure phpBB 1. Firewall: $ sudo ufw status $ sudo ufw allow 22 && sudo ufw enable $ sudo ufw allow 80/tcp $ sudo ufw allow 443/tcp $ sudo ufw reload 2. TLS via Let's Encrypt: $ sudo apt install snapd -y $ sudo snap install --classic certbot

TL;DR Hello everyone! It's been a while since I've posted a list of interesting projects,...

The biggest reason NVIDIA began providing GPL-licensed kernel modules is that its driver architecture evolved to the point where Linux integration, distribution, and maintenance could be greatly simplified while keeping the GPU's critical intellectual property in firmware and user-space components . To be precise, NVIDIA did not open-source its entire driver stack. The components that became open are primarily the following Linux kernel modules: nvidia.ko nvidia-drm.ko nvidia-uvm.ko nvidia-modeset.ko User-space components such as CUDA, OpenGL, Vulkan, and the GSP firmware remain proprietary. ( NVIDIA Developer ) 1. To make integration with Linux distributions easier Previously, NVIDIA's proprietary kernel modules had to be built, signed, and distributed separately from the Linux kernel. A DKMS-based workflow, which rebuilds modules after every kernel update, commonly led to problems such as: Kernel modules failing to build after kernel updates Unsigned modules being blocked by Secure Boot Linux distributions having difficulty maintaining the driver as an official package Increased complexity when integrating with custom kernels or cloud environments By publishing the source code, distributions such as Ubuntu, Red Hat, and SUSE can integrate NVIDIA's kernel modules into their own packaging, signing, and update infrastructure much more easily. NVIDIA itself cites tighter OS integration and simpler signing and distribution as key motivations. ( NVIDIA Developer ) 2. To improve debugging and security review Kernel modules interact with deep parts of the operating system, including memory management, interrupts, inter-process synchronization, PCI Express, and display subsystems. With the source code available, Linux distribution developers and enterprise users can: Trace where execution stops inside the kernel Analyze interactions between GPU events and workloads Fix incompatibilities with custom kernels Review security-related issues Submit patches to NVIDIA NVIDIA stat

In a review triggered by OpenAI’s Hugging Face incident, Anthropic discovered three of its AI models had breached real organizations during third-party evaluations.

After OpenAI's models broke into Hugging Face, Anthropic checked its own history and found three similar incidents

When I first started contributing to open source, GitHub Actions felt like a black box. Seeing a failed workflow on my pull requests was intimidating because I didn't really understand what was happening behind the scenes. Well, this month, I decided to change that. What I Worked On I implemented GitHub Actions across three of my project repos. My main focus was: Adding Markdownlint for Markdown quality Adding Pylint for Python linting. Updating documentation while integrating CI. What I Learned The biggest lesson wasn't technical — it was changing my mindset. A failed workflow isn't something to fear. It's simple feedback. Whether it's markdownlint warning or a pylint error, each failure helps improve the project. Looking Ahead Most of this month was spent improving my own projects, so I didn't contribute much to external repositories. Next month, I want to build on this foundation by contributing to more open source projects and applying what I've learned. Sometimes, learning the tools behind open source is just as valuable as making another pull request. I'm curious What part of GitHub Actions or CI/CD was the most challenging when you first started? Or If you are just getting started, what's the biggest thing that's still a mystery to you? I'd love to hear your experience and tips in the comments. Transparency Note: I used AI as an editor—not as the author. For this article, it helped refine the structure and improve the English grammar. The technical content, experiments, opinions, and conclusions are my own and were reviewed by me before publishing.

Are you a "data hoarder" when it comes to your health? Between Apple Health exports, Oura Ring logs, and Garmin CSVs, I found myself sitting on nearly 10 million rows of biometric data. Trying to analyze a multi-year trend of Heart Rate Variability (HRV) or Resting Heart Rate (RHR) in Excel is a one-way ticket to "Application Not Responding" hell. 📉 In this tutorial, we are diving into the world of Quantified Self data engineering. We will leverage DuckDB —the Swiss Army knife of OLAP—and Apache Superset to build a lightning-fast, local-first biometric dashboard. We'll explore how to turn messy JSON/CSV exports into high-performance insights using dbt for modeling and DuckDB for compute. If you've been looking for a way to master Data Engineering for personal use, this is the ultimate "learn in public" project! 🚀 The Architecture: From Raw Export to Real Insights Before we write a single line of SQL, let’s look at how the data flows. We want a system that is modular, fast, and stays entirely on our local machine (privacy first, right? 🥑). graph TD A[Raw Data: Apple Health / Oura / Garmin] -->|CSV/JSON| B(DuckDB Storage) B --> C{dbt Transformation} C -->|Cleaned Views| D[DuckDB Analytical Layer] D --> E[Apache Superset / Grafana] E -->|Visualization| F[Personal Biometric Dashboard] style B fill:#fff,stroke:#333,stroke-width:2px style D fill:#fbbf24,stroke:#333,stroke-width:2px Prerequisites 🛠️ To follow along, ensure you have the following in your tech stack: DuckDB : Our ultra-fast in-process analytical database. dbt-duckdb : For data modeling and transformations. Apache Superset : For the "wow factor" visualizations. Python 3.10+ : To glue it all together. Step 1: Ingesting the "Mess" with DuckDB DuckDB is incredible because it can query CSV and JSON files directly without an ingestion step. Let’s say you have a massive heart_rate.csv from an Apple Health export. Instead of waiting for a traditional DB to "load" the data, we can create a view instantly: -- Create a

OpenAI has formally outlined a national science initiative designed to connect frontier AI models with government research infrastructure, National Laboratories, universities, and working scientists. The program is not a single model launch. Instead, it combines funded access, early product access, scientific campaigns, and an emphasis on fitting advanced AI into real research workflows. The initiative gives concrete form to OpenAI’s stated goal of helping scientists use increasingly capable models to accelerate discovery. In its official announcement on advancing the next era of national science , published July 22, 2026, the company describes a long-term strategy built around the U.S. Department of Energy’s Genesis Mission and collaborations with National Laboratories. The core proposition is that AI can contribute to hypothesis testing, simulations, and experimental work when it is deployed alongside scientific infrastructure and human expertise. That framing matters. OpenAI is positioning frontier models as tools that researchers direct and evaluate, rather than as a replacement for the institutions and specialists responsible for scientific work. What OpenAI is providing to scientific researchers OpenAI’s commitments span several types of access, from coding support for a broad research community to model capabilities and API funding for large campaigns. The announced provisions include: $4 million in Codex access for approximately 2,000 Genesis researchers at national labs and universities. $3 million in API support for two large scientific campaigns. Up to $10 million in API usage for participating researchers who reach a $2.5 million spending threshold. Access to GPT-Rosalind’s bioscience capabilities for national-lab researchers. Early access to selected models and features for trusted national-lab leaders preparing workflows and evaluations. Expanded access to advanced cyber capabilities for national-lab cybersecurity researchers. These commitments indicat

TL;DR I designed a proposed AWS Transform Custom community skill that prepares Glue 2.0, 3.0, and 4.0 repositories for Glue 5.0. It separates safe mechanical transformations from changes that require human evidence, generates a migration report, and preserves already-compatible files unchanged. Because I didn't have live atx access, the benchmarks in this post are explicitly labeled manually simulated, not agent-executed. The proposal is open as issue #75 — not yet merged, not yet a pull request. The missing data-engineering transformation AWS Transform Custom can apply agent-driven code transformations across a single repository — or thousands of them at once, via AWS Batch and Fargate. As of July 30, 2026, its public sample repository, aws-samples/aws-transform-custom-samples , contained three community-contributed transformations: an EKS version-upgrade-readiness skill, a JBoss-to-Spring-Boot migration, and a Kubernetes readiness migration. None of them touched data engineering. Given that most of my day-to-day work sits across AWS data engineering, Databricks, and Delta Lake, that gap was the obvious thing to fill. What an AWS Transform Custom "skill" looks like Before writing anything, I studied the deepest existing example, jboss-to-springboot , since the pattern it establishes is effectively an unwritten spec for the other two skills as well: README.md — the problem, what the skill does, and how to invoke it via the atx CLI. This is also where the repo draws a clear line: these are readiness transformations. They modify repository artifacts — code and infrastructure-as-code — but they don't deploy jobs, call AWS APIs to change running resources, or claim data-level equivalence. That distinction matters throughout everything below. SKILL.md — the agent-facing definition: YAML frontmatter with trigger keywords, an Objective, explicit Non-Goals , Constraints, worked before/after examples, a "signal in source code → reference file" routing table, and a numbered V

I went looking for a small improvement to an open-source tool. I found a number that pointed the wrong way, and then I found out why it had to. Live demo — paste your own file and watch it happen: https://pin-on-expand.onrender.com The setup Paritok is a 4B model that compresses AI coding-agent context. It sits between your agent and Anthropic or OpenAI, squeezes the file reads and tool output, and tells you what it saved. It's genuinely good work. Trained on 45,000 real agent trajectories, so it knows a function signature matters more than a debug line. Apache 2.0. Runs on a consumer GPU. Their benchmark numbers hold up. I wanted to build a policy improvement on top of it. To prove my improvement helped, I first had to measure what stock Paritok cost. That measurement is the whole story. Two numbers that disagree One coding-agent session. One 20,005-token file in context. Paritok's own /stats endpoint: 64.0% of input tokens saved. What the provider was actually POSTed: 69.2% more than sending the file with no compression at all. Same session. Same file. Both numbers correct. Where the missing tokens went Paritok is non-destructive by design, which is the good part. Compressed content gets tagged [REF:id] , and when the model needs the exact original it calls an injected expand_context tool to pull it back. Lossy on the wire, recoverable when it counts. The proxy answers that call itself . It appends the full original to a proxy-local thread and POSTs that thread upstream a second time. And stats is computed once, in process_request — before that loop runs. post 0: 6,919 tokens compressed request ← counted by /stats post 1: 26,924 tokens carries the full original ← never counted ───────── billed: 33,843 Then it compounds. The proxy conceals the virtual exchange from the client, so your agent never sees it. Next turn the agent re-sends the original file, Paritok re-compresses it to the same reference, and the model expands it again. Every turn. Forever. In fairness:

OpenAI has published a post-mortem examining an unusual pattern in its model testing: recurring references to “goblins” and “gremlins” in model outputs. The company’s official post, “Where the goblins came from” , published on April 29, 2026, frames the behavior as an emergent effect of reinforcement learning and human-feedback dynamics, not as a new product feature. Its practical message is more consequential than the metaphor suggests: unexpected model personas can affect the consistency, safety, and reliability that developers expect from AI systems. The published analysis provides the substantive context behind recent attention to a purported “goblin-level” post. Rather than indicating a model launch, OpenAI’s account suggests a narrower but important lesson about how optimization signals can inadvertently reinforce patterns in language models. For organizations using LLMs in production, the relevant question is not whether goblin-like language is amusing. It is whether teams can detect and address unexpected behaviors before those behaviors influence customer-facing, operational, or high-stakes workflows. What OpenAI documented OpenAI said the “goblin” and “gremlin” metaphors appeared during GPT-5.x testing and RLHF training. The company reported a notable increase in goblin-like language during GPT-5.5 testing when Codex was being evaluated. According to the post, the pattern emerged from reward-signal dynamics : persona-like responses were inadvertently reinforced through reinforcement learning and human feedback. That distinction matters. OpenAI does not characterize goblin behavior as a fixed capability or intentional model identity. It describes it as a byproduct that can arise at scale when a training and feedback process favors certain output patterns. The episode is therefore best understood as an alignment and evaluation lesson, rather than evidence of a separate “goblin” model, feature, or policy release. OpenAI also described a mitigation introduced

There is a number going around that roughly half of all remote MCP servers are dead. I had repeated it myself, in the README of a tool I published. I could not find where it came from, so I measured it. The answer is that about one in ten is actually broken. The "half" figure appears to come from counting servers that require an API key as if they were down. Here is the method and the full breakdown. What I measured On 29 July 2026 I pulled every entry from the official MCP registry — 1,200 servers. Of those, 297 had status: active and advertised a remote endpoint URL (the rest are stdio/local packages with nothing to probe over the network). Each got one anonymous JSON-RPC initialize over streamable HTTP, with a 10 second timeout: { "jsonrpc" : "2.0" , "id" : 1 , "method" : "initialize" , "params" : { "protocolVersion" : "2025-06-18" , "capabilities" : {}, "clientInfo" : { "name" : "mcp-uptime" , "version" : "0.1.0" } } } Then I classified the response: a valid result containing protocolVersion or serverInfo is up, 401/403 is auth-gated, and everything else got bucketed by its actual failure. Results (n = 297) Result Count Share Completed an MCP handshake 133 44.8% Auth-gated (401/403) 134 45.1% DNS failure 8 2.7% Server error (5xx) 6 2.0% Not found (404/410) 5 1.7% Redirect (307/308) 4 1.3% Timeout 2 0.7% Non-MCP response 2 0.7% Other (400, 405, connection) 3 1.0% Reachable: 267 (89.9%). Genuinely broken: 30 (10.1%). Where "half are dead" comes from Look at the first two rows. 55.2% of these endpoints will not complete an anonymous handshake — and that is suspiciously close to the number people quote. But 134 of those 164 are returning a clean 401 or 403. They are running. They are answering. They want an API key, which is a completely reasonable thing for a hosted service to want. Counting those as dead inflates the failure rate by roughly five times. This matters beyond pedantry: if you believe half the ecosystem is rubble, you build defensively against the wron

I am not by any means an expert at finance but I think I do now have some advice for people who are: Do not name your hedge fund anything that will be hilarious if it blows up. Don't use a name like "Long-Term Capital Management," or "Amaranth Advisors" (named for the floral symbol for […]

GitHub热门项目 | Development at the speed of light | Stars: 24,917 | 60 stars today | 语言: Rust

GitHub热门项目 | free online AI resume editor，the only official website is https://magicv.art | Stars: 9,264 | 107 stars today | 语言: TypeScript

GitHub热门项目 | Fast, expressive styling for React. Server components, client components, streaming SSR, React Native—one API. | Stars: 41,126 | 1 star today | 语言: TypeScript

GitHub热门项目 | Blazing fast, instant realtime GraphQL APIs on all your data with fine grained access control, also trigger webhooks on database events. | Stars: 32,058 | 2 stars today | 语言: TypeScript

GitHub热门项目 | The Monorepo Platform that amplifies both developers and AI agents. Nx optimizes your builds, scales your CI, and fixes failed PRs automatically. Ship in half the time. | Stars: 29,157 | 5 stars today | 语言: TypeScript