标签：#p

GitHub热门项目 | 754 structured cybersecurity skills for AI agents · Mapped to 5 frameworks: MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, D3FEND & NIST AI RMF · agentskills.io standard · Works with Claude Code, GitHub Copilot, Codex CLI, Cursor, Gemini CLI & 20+ platforms · 26 security domains · Apache 2.0 | Stars: 10,997 | 886 stars today | 语言: Python

GitHub热门项目 | The open alternative to Salesforce, designed for AI. | Stars: 47,351 | 519 stars today | 语言: TypeScript

I used to live in VS Code with GitLens pinned — the branch graph, heat-mapped blame, the lens annotations. That was my git workflow. Then 2026 happened. With Cursor, Claude Code, and Codex doing the actual editing, the editor itself became optional. The only thing dragging me back was GitLens. That felt wasteful — booting an entire IDE just to peek at commit history. The agent runs the git commands now; I only need to sanity-check the result, occasionally, when something looks off. So I built gitwink — the smallest possible tool for that loop. A tray icon that expands into a glance, hands the commit off as AI context, and gets out of the way. Read-only by design. It cannot commit, push, merge, or modify anything. If I need git surgery, I tell the agent. The 0.5-second confirm loop agent commits → tray click → inline expand → "Copy as AI context" → paste into Claude/Codex/Cursor → "did the agent do this right?" No window switching. No IDE boot. The whole loop fits inside a glance. What's in it Tray-resident (Windows tray / macOS menu bar) — click to toggle, global hotkey Ctrl+Shift+G to summon from anywhere. Right-click the tray icon for Reset position / Open settings file / Quit. First-run discovery that walks your usual code dirs ( source , Documents , Projects , Code , Dev , repos , Desktop , every non-system drive on Windows; ~/Projects , ~/Code , ~/Developer on macOS) and caches the result in SQLite. No "add repo" friction. Unified commit timeline across all repos, with chips above for filtering by Repo (search + pinning), Time range (24h / 3d / 7d / 30d / All), and Authors (multi-select with counts). Per-row markers — ● commit · ◆ merge · ★ tagged — and branch label badges when a commit isn't on the currently checked-out branch. Single-repo DAG view — pick a repo and the panel switches to a per-branch graph with a custom SVG lane drawer (eight-colour palette, hashed from branch name; main / master / develop kept neutral). Inline expand on click — commit body +

⚠️ For defensive/educational purposes only. Sniff only networks you own or are explicitly authorized to test. Unauthorized network monitoring is illegal in most jurisdictions. The uncomfortable truth about your factory floor If your plant uses Modbus TCP — and statistically, it probably does — every register read, every coil write, every sensor value is flying across your network in plaintext . No encryption. No authentication. No signature. Nothing. Modbus was designed in 1979 by Modicon for serial communication between a PLC and a few field devices on a dedicated cable. The threat model was "someone might physically tap the wire." The solution was "don't let strangers into the control room." Forty-five years later, that same protocol is running over your corporate VLAN, talking to cloud historians, and occasionally — if your IT/OT segmentation has gaps — reachable from the internet. Let me show you what that looks like from the wire. The 5-line sniffer This is a defensive monitoring tool. Same code your blue team would use to baseline normal traffic and detect anomalies. Requires scapy : pip install scapy from scapy.all import sniff , TCP , Raw def show_modbus ( pkt ): if TCP in pkt and pkt [ TCP ]. dport == 502 and Raw in pkt : payload = pkt [ Raw ]. load print ( f " { pkt [ ' IP ' ]. src } → { pkt [ ' IP ' ]. dst } : { payload . hex () } " ) sniff ( filter = " tcp port 502 " , prn = show_modbus , store = False ) Run it on a span port, a TAP, or a mirror VLAN, and within seconds you'll see something like this: 192.168.1.50 → 192.168.1.10: 0001000000060103006400 02 192.168.1.10 → 192.168.1.50: 00010000000701030441f00000 192.168.1.50 → 192.168.1.10: 00020000000601100065000102 Every byte tells a story. Let's decode the first packet. Decoding what you just captured The Modbus TCP frame format is documented in the spec (it's public — that's part of the problem): Bytes 0-1: Transaction ID Bytes 2-3: Protocol ID (always 0x0000 for Modbus) Bytes 4-5: Length Byte 6: Unit

The Problem We Were Actually Solving Treasure hunts in Hytale arent just about generating loot. Theyre about generating simultaneous loot across thousands of players while keeping the world state consistent. We started with the assumption that events are stateless notifications: a hunt starts, we fire an event, clients react. That model worked fine when we had 200 concurrent players. At 2,000 players, the event bus turned into a 40 MB/s firehose of JSON blobs. Each loot drop required serializing the entire chunk state—blocks, entities, metadata—so clients could render the drop in real time. The JVMs G1GC couldnt handle the allocation rate. Every 47 minutes, a GC cycle would pause for 4.2 seconds, the chunk cache would fragment, and the server would hard crash with an OutOfMemoryError in net.minecraft.server.MinecraftServer#processQueue. The real problem wasnt the hunt logic. It was the architectural laziness of treating events as a catch-all glue layer instead of a boundary layer with explicit interfaces. What We Tried First (And Why It Failed) We tried Kafka as the event bus. The plan was to shard hunts by region and stream loot drops as compacted topics. The first run worked for about 6 hours before the compacted topics started to bloat. Each hunt was generating 700 KB of serialized chunk state per drop. At 30 drops per hunt per minute, thats 21 MB per hunt per minute. With 400 active hunts, the brokers couldnt keep up. The lag grew to 12 seconds, clients started rubber-banding, and we got a flood of Discord reports: You sank my boat! The event stream was now the bottleneck, not the event source. Next, we tried Redis Streams with a Lua script to aggregate loot drops per chunk. Within 30 minutes, we hit the 4 GB maxmemory limit because Lua scripts were stacking dropped items in memory while waiting for the next batch. The script was elegant—O(1) per drop—but the memory footprint made it unusable in production. Finally, we tried a sidecar service: a small Go process

I understand why so many people are questioning software engineering right now. Every week there’s another headline saying AI will replace developers. Junior engineers are worried there won’t be jobs. Senior engineers are wondering how long their experience will stay valuable. And honestly, if you spend enough time on tech Twitter or LinkedIn, it can start feeling like the industry is collapsing in real time. But after using AI heavily in my day-to-day work as a software engineer, I’ve started seeing things differently. AI didn’t make me feel less useful. It made me feel more capable. Before AI became part of my workflow, a lot of engineering time disappeared into things that were mentally draining but necessary: repetitive refactoring debugging small issues writing boilerplate digging through documentation trying to remember syntax cleaning up legacy code writing SQL queries optimizing simple functions translating vague tickets into technical tasks None of these tasks were impossible. They were just time-consuming. Now, a lot of that friction is reduced dramatically. One of the biggest changes I noticed was backlog cleanup. Tasks that used to sit untouched because nobody wanted to deal with them suddenly became manageable. Not because AI magically solved everything. But because it helped reduce the “mental startup cost” of difficult tasks. Sometimes all you need is: a starting point a refactored example help understanding unfamiliar code a faster debugging path quick documentation summaries That momentum matters more than people realize. A task that feels overwhelming at 9AM suddenly becomes achievable when AI helps break it down. I also noticed we started delivering faster as a team. Not in a “replace developers with AI” kind of way. More in a: less context switching faster research quicker prototyping fewer hours stuck on repetitive problems better ticket breakdowns improved communication kind of way. The interesting part is that AI didn’t just help with coding.

Why Does Using an ORM Decrease Database Performance? While trying to optimize the shipping module in a production ERP, I noticed that database queries were incredibly slow. At first, I examined the SQL queries and checked the indexes. However, I couldn't get the performance boost I expected. The problem lay in the Object-Relational Mapper (ORM) library, which was the cornerstone of our application. ORMs make things easier for software developers by providing an abstract layer for database operations, but this convenience often comes at a performance cost. In this post, I will explain why using an ORM decreases database performance, using concrete examples from my own field experience. The core promise of ORMs is to keep developers away from SQL and allow them to interact with databases in a way that is more aligned with the object-oriented paradigm. This is a huge advantage, especially in small and medium-sized projects or rapid prototyping processes. However, when things get complex and performance becomes critical, the efficiency of the queries generated by ORMs starts to be questioned. In many cases I have encountered, especially in enterprise software development processes, the default behaviors of ORMs created an unexpected load on database servers. Query Inefficiencies Generated by ORMs ORMs usually manage database relationships using mechanisms like "eager loading" or "lazy loading". Depending on the developer's preference, these mechanisms either fetch all related data at once (eager loading) or fetch it in pieces as needed (lazy loading). However, ORMs may not always perform these loads in the most optimized way. For example, while only a few fields like ID and name are sufficient in a list view, the ORM might query the entire table or all related tables. This situation causes unnecessary data transfer and unnecessarily overloads the database server. To give an example, on the order list screen of an e-commerce site, we needed to display the customer inform

Disclosure: I work on Passlens, a browser-first passport and ID photo maker. This post is about the product decisions behind that workflow, not a neutral review of every tool in the space. A passport photo looks simple until you try to make one that an upload form will actually accept. It is a headshot, yes, but it is also a small chain of constraints: physical size, pixel size, background, head position, print scale, and whatever the destination country's portal decides to reject that week. That is why generic photo editors feel slightly wrong for this job. They can crop. They can resize. They can export. The hard part is not any one of those actions. The hard part is keeping all of them tied to the document rule the user picked. The unit problem For developers, document photos are awkward because two units matter at the same time. A user may need a 2x2 inch passport photo. A visa portal may ask for 600x600 pixels. A print sheet may need 35x45 mm photos at 300 DPI. These are not the same request, but people often treat them as if they are. If the app only thinks in pixels, the print can come out the wrong physical size. If it only thinks in millimetres or inches, the digital upload can be rejected for the wrong pixel dimensions. A good workflow has to keep both ideas alive: the document size and the export target. That is the main reason Passlens keeps presets and print layouts as first-class pieces of the workflow instead of treating them as labels on a crop box. The crop is not the output Another small trap: the crop the user sees is not always the final output. For a digital upload, the crop usually becomes one image file. For printing, the same crop may become several photos arranged on 4x6, A4, or Letter paper with spacing, margins, and optional cut marks. If that print sheet is scaled by the browser or printer dialog, the whole thing is wrong. So the editor needs to separate three things: the face and shoulder crop the finished document-photo size the print s

What if a development board could be as friendly as an Arduino, yet powerful enough to drive industrial-grade robots? That is exactly the gap the new G2 Nano sets out to close. Most hobby boards handle simple robot builds with ease, but they hit a wall once a project demands tight, simultaneous control of several motors. Embedded systems engineer Ryan Strace noticed that the custom controllers built for these complex machines tend to look remarkably alike, with motor coordination as the recurring headache. Rather than reinventing that hardware on every project, he designed a single accessible platform to handle it, and the G2 Nano is the result. Precise motor control usually leans on closed-loop techniques like PID, but real-world gremlins such as integrator windup, sensor noise, mechanical saturation, and phase delay can all degrade performance. Robots also need smooth multi-axis motion with managed acceleration to avoid jerky, stressful movement, plus solid fault handling so an unexpected state does not wreck expensive parts. Strace is tackling all of this with a low-cost motion-control IC he is developing, and the G2 Nano is the high-performance platform built to prove out that future chip. What's under the hood Processor: NXP Arm Cortex-M7 clocked at a brisk 1 GHz Wireless: u-blox MAYA-W1 module with dual-band Wi-Fi and Bluetooth Motion sensing: six-axis IMU (3-axis accelerometer plus 3-axis gyroscope) and a dedicated magnetometer for compass heading Form factor: just 0.8 by 3 inches, breadboard-friendly, on a six-layer PCB stackup for clean high-speed signals On the software side, the board targets native micro-ROS and the Zephyr real-time operating system, with planned MicroPython support so you can prototype in Python without paying the usual speed penalty, thanks to that unusually high clock. Every design file and document is open-source and published on GitHub. Build it yourself If you want to follow along, the core ingredients are clear: an NXP Cortex-M7 a

A lot of AI apps die in the same place. Not during the prototype phase. Not while testing...

According to the complaint, a Google engineer risked over $2.7 million on wagers related to Google's 2025 Year in Search campaign.

Author: Tobie Morgan Hitchcock Three months after 3.0 went GA, we're excited to announce that...

Plan and track your trips privately Discussion | Link

Problem Statement We have a misinformation problem. But more specifically, we have a speed problem. A journalist spots a suspicious claim. They search for sources. Cross-reference databases. Call experts. Write a verdict. Get it edited. Publish, maybe 6 hours later. Maybe 3 days later. Meanwhile, the original claim has been screenshot, reposted, quoted in newsletters, and cited in arguments across five platforms. I wanted to build something that closed that gap. Not a chatbot that guesses. A proper pipeline, one that retrieves real evidence, reasons from it, and tells you why it reached a verdict. That's what Sift is. What is Sift? Sift (Source Inspection & Fact-checking Tool) is an open-source multi-agent AI pipeline that takes any text, extracts every factual claim, retrieves grounded evidence, and returns auditable verdicts — TRUE, FALSE, or UNCERTAIN, with cited sources and full reasoning chains. Paste a news article. A politician's speech. A viral statistic. A WhatsApp forward. Sift breaks it into individual claims and fact-checks each one independently. Why Multi-Agent? The naive approach is to ask an LLM: "Is this claim true?" The problem: LLMs hallucinate. They have knowledge cutoffs. They're confidently wrong in ways that are hard to detect. And critically, they don't show their work. A single LLM call can't reliably handle the full pipeline of: Extracting structured claims from noisy text Retrieving dated, traceable evidence from live sources Reasoning across conflicting evidence without confabulating Adversarially reviewing its own conclusions for overconfidence Finding corrections when something is wrong Each of these is a distinct task that benefits from its own prompt, its own tools, and its own failure modes. That's why I built five separate agents, orchestrated with LangGraph. The 5-Agent Pipeline Agent 1 — Claim Extractor A single paragraph can contain 4-5 distinct factual claims. Generic LLMs miss them or conflate them. This agent uses LLaMA 3.3 70

When regulation becomes theater and encryption becomes window dressing By Vektor Memory — 20 min read It is raining here in the Southern Hemisphere again. It has been raining for three weeks now, nonstop. I’m sitting with my chai coffee, watching out of the window, and thinking about data sovereignty. It is, genuinely, the kind of thing I think about often. The northern hemisphere is winding up for summer. Europe is getting ready for long evenings and beach holidays. I’m quietly jealous. I’ve always wanted to split the year: six months south, six months north. Endless summer. The perpetual warmth of a life lived chasing the sun. But here I am. Chai. Rain. Data. I’ve been turning over one question in particular: why is it that the moment you mention data sovereignty, people immediately reach for GDPR? It’s reflexive, especially among Europeans. Understandable. GDPR is loud, it’s enforced, it has teeth. French, German, and Dutch visitors make up a large disproportionate share of our site traffic at VEKTOR, and the interest in privacy and sovereignty from that audience is intense and genuine. Northern Europeans, by and large, take this seriously in a way that other markets don’t; they are working on ways to disassociate from the cloud around the world. And yet. How many times have we clicked “Accept All” on a cookie banner in the last week? How many times have you scrolled past a privacy policy that runs to forty-two pages? How many times have you handed over your email address, your location, your device fingerprint, your behavioral patterns not because you wanted to, but because there was no meaningful alternative? GDPR created the most sophisticated legal architecture for data rights the world has ever seen. It also created the most sophisticated ritual of consent theater the world has ever performed. That gap, between the law and the lived reality, is what this article is about. Ubiquitous data centre growth image The Reflex Problem When people think of data sovere

Google is embarrassing itself, again.

The bill requires companies like OpenAI, Anthropic, and Google to have third parties confirm they’re following safety standards. Illinois governor JB Pritzker says he’ll sign it.

Talk to your computer, it responds and gets things done. Discussion | Link

Who could have seen this coming?

I am a software developer who has been using LLMs extensively at work. I wanted to develop a foundational understanding of LLMs, but have no background in machine learning or statistics. So, I started to read and take notes with the goal to eventually write up a developer's guide to the foundations of LLMs. The article kept growing, so I have split it into four parts. This is the first in the series. Hope this helps! submitted by /u/Normal-Tangelo-7120 [link] [留言]