标签：#rce

Notes An AI shopping assistant for WooCommerce that stores no conversations: what it can answer, what it cannot, and a 10-minute setup Andrej Lauko, ARLing · 6 September 2026 Most chat widgets a WooCommerce store adds today keep a full transcript of what a shopper typed and how the widget answered, sitting in the vendor's database for as long as its retention policy allows. ARLing Asistent, a WordPress plugin for WooCommerce, is built the other way: it answers shopping questions from a store's own product feed and keeps no record of the conversation itself, only a daily count. This note covers why that difference matters, how a feed-grounded assistant actually works, what it answers well and where it stops, the setup, the pricing, and how it compares on price and data handling to Tidio's Lyro and Smartsupp's Mira. 01 Why most chat widgets store every conversation A chat widget that keeps transcripts makes the store a data controller for that content under GDPR: the store decides why the data is collected and how long it is kept, even though the vendor's server does the actual storing. That controller role brings duties many small stores never plan for: a lawful basis for keeping the transcript, a retention period that has to be justified if asked, a way to answer a shopper's access or deletion request within a month, and a data processing agreement with the vendor spelling out what it may do with the content. None of that is hard on its own, but it is another document to keep, another request to route, and another place a customer's name or order number can leak if the vendor has a breach. There is a smaller, everyday reason too: support load. A widget that saves every conversation eventually invites someone to go looking through it, whether to audit what the bot said or to answer "what did it tell this customer." A widget that keeps nothing beyond a daily count removes that job along with the risk. 02 How a feed-grounded assistant works ARLing Asistent connects to

Hi DEV! I got tired of free PC cleaners that bundle a registry cleaner nobody needs, count up a scary number of "issues", and then dangle a paid version at the end. So I wrote the boring version. CleanGeek finds and clears: Temp folders, user and system Browser caches across the installed browsers Windows Update leftovers and Delivery Optimisation cache Crash dumps and error reports Thumbnail cache and font cache Recycle Bin, if you tick it Every item shows what it is and how much space it is worth. Nothing is deleted until you press the button, and you can untick anything you want to keep. Why I built it There is no registry cleaner in it and there never will be. Cleaning the registry has not meaningfully sped up a Windows machine in about fifteen years, and the risk of breaking something is real. Same reason there is no "optimise your PC" button. The tool does one job and tells you exactly what it did. The other reason is the business model. Free cleaners generally are not free, they are a funnel. CleanGeek has no paid tier to funnel you into, no upsell screen, and no telemetry. Tech stack .NET 8, net8.0-windows Avalonia for the UI, with Avalonia.Desktop and Avalonia.Themes.Fluent No third party cleanup engine, the scanning is all in the app Avalonia was the right call. WinForms would have been quicker to get moving but the styling story is grim, and WPF ties you down harder than I wanted. Honest caveat The installer is not code signed yet, so SmartScreen may warn on first run. I am sorting that out. If that is a dealbreaker for you, fair enough. Links Site: https://techygeekshome.info/cleangeek/ Source: https://github.com/techygeekshome/CleanGeek Video: https://youtu.be/Z2s2p3nkIvY If it misses something obvious on your machine, tell me and I will add it.

I built a tool that draws architecture diagrams from a repository, where every edge cites the file, line and commit it came from. Then I ran it against thirteen repositories it had never seen, and every single one of them found something wrong with it. There were thirteen. These are the ones worth writing down. The list says nothing about those codebases. It says something about testing: a tool that reads other people's repositories has to be tested against other people's repositories, and there is no substitute. The rule the tool works by Nothing is drawn that cannot be cited. Every edge in the output carries the file, the line and the commit that justifies it — click an arrow, see the import statement. If a reference cannot be resolved to something in the repository, it is not quietly dropped and it is not guessed at. It is reported as a gap. That second half is what made these bugs findable. A tool that silently drops what it cannot resolve looks perfect and is useless. A tool that reports gaps by name and count tells you, loudly, every time it is confused. Java: a library sharing your package prefix is not you Guava declares com.google.common . Truth is a separate library, and it lives in com.google.common.truth . My resolver matched on package prefixes, so Truth looked like Guava's own code, and every reference to it became a gap against a package Guava does not contain. 834 false gaps — 28% of the repository. The fix is to require the next path segment to look like a type before peeling, because com.google.common.truth.Truth peels to a package and com.google.common.collect.ImmutableList peels to a class, and those are different shapes. Java: a file importing its own nested type Java requires the import for a nested enum constant even inside the same file. Treating that as a dependency has you drawing an arrow from a file to itself. It accounted for all 137 remaining gaps on Spring Boot and all 34 on Guava. Java: static imports point one segment too deep import

TL;DR : some questions don't have a fixed path through your data (search docs, hit a table, compute, verify, answer — in whatever order/combination the question needs), and drawing a graph for that class of question means either enumerating every path up front or hiding an if/else forest inside one node. ctxloom replaces the graph with typed artifacts and agents that react to their appearance — below is the same use case built both ways, side by side. The problem Picture a typical question from a finance lead in an internal chat assistant: "Why did our infra costs jump in Q2?" Answering this honestly requires: Finding relevant documents — the pricing guide, the discount policy (Confluence/docs). Pulling structured data — a CSV/table of monthly spend (GitLab/S3/DB). Computing an aggregate — not "roughly", an exact number from the table. Cross-checking textual claims against the numbers — not letting the model invent a cause the data doesn't support. Returning the answer together with proof: where each part came from. The next question — "what if we hadn't moved to the Pro plan?" — needs a different path: a different source, a different calculation, a different verification chain. There is no universal graph for this class of questions — you can draw a graph for one specific question, but not for the class. This is exactly what typical graph frameworks (LangGraph, CrewAI, etc.) make you pay for in complexity: either you draw a graph for every possible path up front, or you end up with a hidden branching if/else inside one node that nobody can later explain. How this looks in ctxloom ctxloom has no execution graph — it has artifacts (typed, versioned objects) and agents that react to their appearance . The breakdown above is just a chain of artifacts: Question │ ▼ SourceRef (ranked references to sources) │ ▼ TypedDoc / Spreadsheet (lazily resolved content) │ ├──► Evidence (facts extracted from text) │ │ │ ▼ │ Claim (a statement + verification against Evidence) │ └──► C

A green test suite is evidence. It is not independent evidence. The current release of badBANANA Threat Observatory passes all 108 automated tests in its own development and CI environments. That tells me the implementation satisfies the assertions I wrote against the conditions I expected. It does not tell me whether an independent developer can check out the same commit in a clean environment and obtain the same result. That distinction matters more than the number 108. The dangerous failure is a believable one The Observatory presents source-backed threat-intelligence records, freshness information, and material-change events. In that kind of interface, an obvious crash is not necessarily the worst outcome. A more dangerous failure is one that looks healthy: An expired cached snapshot presented as current An invalid expiry value treated as usable A failed upstream source displayed as a successful zero-result response Demo or fallback data appearing without explicit disclosure A disabled or offline state silently normalized into success Those failures do not merely inconvenience the user. They change what the interface appears to know. For v1.2.2, the intended behavior is deliberately fail\ closed: Condition Required behavior Cached snapshot has expired Report it as stale Expiry value is invalid Fail closed to stale Source is offline, disabled, or failed Preserve that state Source data is missing or unavailable Do not present a successful zero result state Ingestion requests overlap Enforce the runtime concurrency limit deterministically Feed credentials are configured Keep them server side and absent from client output The test suite exercises these boundaries. The remaining question is whether the release reproduces cleanly outside the environment in which it was built. Passing tests and independent verification are different claims When the source, tests, build assumptions, and execution environment all come from the same maintainer, a successful run demonstrat

If you're prepping for the Certified Kubernetes Application Developer (CKAD) exam, you've probably already found killer.sh, Killercoda, or one of the paid mock-exam platforms. I wanted something different: no account, no cloud dependency, no subscription — just a simulator that runs entirely against my own cluster, so I could rerun the same drills as many times as I wanted without worrying about usage limits. That's CKAD Dojo — free, open source, self-hosted. What it actually does 20 free mock exams, 398 questions, mapped to the official CKAD v1.35 curriculum A 120-minute countdown timer that mirrors the real exam (turns yellow at 15 min, orange at 5, red at 1) An embedded web terminal (ttyd) right next to the question panel — same gesture as the real exam UI, no window-juggling Instant, real scoring: bash functions query the actual state of your cluster against 400+ criteria, question by question. You don't have to wait until the end to know if you got it right. Runs against your own cluster — kubeadm, minikube, or kind (1.28+). Nothing leaves for the cloud. Why "dojo"? Each of the 20 practice sets is themed after a figure from Japanese mythology or the four celestial guardians (Suzaku, Byakko, Genbu, Kirin...). Resources inside each dojo follow the theme, so kubectl get pods genuinely reads like a small story instead of pod-1, pod-2, pod-3. Small detail, but it makes repeated drilling less soul-crushing. The loop Open a dojo — namespaces, workloads and Helm releases get provisioned for you. Scripts are idempotent, so you can rerun them freely. Train in the terminal — question on the left, real shell on the right, resizable divider. Arrow keys to navigate, F to flag a question, collapsible hints if you're stuck. Score whenever you want — not just at the end. Wipe and redo — read solutions.md, clean the cluster, and run the same dojo again tomorrow. The goal is reflex, not memorized answers. It's community-built 14 of the 20 dojos come from contributors — 9 as fully

Up front: this is my own project, so I'm not exactly neutral here ;-) Where I'm coming from I work completely differently than I did two or three years ago. For most of my career I wanted to write pretty much every line myself, and I was a bit proud of that. That has changed a lot. Instead of programming I now mostly write specifications and review what the AI generates. On the one hand that's great, I can turn new ideas into working software much faster than before. On the other hand there's the risk of stepping into the same traps with AI-generated code again and again. And that's where I noticed something. Every time I started a new project, I found myself explaining the same things to the AI. This goes into a plugin. That stays out of the core. No domain logic in the shell. Please don't invent a third way of doing tabs. The AI would nod, generate something that looked right, and two days later I'd find a slightly different version of the same sidebar with a slightly different bug. There are things I really don't want to explain over and over. A good, preferably deterministic base is getting more important, not less. I don't want to explain proven architectures from scratch every time. I'd rather build on established solutions where I can, ones the AI understands and can just use. So for my new projects I built exactly that, and put it on GitHub as open source. Why Angular? Well, simply because I think it's a great framework and I've had a lot of good experiences with it over the last 10 years. What it is, and what it isn't LoomWeaver is a workbench shell for Angular. Not a component library. Think of the frame VS Code gives you: a rail on the left, sidebars, a top bar, a status bar, and in the middle tabs and panes you can split and drag around. That frame is what most workbench-style products build themselves, every time, slightly differently. LoomWeaver gives you that frame, and your own domain moves in as plugins. The core contains zero domain logic. Even my

AI coding agents can modify an unfamiliar file in seconds. The slower question is often more important: Why does this code look this way? The answer may be scattered across old local sessions: one turn investigated the bug, another rejected an approach, and a later turn made the edit. Git preserves the code change, but not necessarily the surrounding agent conversation. I added a local query layer to ThoughtDAG so a developer—or a coding agent—can deliberately retrieve that history before editing: npx thoughtdag why src/lib/api.ts It searches supported local agent transcripts for turns that changed, read, or discussed the file and returns links to the matching source turns. Observation is not explanation The difficult part was not text search. It was avoiding a false claim of causality. If a session record shows a file edit, ThoughtDAG can report that as an observed change: Δ storedProviders → storedProviders, storedVision… If the agent later says why it made the change, that is useful—but it is still the agent's account, not a verified causal fact. ThoughtDAG marks that separately: ≈ candidate explanation from the agent response This distinction matters when old session history becomes input to another agent. A fluent explanation should not silently harden into ground truth just because it was retrieved. Retrieval stays deliberate For regular use, the same index can be exposed through read-only MCP tools: npm install -g thoughtdag thoughtdag setup mcp The agent can then call why_check , why_file , find , and recall_turn before changing code. Retrieval is explicit; matching history is not automatically injected into every prompt. The index stays on the local machine, and source session files are never modified. The current CLI covers local Claude Code, Codex, and ThoughtDAG canvas conversations. What this does not prove This is a developer preview, not a complete audit trail. An observed edit proves that the recorded session changed a file, not that every reason for

Runnable reproductions for every framework named above, offline and pinned to a version: https://github.com/mahirhir/unanswered-approval

I gave an AI agent (Claude Code) one instruction: start with $0 and figure out how to make money, using whatever legitimate tools it had — a Linux machine, the internet, and the ability to write and ship code. Here's what actually happened, because it wasn't what I expected. It didn't start with an idea. It started with research. Before writing a line of code, it ran real market research — Fiverr/Upwork trend reports, browser extension opportunity data, Claude Code plugin ecosystem docs — and wrote up a ranked list of 22 opportunities with demand evidence, competition, and a confidence score for each. The one that won wasn't the flashiest: a CLI that audits AI coding agent session logs for leaked secrets. Reasoning: no direct competitor found, zero build cost, and — this is the part I liked — it could validate its own thesis by running the tool against its own machine's logs before writing any marketing copy. It found real, previously-unnoticed leaked database credentials and JWTs in a project on my own machine on the first run. That's agent-audit , and it's live and free now. Then it hit real friction, and mostly handled it honestly The distribution part is where it got interesting. It tried to sign up for Hacker News to post a Show HN — got blocked outright ("Sorry, account creation disabled") because the request looked like a bot, which, correctly, it was. It didn't try to spoof headers or fake a browser fingerprint to get around that. Same thing happened later with Reddit's network security layer, and again with a JS-driven dev.to signup form that was silently failing. Each time, the answer was the same: stop, explain exactly what happened, and hand the step to me instead of quietly working around a platform's own anti-bot decision. That's a genuinely different failure mode than I expected going in. I assumed "AI agent tries to grow a business autonomously" would mean either it gets stuck asking permission for everything, or it starts finding clever workarounds

GitHub热门项目 | AI enabled pair programmer for Claude, GPT, O Series, Grok, Deepseek, Gemini and 300+ models | Stars: 7,609 | 40 stars this week | 语言: Rust

GitHub热门项目 | Rust GUI components for building fantastic cross-platform desktop application by using GPUI. | Stars: 13,942 | 199 stars today | 语言: Rust

GitHub热门项目 | Miles is an enterprise-facing reinforcement learning framework for LLM and VLM post-training, forked from and co-evolving with slime. | Stars: 2,469 | 55 stars today | 语言: Python

The decision between a free hosted AI coding server and a self-hosted stack is rarely about price. It is about three measurable variables: token burn per task, latency tolerance, and privacy surface. Teams that compare sticker prices pick wrong. Teams that measure these variables pick right most of the time. This guide provides a decision table, a token budget script, and a one-week audit workflow. The framework applies to any free AI coding tier. The examples use MonkeyCode, an open-source AI coding assistant whose free tier includes model access and a hosted server with a 10M token allowance at the time of writing. Quotas and model availability change, so verify the current limits before relying on them. Disclosure: This article was prepared as part of MonkeyCode's product outreach. Why Sticker Price Is the Wrong Variable Free sounds better than paid. It is not always cheaper. A free server that burns 40,000 tokens on a task a local model handles in 8,000 tokens costs more in time, context, and rework. The real unit of comparison is tokens per completed task, not dollars per month. Self-hosting has the same trap. A GPU that already sits in the office looks free. Add power, cooling, maintenance, and the engineer who keeps the stack alive, and the hourly cost becomes visible. The comparison needs one model that accounts for both sides. The Three Variables That Decide Token burn per task Refactors and test generation consume more tokens than single-file edits. The number varies by model, context length, and repository size. Most teams never measure it. That is the first mistake. A 10M allowance sounds large until a monorepo context window eats a meaningful slice of it on every request. Latency tolerance Interactive coding needs fast first-token time. Batch tasks like code review or documentation generation tolerate seconds of delay. A free hosted server usually sits between the two. Teams that treat all tasks as interactive overestimate latency risk. Teams that treat

At 2:47 AM, the email lands: "Your free allowance expires in 72 hours. Upgrade to continue." Your demo works. Your eval harness passes. Your CI pipeline is green. And in three days, every one of those things will be a pile of 429s. I've been on both sides of this. I've built on free tiers that disappeared without notice, and I've watched teams scramble to migrate after the fact. The scramble is always the same: nobody knows which config file points at the remote endpoint, nobody remembers the local model weights were never downloaded, and the "quick fix" takes a full day. So I did the thing I should have done months ago. I ran an exit drill. Disclosure: This article was prepared as part of MonkeyCode's product outreach. MonkeyCode is an open-source AI development platform that currently offers a free managed server with a 10M-token allowance. The drill below works against any managed endpoint — MonkeyCode's free server is just a convenient target because the same codebase is self-hostable. The drill: 45 minutes, one laptop, zero meetings The goal is brutal and specific: make the application work without the free server, in under an hour, with only the tools already on your machine. I picked a Friday afternoon. I set a timer. I closed Slack. Here's exactly what happened. Minutes 0–5: Inventory the dependency The first step is finding every place your code touches the remote endpoint. Don't grep for the URL — grep for the client library. grep -rn "openai \| anthropic \| chat/completions" --include = "*.py" --include = "*.ts" --include = "*.js" . In my case, the damage was contained: one config file, two modules, and a test fixture that hardcoded the remote URL. The fix was a single environment variable. But knowing that took five minutes of grepping, not thirty seconds of intuition. The lesson: if your endpoint URL lives in more than one file, you've already failed the drill. It should be an environment variable, period. Minutes 5–15: Stand up the local replacement Th

Homeland Security Investigations agents hit the outdoor retailer with a controversial subpoena as part of a dragnet search for the identities of protesters who entered a Minnesota church in March.

TL;DR Welcome back to Dev Opportunity Radar. This is a weekly series where I share opportunities,...

RustDesk is gaining attention today with +84 GitHub stars , and the reason is straightforward: it provides an open-source remote desktop experience while allowing teams to control the infrastructure behind it. Unlike a client-only tool, RustDesk is built around a self-hosting model. The desktop client connects through a RustDesk ID server ( hbbs ) for rendezvous and a relay server ( hbbr ) when direct peer-to-peer connectivity is unavailable. This separation makes the architecture easier to reason about and gives operators more control over traffic and metadata. A quick server experiment can start with Docker: docker run -d \ --name rustdesk-hbbs \ --network host \ -v " $PWD /rustdesk-data:/root" \ rustdesk/rustdesk-server:latest \ hbbs docker run -d \ --name rustdesk-hbbr \ --network host \ -v " $PWD /rustdesk-data:/root" \ rustdesk/rustdesk-server:latest \ hbbr For production, configure the client with your server’s public key and hostname rather than relying on default discovery. Keep the relay and rendezvous ports documented, restrict administrative access, and store the generated keys in a protected location. The Rust implementation is a practical fit for a latency-sensitive desktop application: native binaries, low runtime overhead, and broad platform support. The trade-off is operational complexity. Self-hosting means handling updates, firewall rules, TLS or tunnel termination, backups, and monitoring yourself. Things to watch before production: Network design: Direct connections may fail behind strict NAT, forcing traffic through the relay and increasing bandwidth usage. Security controls: Treat the server key, access credentials, and client distribution process as sensitive infrastructure. Upgrade testing: Validate client/server compatibility in a staging environment before rolling out updates widely. For developers who want remote support without surrendering control of the entire connection path, RustDesk is a compelling open-source project to test in a p

Have you ever wondered how your smartwatch actually knows you're stressed? Most of us treat the "Stress Score" on our wrists as a source of truth, but the logic remains hidden behind proprietary algorithms. Today, we are pulling back the curtain. We are going beyond basic heart rate tracking to perform PPG signal processing and HRV frequency domain analysis using Python. By the end of this guide, you’ll know how to ingest raw data via Bluetooth Low Energy (BLE) , apply digital filters with SciPy , and calculate the elusive LF/HF ratio to determine autonomic nervous system balance. If you are interested in advanced biometric algorithms or Python signal analysis , you’re in the right place. 🚀 The Architecture: From Photons to Stress Metrics Unlike standard heart rate (BPM), which just counts peaks, Stress Scores rely on Heart Rate Variability (HRV) —the millisecond-level variations between heartbeats. We'll be moving from raw light intensity data to a frequency-based stress index. graph TD A[Wearable Sensor / PPG] -->|Raw BLE Stream| B[Data Acquisition - Bleak] B --> C[Preprocessing - Bandpass Filter] C --> D[Peak Detection - Find R-R Intervals] D --> E[Cubic Spline Interpolation] E --> F[Fast Fourier Transform - FFT] F --> G[LF/HF Ratio Calculation] G --> H[Final Stress Score] 🛠 Prerequisites To follow this advanced tutorial, you’ll need: Hardware : A pulse oximeter or wearable that exposes raw PPG via BLE (e.g., Polar OH1, MAX30102 with an ESP32). Stack : NumPy & SciPy : For heavy-duty math and signal processing. Bleak : For cross-platform Bluetooth Low Energy communication. Matplotlib : To visualize the pulse waves. Step 1: Capturing the Raw PPG Stream (BLE) Photoplethysmography (PPG) works by shining green or red light into the skin and measuring the light absorption. First, let's grab that raw stream. import asyncio from bleak import BleakClient # UUID for the Raw PPG Characteristic (Device specific) PPG_CHAR_UUID = " 00002a37-0000-1000-8000-00805f9b34fb " def no

GitHub热门项目 | Algorithm powering the For You feed on X | Stars: 32,574 | 37 stars today | 语言: Rust