标签：#rce

Java is everywhere in backend systems, enterprise applications, and production environments. But when it comes to numerical computing, data manipulation, and scientific-style operations, Python's NumPy ecosystem has become the standard. I wanted a similar experience in Java: a lightweight, dependency-free library for working with multidimensional arrays and linear algebra. That idea became NumPy4J. What is NumPy4J? NumPy4J is an open-source numerical computing library for Java inspired by NumPy. It provides: Multidimensional arrays (NDArray) NumPy-style broadcasting Array creation utilities Reshaping and slicing Element-wise operations Linear algebra operations Example: NDArray A = NDArray . of ( new double []{ 1 , 2 , 3 , 4 }, 2 , 2 ); NDArray B = NDArray . ones ( 2 , 2 ); NDArray C = A . add ( B ); Matrix operations: NDArray result = LinearAlgebra . matmul ( A , B ); Solving equations: NDArray x = LinearAlgebra.solve(A, b); Why build another numerical library? There are already excellent Java math libraries available. The goal of NumPy4J is different: Provide a NumPy-like API experience Make multidimensional arrays a first-class concept in Java Keep the API simple and approachable Create a foundation for future scientific computing features Testing approach To make sure behavior stays consistent, NumPy4J uses Python NumPy as a reference implementation. Test cases are generated with NumPy and validated against the Java implementation, covering: Broadcasting Matrix operations Reshaping Transpose Linear solving Element-wise calculations What's next? The roadmap includes: More NumPy-compatible operations Matrix decompositions (QR, LU, Cholesky) Eigenvalue computation More statistics functions Performance improvements Try it out If you work with Java and need NumPy-style numerical operations, I would love for you to try NumPy4J, provide feedback, and contribute ideas. GitHub: https://github.com/darius1973/numpy4j Documentation: https://darius1973.github.io/numpy4j/inde

LLM-written bibliographies do not stop at arXiv preprints. Law review drafts invent reporter cites; multilingual papers mangle Chinese titles. citesure 0.2 extends the integrity gate into those failure modes. US case law via CourtListener References that look like court cases — @jurisdiction entries, Plaintiff v. Defendant titles, or reporter strings such as 347 U.S. 483 — are resolved against Free Law Project CourtListener. Ranking prefers an exact reporter cite over companion orders, so Brown lands on 347 U.S. 483 rather than a later procedural listing. @jurisdiction { brown1954 , title = {Brown v. Board of Education} , year = {1954} , howpublished = {347 U.S. 483} , } citesure check examples/packs/us-case-law.bib citesure warm-cache cases.bib Optional COURTLISTENER_TOKEN for higher rate limits. Law-review CI: templates/journal/law-review.yml . CJK-aware matching NFKC + fullwidth folding; character-level similarity for CJK-heavy titles; CJK bigrams in claim scoring so Chinese claims are not silently empty. Evidence Integrity bench 242/242 (US cases + Chinese titles + multi-domain set) Claims mini-bench 29/29 Eight domain packs including us-case-law Install pip install "git+https://github.com/SybilGambleyyu/citesure.git[pdf]" Source: github.com/SybilGambleyyu/citesure · Demo: workers.dev

I wanted to use web-based AI chatbots — Claude, Gemini, ChatGPT, Qwen — for actual development work, not just Q&A. The free tiers are generous, and I didn't want to be locked into a single coding agent or pay for API access just to get an assistant to touch my code. But the moment you try to actually use a web chat for real dev work, you hit the same wall every time: you either paste in your whole codebase manually every session, or you give up and reach for a paid extension with an API key behind it. So I built AI Bridge — a CLI tool that bridges a local codebase and any browser-based AI chatbot. No API keys, no extensions running in the background, no vendor lock-in. You pack your code, paste it into whichever AI chat you're using, and apply the changes back with a command. Why not just use Copilot, Cursor, or an API key? Coding agent apps and API-based tools work, but they come with tradeoffs I wanted to avoid: Web-based AI chat plans are usually more generous on the free tier than API usage I'm not locked into one provider — I can switch models mid-project depending on which one is handling a task better There's no background agent or extension — it's just a CLI and whatever chat tab I already have open The tradeoff is that browser chats don't have direct filesystem access. AI Bridge closes that gap without turning it into full manual copy-pasting. How it works There are two modes, depending on project size. Simple Mode is for projects small enough to fit in a single prompt. You pack the codebase, upload it along with a couple of prompt templates, and apply the AI's response back to your files: dotnet tool install --global Tools.AIBridge cd /path/to/your-project ai-bridge init ai-bridge pack # Upload ai-bridge/1-SimpleMode/*.md + the generated context files to your AI # Copy the AI's response, then: ai-bridge apply --paste Advanced Mode is for larger codebases, where uploading everything every time burns tokens and adds noise. Instead, you generate a one-time in

Workflows is a Rust library crate (not a hosted service; the crate name on crates.io/GitHub is tinyflows) that models an automation as a WorkflowGraph: a directed graph of typed nodes and edges. You build or generate that graph, it gets structurally validated, compiled into an opaque CompiledWorkflow, and lowered — once per run — onto tinyagents, a state-graph execution engine, via engine::run. model::WorkflowGraph -> validate -> compiler::compile -> engine::run (typed graph) (structural) (validated handle) (lowers onto tinyagents, drives to done) Run state is a single JSON value shaped like { "run": { "trigger": … }, "nodes": { "": { "items": [ … ] } } }. A merge reducer folds each node's output under its own id, so independent branches never collide — which is what keeps parallel fan-out deterministic. The node catalog Kind What it does trigger Entry node that starts the workflow (exactly one per graph); firing mode is host-driven agent Runs an LLM agent turn, with optional chat-model / memory / tool / output-parser sub-ports tool_call Invokes one specific integration action deterministically, no LLM involved http_request Outbound HTTP request code Sandboxed user code (JavaScript or Python) output_parser Parses/validates an upstream agent's output into a structured shape sub_workflow Runs another workflow as a nested sub-graph and returns its output condition Two-way IF, emits on true/false switch Multi-way branch keyed by an expression result merge Fan-in barrier — waits for every wired predecessor before running split_out Fan-out — emits one item per element of a list transform Pure, expression-based field mapping over the run state Data flows between nodes as arrays of items shaped { json, binary?, paired_item? } — closer to n8n's item-based model than a plain function-composition DAG — and node config can reference the run scope with =-prefixed expressions like =item.name. The part I actually want to talk about: host-agnosticism Every place this engine would n

OpenAI, Anthropic, and Google expose different APIs, message formats, tool-calling conventions, error types, and response structures. That difference is manageable while an application uses only one provider. It becomes more expensive when the application needs retries, circuit breakers, fallback routes, observability, and recovery across several providers. Without a shared abstraction, resilience logic tends to be implemented repeatedly: OpenAI integration ├── request conversion ├── retry logic ├── error classification ├── circuit breaker └── tool-call recovery Anthropic integration ├── request conversion ├── retry logic ├── error classification ├── circuit breaker └── tool-call recovery Google integration ├── request conversion ├── retry logic ├── error classification ├── circuit breaker └── tool-call recovery I did not want to build resilience three times. I wanted to define the recovery policy once and apply it across every provider supported by the application. That became llm-api-resilience , a Python library for retries, ordered failover, circuit breakers, and checkpoint recovery across multiple LLM providers. Quick start pip install llm-api-resilience Once the provider adapters are configured, an ordered fallback plan takes only a few lines: from llm_api_resilience import RecoveryPlan , ResilientLLM , Route llm = ResilientLLM ( RecoveryPlan ( [ Route ( " openai-primary " , openai_adapter ), Route ( " anthropic-backup " , anthropic_adapter ), Route ( " google-last-resort " , google_adapter ), ] ) ) response = llm . chat ( [{ " role " : " user " , " content " : " Explain circuit breakers briefly. " }] ) print ( response . selected_route ) print ( response . content ) GitHub: llm-api-resilience Provider adapter: llm-api-adapter The library is built on top of llm-api-adapter , which provides one interface for OpenAI, Anthropic, and Google. Because provider-specific differences are handled by the adapter, the resilience layer can operate on a shared contract inst

It turns out some of Benjamin Franklin's opinions from 240 years ago are still relevant today.

As Chinese AI models grow in capability and popularity among U.S. companies, the arguing over what should be done about them has reached a fever pitch.

It started with the dumbest problem in computing: I'm in bed, a movie is playing on my laptop across the room, and pausing it requires physically getting up . Every existing fix annoyed me in some way. Remote desktop apps are overkill and route through someone's cloud. Remote-control apps want accounts, subscriptions, or a native app install. I just wanted my phone to poke my laptop over my own Wi-Fi. So I built LapDeck : one Node.js process on the laptop, a PWA on the phone. Scan a QR code once and your phone becomes an app launcher, touchpad, keyboard, live screen viewer, and media/power remote. MIT licensed, plain JavaScript, no build step. This post is about the four problems that turned out to be more interesting than I expected. The architecture in one line Phone (PWA) ── WebSocket + MJPEG over Wi-Fi ──► Node.js agent (Windows) The agent serves the PWA, exposes a WebSocket for commands, and streams the screen as MJPEG. The protocol is deliberately dumb JSON envelopes — no protobuf, no RPC framework — so a native Android client or a CLI script can speak it in an afternoon. Windows-specific glue (volume, brightness, power, capture) is isolated in src/win/ , so a macOS/Linux port only has to reimplement that layer. Problem 1: mobile keyboards lie to you The obvious way to build a remote keyboard is to listen for keydown and forward key codes. On mobile, this collapses immediately: swipe typing, autocorrect, and IME composition don't emit per-key events. Android will happily tell you every key is keyCode 229 . The fix: stop listening to keys entirely. I keep a hidden input, and on every input event I diff the field's value against the last known state — compute the common prefix, then emit "delete N chars, type this string" to the laptop. Swipe-type a whole word and the laptop receives one clean text insertion. IME composition, autocorrect rewrites, emoji — all just become diffs. The lesson generalizes: on mobile web, treat the text field as the source of truth, n

TL;DR I merged several training courses into one monorepo and gave every course the same numbered folder shape : 00-planning → 04-post-training . A _TEMPLATE/ you copy to start the next one, an _ARCHIVED/ you park old stuff in, and a CLAUDE.md that makes the convention machine-readable. The trick that makes it stick: templates use <angle-bracket-slots> , and "done" is a grep that returns nothing. I had course material scattered across repos — planning notes here, marketing copy there, facilitator run-sheets in a third place. Every new course started from a blank page, and I re-invented the folder layout each time. So I collapsed everything into one monorepo with a single rule: every course has the identical shape. The lifecycle, as folders The insight isn't "use folders" — it's that a course has a lifecycle , and numbered folders make that lifecycle the primary axis instead of file type. Plan it, sell it, teach it, run it, follow up. Five stages, always in order: Folder Stage What lives here 00-planning/ Prepare Syllabus (source of truth), specs 01-marketing/ Sell Positioning master + channel assets 02-content/ Teach Modules, one file each 03-delivery/ Run Run-sheet, pre-flight checklist, fallback plan 04-post-training/ Follow up Feedback form, follow-up email, post-mortem The numeric prefix isn't decoration. It forces sort order to match the actual workflow, so the folder listing reads like the process itself. Same reason migration files are timestamped — order is information. <course>/ 00-planning/ -> derives everything below 01-marketing/ 02-content/ 03-delivery/ 04-post-training/ --. post-mortem findings | ^------------------' feed back into 00..03 That loop at the end matters: the post-mortem doesn't sit in a graveyard folder. Its findings flow back into the syllabus, the run-sheet, the marketing. The structure runs the same feedback loop it's supposed to teach. _TEMPLATE/ : a course starts as a copy Starting a new course is one line: cp -r _TEMPLATE my-new-cou

why-we-open-sour-c1f013bf.webp alt: Building Digital Identity Tools - Why We Open-Sourced Our SSI SDK relative: false Self-Sovereign Identity (SSI) is a framework that allows individuals and organizations to control their own digital identities and share verified credentials without relying on a central authority. This paradigm shift empowers users with greater privacy and control over their personal data, while also providing robust mechanisms for verifying the authenticity of credentials. What is Self-Sovereign Identity (SSI)? SSI is built around the concept of decentralized identifiers (DIDs) and verifiable credentials. DIDs are unique identifiers that are controlled by the entity they represent, enabling them to manage their own identity data. Verifiable credentials are digital assertions that can be issued by one party and verified by another, ensuring the authenticity and integrity of the information shared. Why did we open-source the SSI SDK? Open-sourcing the SSI SDK was a strategic decision driven by several factors. First, fostering innovation within the community is crucial for advancing the field of digital identity. By making our SDK available to everyone, we encourage collaboration and experimentation, leading to new ideas and improvements. Second, promoting transparency is essential for building trust in digital identity systems. Open-source projects allow others to inspect the codebase, understand how it works, and identify potential vulnerabilities. This transparency helps build confidence in the security and reliability of the SDK. Finally, enabling a broader community to contribute to and benefit from secure digital identity solutions aligns with our mission to democratize access to these technologies. By lowering the barriers to entry, we hope to empower more developers and organizations to adopt and improve upon our work. What are the key features of the SSI SDK? The SSI SDK provides a comprehensive set of tools for building digital identity app

GitHub热门项目 | A hive mind communication platform | Stars: 3,079 | 2,720 stars this week | 语言: Rust

GitHub热门项目 | Real-time token, cost, and AI limits widget with multi-device sync for Claude Code, Codex, OpenCode, Hermes, OpenClaw, Cursor, Antigravity and more. | 为 AI Tools 打造的即时Token、成本与限额监控桌面组件，支持多设备同步 | Stars: 904 | 199 stars this week | 语言: JavaScript

GitHub热门项目 | RustDesk Server Program | Stars: 10,102 | 10 stars today | 语言: Rust

GitHub热门项目 | CLI proxy that reduces LLM token consumption by 60-90% on common dev commands. Single Rust binary, zero dependencies | Stars: 72,532 | 274 stars today | 语言: Rust

GitHub热门项目 | Empowering everyone to host fast and efficient Minecraft servers. | Stars: 8,141 | 96 stars today | 语言: Rust

GitHub热门项目 | 求是Skill——从经典唯物辩证法与实践哲学中提炼出一条总原则和九大方法论工具武装AI大脑。Qiushi-Skill: Build agents that investigate first, focus on the main contradiction, validate in practice, and keep pushing until the work is actually done. | Stars: 3,597 | 14 stars today | 语言: JavaScript

GitHub热门项目 | Linux, Jenkins, AWS, SRE, Prometheus, Docker, Python, Ansible, Git, Kubernetes, Terraform, OpenStack, SQL, NoSQL, Azure, GCP, DNS, Elastic, Network, Virtualization. DevOps Interview Questions | Stars: 83,310 | 44 stars today | 语言: Python

GitHub热门项目 | A curated list of awesome Claude Skills, resources, and tools for customizing Claude AI workflows | Stars: 68,524 | 155 stars today | 语言: Python

GitHub热门项目 | Easily and securely send things from one computer to another 🐊 📦 | Stars: 37,203 | 737 stars today | 语言: Go

GitHub热门项目 | Kimi Code CLI — The Starting Point for Next-Gen Agents | Stars: 4,473 | 1,352 stars this week | 语言: TypeScript