标签：#us

On May 29, 2026, OpenAI published its Frontier Governance Framework — and most developers moved on to the next item in their feed. That’s a mistake worth correcting. The document doesn’t announce a new model or lower an API price. It describes how OpenAI measures whether its own systems could enable mass-casualty events, what access controls gate who can reach those capabilities, and how this maps to the regulations — the EU AI Act and California’s Transparency in Frontier AI Act — that are actively shaping compliance requirements for any enterprise deploying frontier AI this year. If you build security tools on OpenAI APIs, the framework’s Trusted Access for Cyber program directly affects what your application can and cannot do. If you operate in a regulated environment, the framework is the vendor-side accountability document your compliance team needs to reference. And if you build on frontier models at all, the risk tier system in this framework governs the capability restrictions you will encounter — and, increasingly, what auditors and procurement teams will ask about when vetting your AI vendor stack. What the Framework Actually Is The Frontier Governance Framework is OpenAI’s published methodology for evaluating the risk profile of frontier models before and after deployment. It covers six functional areas: risk assessment and mitigation, model reporting, security risk management, incident response, external expert input, and framework updates. Each area has defined processes, thresholds, and accountability mechanisms. The core architecture is a tier system applied across four risk domains. Each domain is evaluated independently, with tiers reflecting capability levels that could enable specific categories of harm. A model’s rating in any domain determines what deployment controls apply — what gets blocked at the API layer, who gets elevated access, and what triggers an incident response workflow. The framework was published explicitly to align with two regu

All tests run on an 8-year-old MacBook Air. All results from shipping 7 Mac apps as a solo developer. No sponsored opinion. The most common Tauri v2 frustration: you write a command, invoke it from the frontend, and nothing happens. No error. No crash. Just silence. It's almost always permissions. How Tauri v2 permissions work Tauri v2 introduced a capability system. Every plugin action — reading files, executing shell commands, sending notifications — requires an explicit permission declaration in your config. Without the permission, the plugin call fails silently on the frontend. The Rust code never runs. // src-tauri/capabilities/main.json { "identifier" : "main-capability" , "description" : "Permissions for main window" , "windows" : [ "main" ], "permissions" : [ "core:default" , "fs:read-all" , "fs:write-all" , "shell:allow-execute" , "opener:allow-open" , "global-shortcut:allow-register" , "global-shortcut:allow-unregister" ] } Note: As of Tauri v2.1, shell:allow-open is deprecated. Use tauri-plugin-opener and opener:allow-open instead. The debugging flow When a command does nothing: Open DevTools ( Cmd+Option+I in dev mode) — check the console for a rejected Promise or permission error Check your terminal output — the Rust side logs errors directly in the tauri dev terminal; look for lines like [tauri] permission denied or not allowed Enable verbose logging — set RUST_LOG=tauri=debug before running tauri dev for more detailed backend output Check your capabilities file — missing or misspelled permission identifiers are the #1 cause Permission errors in the console typically look like a rejected Promise with a message such as plugin:shell|execute not allowed . The capabilities file is always the first thing to check. Common permissions you'll need "permissions" : [ "core:default" , "fs:read-all" , // read any file "fs:write-all" , // write any file { "identifier" : "shell:allow-execute" , "allow" : [{ "name" : "my-cmd" , "cmd" : "adb" , "args" : true }] }, "op

What is nbwipers? nbwipers is a CLI tool that strips outputs and metadata from Jupyter notebooks before git commit. Written in Rust - faster than nbstripout Supports git clean filter Works with .ipynb files Why use it? Jupyter notebooks store cell outputs inside the .ipynb file (JSON). This causes problems: Noisy diffs - output changes pollute every commit Repo size - images and large outputs bloat the repo Security - sensitive data can leak in outputs (API keys, query results) The solution: strip outputs automatically on git add via a clean filter. Why not nbstripout? nbstripout is written in Python. It is slow - git status , git diff , and git add all became noticeably slow on this repo because nbstripout was invoked for every .ipynb file. The main cause is Python startup time. With 100+ notebooks, nbstripout can take 40+ seconds where a Rust-based tool takes ~1 second. Faster alternatives: Tool Language Notes nbstripout-fast Rust Up to 200x faster; no git filter install support nbwipers Rust Inspired by nbstripout-fast; adds git filter + pyproject.toml config nbwipers is essentially nbstripout-fast with better git integration. Switching to nbwipers fixed the slowness. Setup 1. Install felixgwilliams/nbwipers is now in the aqua registry as of v4.517.0 . Using aqua , add to aqua.yaml : packages : - name : felixgwilliams/nbwipers@v0.6.2 Then run: aqua install 2. Configure git filter Run once per repo (writes to .git/config ): git config filter.nbwipers.clean "nbwipers clean -" git config filter.nbwipers.smudge cat git config filter.nbwipers.required true Or edit .git/config directly: [filter "nbwipers"] clean = nbwipers clean - smudge = cat required = true required = true makes the commit fail if nbwipers is not installed. This prevents accidentally committing outputs. 3. Add .gitattributes In the repo root, add .gitattributes : *.ipynb filter=nbwipers **/.ipynb_checkpoints/*.ipynb !filter **/.virtual_documents/*.ipynb !filter The !filter lines exclude checkpoint an

The Enhanced Games — a singular sporting competition where a majority of the athletes were on performance enhancing drugs — may herald a new business model that the tech industry is ready to embrace.

The Problem We Were Actually Solving I still remember the day our treasure hunt engine started to show its weaknesses. We had been using a custom-built solution written in Java, and it had served us well until our user base grew exponentially. The engine, which relied heavily on recursive searches and dynamic memory allocation, began to cause performance issues and occasional crashes. Our team was under pressure to find a solution that would allow our server to scale without sacrificing the user experience. After some research, I became convinced that Rust was the answer to our problems. Its focus on memory safety and performance seemed like the perfect fit for our needs. What We Tried First (And Why It Failed) Our first attempt at solving the problem was to simply translate our Java code into Rust. We thought that the language's built-in features would automatically solve our performance and memory issues. However, we quickly realized that this approach was not going to work. The Rust compiler was complaining about lifetime issues and borrow checker errors, which we did not fully understand at the time. We spent weeks trying to fix these issues, but our code was still not stable. I recall one particularly frustrating error message from the Rust compiler: error: cannot borrow self.list as mutable because it is also borrowed as immutable. It was then that I realized we needed to take a step back and rethink our approach. The Architecture Decision We decided to start from scratch and redesign our treasure hunt engine with Rust's strengths in mind. We chose to use a graph-based data structure, which allowed us to take advantage of Rust's ownership model and avoid common pitfalls like null pointer dereferences. We also made use of the crossbeam crate for parallelism and the tokio crate for async I/O. This new design required us to think differently about our problem domain, but it ultimately led to a more efficient and scalable solution. I was impressed by the level of

SpaceX already generated one-fifth of its 2025 revenue from government contracts, the company revealed in its IPO filing.

You stopped being the loop Most people use Opus 4.8 the way they used every model before it: open a chat, type a request, watch the cursor, correct it, repeat. That's a conversation. A dynamic workflow is something else entirely. The shift is this: you stop being the loop. Instead, an orchestrator — plain code you control — spawns subagents you design, fanning out work in parallel, running steps in sequence, judging and merging results, and reporting back when the whole thing is done. Opus 4.8 can drive hundreds of parallel subagents inside a single workflow, with effort control per node so cheap steps stay cheap and hard steps think harder. In this tutorial you'll learn the core patterns by building one concrete thing: a pull-request reviewer that fans out across correctness, security, and performance, then adversarially verifies every finding before it reaches you. // You design the shape. The orchestrator runs it. const found = await parallel ( DIMENSIONS . map ( d => () => agent ( d . prompt , { schema : FINDINGS }))) const deduped = dedupeByFileLine ( found . flatMap ( r => r . findings )) const verified = await parallel ( deduped . map ( f => () => agent ( refutePrompt ( f ), { schema : VERDICT }))) const real = verified . filter ( v => v . refuted === false ) By the end you'll know when to reach for parallel() versus pipeline() , how structured output schemas keep subagents composable, and where to set effort per node. The mental model: it's a graph, not a prompt Stop thinking "I send a prompt, I get a completion." Start thinking: an orchestrator runs a workflow graph, and each node is an agent call. The orchestrator is plain code. It decides what runs, in what order, and what to do with each result. Subagents are the leaf workers — each gets a focused prompt, a structured-output schema, and its own effort setting. The unit of work is no longer the prompt; it's the graph. Two primitives compose every graph, and the difference between them is entirely about ba

A child laughs on a playground. Pure. Unbothered. The world owes him nothing yet and he owes it nothing back. Then he grows up. He does everything right. Studies. Works. Sends his resume. Waits. Rejected. Sends it again. Rejected. Again. Rejected. The smile disappears. Not slowly. Suddenly. The day you realize the system was never built for you. An empty stomach has no dignity. A person denied the right to work is not just unemployed, they are being told their existence has no value. That is not a glitch. That is a choice someone made. 72 million rejections per year in the US alone. The algorithm decides in 0.8 seconds. No human ever reads his name. AI did not build this system. Humans did. AI just made the discrimination invisible, scalable, and deniable. So I built BiasLens. Paste your rejection. 30 seconds. Scans for documented discrimination patterns under US employment law. Free. Anonymous. No account. The hardest part was not building the scanner. It was forcing the AI to say "no bias found" when there isn't any, instead of manufacturing injustice to seem useful. How do you stop AI from missing the bias that's actually there, without inventing bias that isn't? I am still solving that. For that child. For every human who deserves to keep smiling. https://biaslens-justice.vercel.app/

Someone named “Squid” seems to be a “ West Country legend .” As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered. Blog moderation policy.

Soon-to-be-laid-off Meta contractors say they’re being treated differently than Mark Zuckerberg’s full-time employees, who stand to receive more generous severance packages.

About 1 in 5 cases were hospitalized and most of those developed complications.

"The crown is a weight that crushes. You'll do things that spell death for all involved."

A book about how AI shapes perceptions of reality came under fire for using AI-generated quotes. Its problems go beyond that.

Anthropic's Mythos model can autonomously find zero-day vulnerabilities. Their CVD disclosure process uses manual SHA-3-512 hash commitments to prove findings existed. I built something that automates that in one line of Python. What AetherProof does One function call generates a 128-byte Ed25519-signed receipt that proves: What model ran — FNV-1a hash of provider/model ID What it produced — hash of the output When — cryptographic nanosecond timestamp Tamper-evident — flip any byte anywhere → INVALID python import aetherproof receipt = aetherproof.for_anthropic( "Find vulnerabilities in this binary.", finding_text, model="claude-mythos-preview" ) receipt.save("CVE-2026-001.receipt") print(receipt.verify()) # True Try it in 30 seconds pip install aetherproof python -c " import aetherproof r = aetherproof.for_anthropic('question', 'answer') print(r.verify()) # True print(r.pretty()) " The unusual part — invisible Unicode watermarking Receipts embed invisibly into any text using Unicode Private Use Area codepoints (U+E000–U+E0FF). AI output carries its own audit trail. Works in any language — Arabic, Chinese, Devanagari, Hebrew, Thai, Japanese all tested. signed_output = aetherproof.embed(ai_response, receipt.to_bytes()) # Text looks identical. Receipt is inside. aetherproof.verify_embedded(signed_output) # True Numbers 187 tests, 0 failures 128/128 byte flips all detected 1000/1000 tamper probes pass Cross-language: Python generates, Rust CLI verifies 15,446 receipts/sec (Python) · 5,472/sec (Rust) Why AGPL-3.0 Free for open source. Commercial use needs a license. This is the compliance layer under your AI stack — it should be open, auditable, and not vendor-locked. GitHub https://github.com/pulkit6732/aetherproof Built by Pulkit. Feedback welcome.

Meet Halimun Proxy a high-performance, ultra-low latency proxy tunnel system built from the ground up in Rust. Why Rust? By leveraging Rust , Halimun achieves extreme efficiency. Using the Axum web framework and Tokio for non-blocking asynchronous I/O, it manages to maintain a tiny footprint—running on as little as ~15MB of RAM . It’s designed to be fast, memory-safe, and incredibly stable under load. Core Security Features Halimun isn't just a proxy; it’s a security layer. It enforces strict request validation to ensure your internal services are never exposed to malicious actors: AES-256-CBC Encryption: End-to-end payload masking. Even if your traffic is intercepted, the actual API endpoint and data remain indecipherable. HMAC-SHA256 Integrity: Validates that data hasn't been tampered with in transit. Replay Attack Prevention: Uses Nonce and timestamp verification in-memory (via DashMap ) to reject duplicate spoofed requests. SSRF Protection: Built-in mechanisms to prevent attackers from targeting your internal network infrastructure (e.g., 127.0.0.1 ). Camouflage Routing: It hides your actual API structure behind random, dummy URL segments, making traffic profiling by WAFs or human analysts nearly impossible. Quick Start (Docker) Halimun is "Docker-ready," making it easy to drop into any existing infrastructure. 1. Configuration First, generate your encryption keys using the built-in generator: # Generate keys and save to .env docker build -t halimun-proxy . docker run --rm halimun-proxy ./halimun-proxy --keygen --format = env > .env 2. Deployment Configure your config.yaml to map your backend services, then launch your cluster: docker-compose up -d Your production proxy is now live, listening securely on port 80 while your backend services remain completely secluded within a private Docker network. Under the Hood: Request Lifecycle Halimun uses an encrypted tunnel approach. A typical request follows this structure: POST /proxy/1/SEGMENT1/SEGMENT2/SEGMENT3/SEGMEN

Pope Leo XIV may not be able to disarm AI, but he’s got the attention of the industry.

GitHub热门项目 | A data visualization and analytics component, especially well-suited for large and/or streaming datasets. | Stars: 10,909 | 283 stars this week | 语言: Rust

GitHub热门项目 | Portable DNS resolver in Rust — .numa local domains, ad blocking, developer overrides | Stars: 1,229 | 27 stars today | 语言: Rust

GitHub热门项目 | ⭐️ A cross-platform CLI All-in-One assistant tool for Claude Code, Codex & Gemini CLI. | Stars: 3,041 | 23 stars today | 语言: Rust

GitHub热门项目 | Code at the speed of thought – Zed is a high-performance, multiplayer code editor from the creators of Atom and Tree-sitter. | Stars: 84,059 | 102 stars today | 语言: Rust