Tootfinder

Not bad, not bad:
Uses some new Swift 6.2, 6.4 APIs:

from my link log —
Dark side of POSIX APIs: handling siginfo_t in Rust.
https://vorner.github.io/2021/01/03/dark-side-of-posix-apis.html
saved 2021-01-08

Folks tying their businesses to the APIs of Anthropic, OpenAI, etc., are this generation’s Twitter client developers.
(Maybe look into recent history to see what Twitter eventually did and what happened to them. Rule of thumb: an API key is a key to a door you don’t own whose lock can be changed at any time.)

🔢 With "use native_types", int, float and bool map to C int64_t, double and bool. Strongly-typed std::vector, std::map and std::ordered_map containers run up to 10× faster than PHP arrays
🧮 High-precision numerics built in: bigInt (GMP), decimal (libmpdec) and bigFloat (MPFR) with typed operators and method APIs

Siri AI spricht erstmals mit Dritt-Apps – Beta 3 zeigt Apples Strategie
Erste Tests von iOS 27 Beta 3 zeigen: Siri AI kann bereits Informationen aus Drittanbieter-Apps abrufen. Apple profitiert dabei von vorhandenen APIs.

Siri AI spricht erstmals mit Dritt-Apps – Beta 3 zeigt Apples Strategie
Erste Tests von iOS 27 Beta 3 zeigen: Siri AI kann bereits Informationen aus Drittanbieter-Apps abrufen. Apple profitiert dabei von vorhandenen APIs.

Nearly 5 years of work later, I've successfully closed the Node.js TLS fingerprinting issue: https://github.com/nodejs/node/issues/41112.
As of Node 26.4.0, it's possible to match most common TLS fingerprints in Node directly. I've published a library to do all the hard wo…

from my link log —
How io_uring and eBPF will revolutionize programming in Linux.
https://www.scylladb.com/2020/05/05/how-io_uring-and-ebpf-will-revolutionize-programming-in-linux/
saved 2020-11-26

How io_uring and eBPF Will Revolutionize Programming in Linux
ScyllaDB's Glauber Costa explains how two new APIs, io_uring and eBPF, are changing the fundamental nature of Linux programming.

Cloudflare announces Cloudflare Wallets for users to pay for APIs and content via stablecoins, with the ability to create virtual wallets for agentic shopping (Jeff John Roberts/Fortune)
https://fortune.com/2026/08/04/cloudflare-ai-agents-wallets-id/

Cloudflare just launched a permanent ID tool and wallet for AI shopping
The new service makes it easier for consumers to equip AI agents with tools that let them spend and to identity themselves to merchants' agents.

Honey bees can serve as sentinels for environmental health #environment

Honey bees can serve as sentinels for environmental health
Honey bees (Apis mellifera) are widely known as essential pollinators, but researchers using a "One Health" approach have also identified them as biological sentinels of environmental health. Honey bees continuously interact with their surrounding environment through the collection of nectar, pollen and water and can therefore be exposed to contaminants present in agricultural and natural ecosystems. Their health may consequently provide valuable information about environmental pressures affect…

Not bad, not bad:
Uses some new Swift 6.2, 6.4 APIs:

What do you think about #AI? On possible parallels with symbiogenesis, kleptoplasty, APIs, higher-order entities, and more... https://robtow.substack.com/p/what-do-you-think-about-ai by

What Do You Think About AI?
Rob Tow · Nova Lux, New Mexico, USA, Sol III · 6 September 2026

anyone know any public #invidious instances with open APIs? boosts appreciated!

anyone know any public #invidious instances with open APIs? boosts appreciated!

Continuing to make progress on the new input validation flow.
Anybody have feedback? I'm open to tweaking the UI although I think the backend APIs and data model are reasonably final

We are quickly arriving at the time where we can run models on local hardware that rival some of the largest datacenter based models from a few months ago. A lot of companies will start building and using these in their own infrastructure to provide cheap local AI services instead of expensive BigTech APIs.
https://simo…

Qwen 3.8 27B is excellent, but it defaults to wildly overthinking things
Friday’s big release was Qwen 3.8 27B, an Apache 2 licensed 27B parameter vision-capable LLM from Alibaba’s Qwen research lab. I’ve been looking forward to this one: 27B is an …

@… Yes, apps can track uninstalls, by detecting a specific error code sent back by the push notification APIs on iOS and Android.
Try CoMaps/Organic Maps or Magic Earth.

🚀 Programmatic access via REST APIs and the NocoDB SDK. Requests are authorized with JWT or social auth tokens.
🐳 Runs from a single #Docker command with SQLite or #PostgreSQL. An auto-upstall script installs Docker Compose, Redis and Traefik, and sets up plus renews SSL automatically.…

🔨 Skill Forge explores a site once, discovers its APIs and data patterns, then generates a deploy-ready skill package that runs at scale without re-exploration
📦 A solutions catalog ships 30 pre-built skills for sites like Amazon, Google Maps, YouTube and Reddit
💻 Runs on Windows, macOS and Linux with any agent that can execute shell commands. MIT licensed, most features free

When I was advocating for nogil/free-threading, I always said that it’s important not to judge threads by the APIs we have, but by the APIs we will build once they’re worth the trouble.
Here’s my first contribution: a way to run fault-tolerant background threads with PostgreSQL-based¹ orchestration: lease-based leader election & NOTIFY dispatch.
Hope you like it—it fell out of 2 other projects I want to open-source eventually.
¹ requires @…, SQLAlchemy optional
https://github.com/hynek/pgbg

Leaky Language Models: Stealing Architecture and Inference Optimizations via Per-Token Timing
Sadegh Majidi, Niloofar Mireshghallah, Kazem Taram
https://arxiv.org/abs/2607.20723 https://arxiv.org/pdf/2607.20723 https://arxiv.org/html/2607.20723
arXiv:2607.20723v1 Announce Type: new
Abstract: This work presents LeakyLMs, a set of attacks that leak proprietary model, architecture, and deployment information from production language models. LeakyLMs is the first to demonstrate that key model and deployment details can be inferred using only token generation timing, even when interacting through remote APIs. LeakyLMs introduces two core attacks. The first attack targets inference optimizations and deployment strategies. For example, our attack detects whether a provider uses speculative decoding, a widely deployed inference-time optimization, and further identifies the context length of the draft model used in the pipeline. Our measurements show that Google Gemini Flash 2.5 uses speculative decoding with a draft context window of approximately 128K tokens. The second attack recovers key architectural properties, including the number of transformer layers, hidden dimension size, and number of attention heads. To achieve this, LeakyLMs builds a detailed and accurate model of token-generation timing on modern NVIDIA GPUs, characterizing how latency scales with model configuration and hardware parameters. The attack then performs a search over the architecture space using this timing model. In experiments with Llama models, the near-correct architectural configuration appears in the top-10 guesses more than 90% of the time.
toXiv_bot_toot

"In most languages, metaprogramming lives in a separate layer with its own representation of code like templates, reflection APIs, token streams, quasi-quoted ASTs. Some of those layers are crude and some are genuinely sophisticated, but each is a wall between code and data. In Elisp there was never a wall to tunnel through. Elisp enables metaprogramming, but it's the same language, and the same data structures, all the way down." - Charlie Holland
#lisp #elisp #emacslisp
https://www.tumblr.com/teledyn/824127274686234624?source=share

from my link log —
Avoiding overload in AWS distributed systems by putting the smaller service in control.
https://aws.amazon.com/builders-library/avoiding-overload-in-distributed-systems-by-putting-the-smaller…

🛡️ That kills credential exfiltration via prompt injection: an agent cannot leak a secret it never held
🔌 Transparent integration through HTTPS_PROXY and a MITM architecture, so existing MCP servers, CLIs, SDKs and APIs keep working unchanged

Decode-Time Grammars: Constrained LLM Generation over a Refinement Order of Grammar Fragments
Shuoming Zhang, Ruiyuan Xu, Haofeng Li, Qiuchu Yu, Yangyu Zhang, Chunwei Xia, Xiaobing Feng, Chenxi Wang, Huimin Cui, Jiacheng Zhao
https://arxiv.org/abs/2607.18357 https://arxiv.org/pdf/2607.18357 https://arxiv.org/html/2607.18357
arXiv:2607.18357v1 Announce Type: new
Abstract: Large language models now write a growing share of the world's code, increasingly inside agents and serving systems that compile, execute, or dispatch generated code without line-by-line review. This works well for mainstream languages but remains brittle for low-resource programming surfaces such as domain-specific languages, custom library APIs, and command-line tools. Even under grammar-constrained decoding, a model can still produce references invalid in the current environment: a buffer never declared, a column absent from the schema, a function the library does not provide, or an unsupported CLI option.
This paper introduces decode-time grammars: grammar fragments instantiated during generation from a runtime environment Gamma. A region-specific policy selects a fragment for each hole, and a tightening operator replaces open reference positions with Gamma-typed slots whose candidates are exactly the names, fields, APIs, or options available at that point. Newly generated declarations enter Gamma before later regions are decoded, so the constraining grammar can depend on the prefix already generated. This ensures not only grammatical correctness but also semantic correctness, by preventing references to undefined symbols.
We formalize grammar fragments as environment-indexed grammars ordered by refinement, prove No-Ghost soundness for Gamma-slotted fragments, show that refinement preserves this support-set guarantee, and characterize the boundary of mask-enforceable properties. We implement the approach in gproj with offline grammar induction and online policy resolution. Across TileLang, SQL, and P4, with models from 0.6B to 236B parameters, gproj eliminates ghost references by construction at moderate overhead over standard constrained decoding.
toXiv_bot_toot

⚠️ Current drawbacks: still public preview, APIs may change, Node.js 22 required & local mock implementations may behave differently from real AWS resources
📊 The real positioning: Blocks competes less as "yet another framework" and more as an alternative to #AWSAmplify, #Supabase

Buzz to Boom: Detecting Message Progression Vulnerabilities in Electron Applications via Segmented Directed Fuzzing
Jianjia Yu, Zhengyu Liu, Ziyang Li, Yu Sun, Yinzhi Cao
https://arxiv.org/abs/2607.20698 https://arxiv.org/pdf/2607.20698 https://arxiv.org/html/2607.20698
arXiv:2607.20698v1 Announce Type: new
Abstract: Electron is a popular framework for building cross-platform desktop applications using web technologies. Such applications consist of multiple processes with different privilege levels that communicate via message passing. When inter-process messages carry attacker-controlled inputs, they can propagate across processes and reach privileged APIs, e.g., command execution. Such a message propagation behavior is characterized as Message Progression Vulnerabilities (MPVs). The exploitation of MPVs is challenging because it often requires multiple steps, e.g., first arbitrary code execution in one process via message passing, and then command injection in another process using another message crafted in the first process. To our knowledge, existing works on Electron security only study unsafe configurations and malicious Document Object Model (DOM) content, i.e., they cannot detect or exploit these vulnerabilities that need to be triggered by complex cross-process exploits via message passing. We present Proton, a segmented directed fuzzing framework for detecting MPVs. Our key insight is to decompose end-to-end fuzzing into per-process segments along message-passing boundaries, where the goals of fuzzing each segment are either: (i) reaching a sink in the current process or (ii) propagating the payload to the next process, to enable the exploration of another process. In the second case, the messages seed the corpus of the next segment. Finally, Proton synthesizes crash inputs from each process to validate end-to-end exploits. We evaluate Proton against 589 real-world Electron applications, resulting in 23 zero-day MPVs. Among them, 22 lead to OS command execution, including projects with over 50k GitHub stars. We responsibly disclosed all findings. To date, we have received 13 acknowledgments, 11 fixes, and 11 CVEs, including a bug bounty from Vercel.
toXiv_bot_toot

🧮 cuda.compute brings parallel algorithms from the CUDA Core Compute Libraries: sort, scan, reduce, transform, unique, histogram, top-k
🔧 cuda.bindings offers direct bindings for all C APIs, cuda-pathfinder detects installed CUDA components, nvmath-python adds math libraries

The release of cpe-editor v1.1.0
https://github.com/gcve-eu/cpe-editor/releases/tag/v1.1.0
CPE Editor v1.1.0 is a substantial feature and operations release focused on making curated CPE data easier to explore, review, publish, and run in production. It expands the public contribution workflow, adds richer APIs and feeds, improves dataset portability, and delivers major performance and reliability improvements for larger catalogs.
@…

RE: https://mastodon.social/@glyph/116788242133509166
It's inherent to LLMs that they produce garbage—it's not fixable, because text generation based on statistics has no concept of right or wrong or true or false.
Therefore it's only (partially) useful in a small subset of use cases that have other ways of enforcing veracity—namely programming, by literally looping over itself until the code is syntactically correct, it doesn't call non-existing APIs and the expected output for a specific input happens.*
Even then the code may 1. only cover the specific test cases asked of the LLM and fail for others or 2. the LLM may get stuck in an endless loop if it can't get the code to run or work.
*The programming use case also has a lot of other intrinsic and extrinsic factors that make it work better than most other text generation applications; for example a large amount of training data of mostly working code and that the languages being generated are both many orders of magnitude simpler in structure than human languages and mathematically unambiguous.**
**Except for Perl of course

IssueTrojanBench: Benchmarking AI Coding Agents Against Malicious Issue Requests
Ankur Singh, Jinqiu Yang, Tse-Hsun Chen
https://arxiv.org/abs/2607.20759 https://arxiv.org/pdf/2607.20759 https://arxiv.org/html/2607.20759
arXiv:2607.20759v1 Announce Type: new
Abstract: AI coding agents powered by LLMs are increasingly integrated into real-world software development, where they generate, edit, and execute code with autonomous access to local files and tools. Coding agents inherit security risks from both the LLM backbone, where adversarial prompts, poisoned training data, and backdoor triggers can cause models to emit insecure or attacker-chosen code, and their agentic architecture, where tool-using autonomy enables induced misuse of external APIs, data exfiltration, and persistent compromise of development environments. This paper presents a systematic evaluation of malicious issue requests against state-of-the-art coding agents (Cursor, Claude Code, and Codex Desktop), powered by two major model families (OpenAI GPT-5.3 Codex/GPT-5.4 and Anthropic Sonnet 4.6). Our novel benchmark IssueTrojanBench contains malicious issues that are constructed based on four novel attack categories (i.e., embedded as malicious instructions in issues), six delivery vectors (e.g., PDF, or issue comment), and further augmented by perturbations. Our results reveal critical vulnerabilities in the as-deployed modern coding agents, i.e., 66.5% of the malicious issues from IssueTrojanBench penetrate all the guardrails (agent- and LLM-level) of coding agents. Our further analysis shows that rejection is almost entirely from LLMs rather than the agent frameworks, with GPT models broadly vulnerable and Sonnet 4.6 exhibiting more selective, risk-aware blocking of high-impact actions. Our evaluation also highlights that the current agent-level defense strategy offers limited additional protection for coding agents. Our findings highlight the urgent need for stronger agent- and model-level safety mechanisms to protect AI coding agents.
toXiv_bot_toot

AuthProbe: Specification-Driven, Multi-Identity Detection of Broken Object-Level Authorization in Recruitment API
Jay Barach
https://arxiv.org/abs/2607.20574 https://arxiv.org/pdf/2607.20574 https://arxiv.org/html/2607.20574
arXiv:2607.20574v1 Announce Type: new
Abstract: Broken Object-Level Authorization (BOLA), also known as Insecure Direct Object Reference (IDOR), has topped the OWASP API Security ranking since 2019 and is the root cause of some of the largest exposures of applicant data in recruitment technology. The defining feature of this flaw class is that a malicious request is byte-for-byte indistinguishable from a legitimate one, which is precisely why web application firewalls and single identity scanners fail to catch it. We present AuthProbe, an open-source, black-box scanner that detects BOLA and IDOR in HTTP APIs by driving its tests from an OpenAPI specification and by acting under two or more identities that the operator controls. AuthProbe discovers, for each identity, the objects that identity legitimately owns, then attempts to read one identity's objects while authenticated as another and confirms a leak by comparing the response against a ground-truth fetch by the true owner. It also walks predictable identifiers to expose enumeration and reports missing authentication and existence oracles. The tool returns a severity-thresholded exit code and machine-readable reports so that it can gate a continuous integration build. On a synthetic recruitment API in which the McHire failure class is reproduced, AuthProbe detects every planted cross-identity read with no false positives on a hardened counterpart, and its running time grows linearly with the number of objects under test. AuthProbe is released under the Apache 2.0 license with an authorized-use guardrail.
toXiv_bot_toot

Generalized Constraint Projection: Four-Dimensional Type Inference for Dynamic Languages
Qunhui Zhang
https://arxiv.org/abs/2607.19693 https://arxiv.org/pdf/2607.19693 https://arxiv.org/html/2607.19693
arXiv:2607.19693v1 Announce Type: new
Abstract: Type inference for dynamically typed languages must reconcile four distinct sources of evidence for function parameters: internal assignments, explicit declarations, contextual requirements, and structural operations. Existing systems often merge these sources into one constraint set, causing spurious conflicts or requiring redundant annotations. We present Generalized Constraint Projection (GCP), a zero-annotation inference framework that stores the four sources in separate monotone slots on a stable definition-time template and checks each call in a fresh projection session. Ordinary calls verify concrete arguments and specialize return types without modifying the template, while currying produces residual projected functions. GCP uses Outline Equational Matching (OEM), a structural compatibility preorder with an open bidirectional delegation protocol, and future this, a receiver-preserving extension for subtype-refining fluent APIs. On the strict success fragment of a finite-height type preorder, we prove monotonicity, local and global convergence in $O(Nh_T)$ effective updates, conditional projection-obligation soundness, projection termination, multi-module convergence, and order independence under fair monotone iteration. For the pure, recursion-free core Outline0, we additionally prove big-step evaluation definedness, type preservation, runtime receiver retention, and projection-evaluation coherence. We instantiate GCP in the Outline dynamic language as a typed substrate for ontology worlds and apply it to unannotated Python source to recover PEP 484 annotations for downstream compilation.
toXiv_bot_toot

🔄 On deployment, the same APIs map automatically to real AWS services like #Lambda, #DynamoDB, #Aurora, #APIGateway