There are plenty of developers, but only a few problem solvers -- Posting about new tech, ai, php, laravel, DevOps I built https://xitter.cf/t.co/usgoqY7eFB β³π₯
Germany/Regensburg
Joined November 2009
- Tweets16K
- Following655
- Followers627
- Likes7K
π #HarnessRouter Community Edition is a self-hosted, Apache-2.0 #opensource layer that turns existing agent harnesses into pluggable backends behind one API #AIagents #selfhosted
𧩠26 harness bases supported today, including #Codex, #ClaudeCode, Hermes, Pi, DeepSeek Harness, #OpenCode, Kilo Code, Qwen Code, #GeminiCLI, Cline, goose, #Aider and #OpenHands. Switching harness means changing one field: metadata.harness_id
π Implements the Unified Harness Protocol (#UHP), an open, versioned standard whose task surface is compatible with the #OpenAI Responses API, so existing SDKs, streaming parsers and UI components keep working
βοΈ Handles the harness engineering: persistent sessions, streaming progress via server-sent events, file inputs and artifacts, cancellation, structured failures, idempotent retries and W3C trace context propagation
π Project benchmark across eight harness Γ model configurations on one task: cost ranged from 223 down to 0.47 credits (99.8% lower) and latency from 4m 36s to 1m 25s (3.2x faster). The best configuration varies per task
π Secrets passed through env references or vault are redacted from responses, streams, traces and stored records. Sessions run in separate workspaces under separate OS users
π³ One #Docker container bundles Console, Gateway and Runner. Bring your own provider key, no account or bundled model required. Starter kits cover slides, sheets, dashboards and videos, and the optional managed Cloud uses the same API contract
π github.com/HarnessRouter/harβ¦
π€ #Rakazo is an #opensource #AIagents platform for persistent #AI teammates and a #selfhosted assistant you run on your own machine. Available on the web, as an #Electron desktop app, on iPhone and Android. Positioned as an alternative to Grok Bot, OpenClaw and Hermes Agent. Apache-2.0 licensed, currently in beta.
π¬ Once running, it is just chat: set up a bot and manage it from that same conversation. Each bot keeps its own conversations, memory, routines and history.
π₯οΈ Bots get real computers with browser, terminal, file and graphical desktop access. Shared Team Computers or isolated Private computers via #Docker, E2B, Daytona, CreateOS, Box, Railway or a trusted local machine.
π§ Bring your own model credentials through Pi. Bots can delegate work to peer bots or short-lived subagents. Voice mode speaks replies, takes dictation and handles calls with your own ElevenLabs, OpenAI, Cartesia or Fish Audio key.
π App integrations through Composio or Pipedream Connect, plus user-installed Treg, remote #MCP and #OpenAPI tool sources. Connector credentials are encrypted on the server and never returned by the API.
π One-command install from published Docker images (amd64 + arm64), one-click Railway deploy, or a VPS behind HTTPS that you connect to from desktop, mobile or browser. UI available in 9 languages, including Deutsch.
π§ Stack: #TypeScript, React 19, Vite, Tailwind CSS, Hono, oRPC, #PostgreSQL, Prisma, Better Auth, Graphile Worker and Expo.
github.com/elie222/rakazo
Micha(el) Bladowski π©πͺ πΊπ¦ retweeted
π¨New contender for the two Spark categoryπ¨
DeepSeek-V4.1-Flash-1017 on two DGX Sparks: 70.6 tok/s with @bertholomusai's TensorFold recipe.
bertholomus' own EXL3 2.5 bpw quant, one model split across both Sparks (TP2).
The recipe v0.7.2 as of Oct 24, commit 30a5bf9, with the author's sampling and context.
Thinking off for every number here, except the GPQA line marked with thinking.
The recipe wants RDMA GID index 5, which my Sparks did not have, so I gave the link ports IPv4 addresses. One Spark, an ASUS GX10, has an older driver.
Decode, code: 70.5 tok/s
Decode, prose: 70.6 tok/s
500 words: about 10.0 s
Reading a 32K-token prompt: 1,830 tok/s
First token after a 32K prompt: 17.9 s
Four requests at once: 107.4 tok/s in total
Eight requests at once: 106.3 tok/s in total
Context: 1,048,576 tokens, the recipe's setting
Largest context I tested: 131,072 tokens
The recipe runs 4 slots, so with eight requests the rest wait for a free slot.
For scale, bertholomus' 4.0 bpw quant on four Sparks:
Decode, code: 82.8 tok/s
Decode, prose: 80.8 tok/s
Eight requests at once: 141.2 tok/s in total
MMLU-Pro: 62.0% Β± 4.7 points
GPQA Diamond: 43.9% Β± 6.9 points
IFEval: 92.0% Β± 3.8 points
LiveCodeBench: 60.0% Β± 14.5 points
Long text 8K: 67.5% Β± 14.0 points
Long text 32K: 57.5% Β± 14.7 points
GPQA with thinking: 80.0% Β± 13.9 points
Open: MMLU-Pro and GPQA answers were capped at 48 tokens (one letter). Answers that hit a cap count as wrong:
MMLU-Pro: 49 of 400 cut
GPQA Diamond: 46 of 198 cut
Long text: 3 answers cut
LiveCodeBench: 2 answers cut
GPQA with thinking: 5 of 30 cut
Quality and tool calls in Mia's sparkDash 2.50.0:
QA: 89.3% Β± 5.0 points
MMLU: 93.0% Β± 3.0 points
Tool Eval: 93/100
Every number, the exact command and the raw output: niklaslenz.com/v2/deepseek-vβ¦
You can play the world it built there in your browser.
Recipe, quant and TensorFold fork by @bertholomusai. TensorFold engine by @ashxhart. sparkDash by @MiaAI_lab. Model by DeepSeek.
𧩠#OpenUI by #Thesys is an open standard for #GenerativeUI: instead of returning plain text, #ai #LLMs stream a compact language called OpenUI Lang that renders as live UI components while tokens arrive. #opensource under MIT, 13.1k stars on #GitHub.
β‘ Token efficiency: OpenUI Lang uses up to 67% fewer tokens than equivalent #JSON. Measured with tiktoken across seven UI scenarios, it needs 4,800 tokens in total versus 10,180 for Vercel JSON-Render and 9,948 for Thesys C1 JSON. At 60 tok/s that means roughly 4.9s instead of 14.2s.
π How it works: define a component library, generate the system prompt directly from it, send it to the model, stream OpenUI Lang back and render progressively. The model can only output the components you register, with props typed via #Zod schemas.
𧱠A framework-agnostic core powers first-party runtimes for #React, #Vue 3, #Svelte 5 and #Angular. React also ships built-in component libraries (charts, forms, tables, layouts), ready-made chat interfaces and a headless chat package.
π Integrations: #LangChain and #LangGraph agents via AG-UI, assistant-ui, Google's A2UI v1.0 protocol, React Email for model-generated emails, and a browser bundle for CDN, iframe and no-build embeds. Server utilities and optional observability are included.
π Quick start: npx @openuidev/cli@latest create scaffolds a working streaming chat app. An Agent Skill lets #ClaudeCode, Codex, #Cursor and Copilot help build and debug OpenUI apps. Live playground at openui.com.
github.com/thesysdev/openui
π¦ Static site bundles from a #Laravel app #PHP #opensource #webdev
Laravel Export by #Spatie crawls your app and saves every reachable URL as a static HTML page. The entire public folder is added, so CSS, JS and images stay in place. One command: php artisan export
π― Build a blog or site with the Laravel tools you already know, export it and upload it anywhere. No full server to manage. Or edit content in an admin panel like #Filament, #Nova, Wink or Sharp and publish the static result to #Netlify
π·οΈ Crawling is on by default and finds pages automatically. Enable use_streaming to cut memory usage on large sites. Prefer full control? Disable crawl and list exact paths like "/" or "/rss.xml"
π include_files adds folders relative to the app root (default: public). exclude_file_patterns drops files via regex. .php files and mix-manifest.json are excluded by default, so index.php never lands in the export
πΎ Output goes to a Laravel filesystem disk (default: a dist folder). Any driver works, including #S3, to export straight to cloud storage. All content options are also exposed in code via the injectable Exporter class, e.g. paths from Post::all()->pluck('slug')
π§ before and after hooks run any shell command: build assets with Yarn before the export, deploy with the Netlify CLI afterwards. Skip hooks with --skip-deploy, --skip-before, --skip-after or --skip-all
π MIT licensed, 676 stars, installed via #Composer. Zero configuration needed to get started
github.com/spatie/laravel-exβ¦
π #Redis memory tip for #Laravel counters: stop creating one key per counter. 1M posts means 1M keys, and each key carries roughly 50β100+ bytes of overhead, even when the value is a tiny integer. #PHP #performance
β The costly pattern: Redis::incr("post:{$id}:views") plus an expire per key. Simple, but at high cardinality the key structure alone eats hundreds of MB.
β
The leaner pattern: group counters into hashes. Redis::hincrby('posts:views', $id, 1) to write, HGET to read. The per-key overhead gets shared across many fields.
π― The catch: the compact listpack encoding only applies to small hashes (default hash-max-listpack-entries = 128). One giant hash with millions of fields falls back to a regular hashtable. Bucket instead: key "posts:views:" . intdiv($id, 100), field $id % 100.
π Result: often 3β10x less RAM for counters, depending on data shape. Best fit: views, likes, rate limits, per-IP or per-user counters with millions of entries.
β οΈ Trade-offs: TTLs apply to the whole hash, not single fields (Redis 7.4+ adds HEXPIRE for field-level expiry). Laravel's Cache facade has no HINCRBY, so this runs through the Redis facade directly.
π More Laravel Redis patterns (key conventions, TTLs, tags, locks, Cache::flexible): laracopilot.com/blog/laravelβ¦
Micha(el) Bladowski π©πͺ πΊπ¦ retweeted
BBC: Hablaremos con nuestro experto en seguridad de BBC respecto a la vulnerabilidad de PHP.
El experto en seguridad: No sabΓa que PHP existΓa hasta ayer en la maΓ±ana.
π§ #DeepSeek has open-sourced #DeepInfer, the high-performance #inference framework that powers its large-scale production services. The release covers offline inference with the core features needed for serving at scale, currently for DeepSeek-V4.1-Flash #opensource #LLM
β‘ Optimized kernels from DeepSeek's own stack: #FlashMLA, #DeepGEMM, #DeepEP, TileKernels, DeepSelect and custom #TileLang kernels, plus an optimized model and sampler runtime
π Parallelism via Attention DP / balanced context parallelism and #MoE expert parallelism with EPLB load balancing. Asynchronous scheduling overlaps CPU batch scheduling with device execution and is on by default
π― Faster decoding with DSpark draft tokens and confidence-scheduled verification (default max draft length: 5). SWA bounded replay cuts decoder prefill work by replaying only a bounded suffix
π Batch-invariant inference keeps results identical across batch compositions, deterministic sampling returns identical outputs for identical inputs and seeds (both NVIDIA only). Structured outputs constrain generation to regex, JSON schema or EBNF grammar
π₯οΈ Hardware: #NVIDIA SM100 GPUs and #Huawei Ascend 950 NPUs. Requires Linux, GCC 13+, #Python 3.12 and #CUDA 13 or CANN 9.2. Benchmarks were measured on 4 SM100 GPUs for prefill and 64 for decode
𧩠Not included: a KV cache system, prefill/decode disaggregation and load balancing across data-parallel replicas. Originally built on #vLLM with inspiration from #SGLang and TensorRT-LLM. Apache 2.0 license
π github.com/deepseek-ai/DeepIβ¦
Micha(el) Bladowski π©πͺ πΊπ¦ retweeted
Rubyβs turn π
Remember the GitLab bug? Well now it moved upstream into Ruby.
Multiple 10.0 CRITICAL exploits.
Patch now π¨
Happy Friday π€
ruby-lang.org/en/news/2026/1β¦
Micha(el) Bladowski π©πͺ πΊπ¦ retweeted
If you updated PHP versions 5.6, 7.0 or 7.1 from OndΕej's repo on Wednesday, consider another upgrade ASAP: the package update from last night fixes a few more multipart-upload fixes π¨
$ apt update
$ apt upgrade
And errr ... consider moving to PHP 8.x π¬
π§ #doubleAI, a Tel Aviv startup founded in 2023, has launched #Maxwell, a code execution model (CEM) that evaluates, optimizes and rewrites binary code while a program is running. Source code stays untouched. #AI #LLM #performance
βοΈ Unlike a #JIT compiler, Maxwell reasons at a higher level and can swap out entire algorithms, e.g. replacing a general-purpose sort with a better-suited one. It sees the exact hardware, the real data shapes and types, and live bottlenecks, and keeps optimizing continuously.
β
Every rewrite is backed by #FormalVerification: Maxwell produces proofs that the replacement code is equivalent. The same process can prove the absence of memory errors; doubleAI says it found memory-safety issues in #Python itself this way.
π Claimed results: data pipelines more than 38x faster, AI inference kernels more than 4.5x faster. The 4K video model LTX-2.5 ran nearly twice as fast after Maxwell cut data exchange between GPUs and dropped unnecessary token padding.
π Best fit is algorithmic code that can be tailored to hardware, but plain #Python and #PyTorch graphs also benefit, since the company says they are often far from optimal even under Torch's compiler.
π§ Tracing and profiling overhead is capped at 2%, zero when idle. Setup: install the runtime, run your code. The model is hosted by doubleAI, so some trust is required.
π theregister.com/ai-and-ml/20β¦
π¨ Critical auth bypass in #Laravel's token API guard (CVSS 9.2): on #MySQL and #MariaDB, an unauthenticated attacker could log in as an existing user without knowing their API token #PHP #infosec
π The bug sits in Illuminate\Auth\TokenGuard, the class behind the "token" guard driver. A crafted non-string credential slipped past the guard and made the lookup query match an unintended user record instead of failing authentication
π§ Root cause: the guard only checked that the token was not empty. The fix adds an is_string() check to both user() and validate(), so arrays and other non-string values are rejected before any database query runs
π― Affected: apps with a guard using 'driver' => 'token' in config/auth.php. #Sanctum and #Passport register their own guard drivers and are not listed in the advisory (GHSA-f9x3-7vq9-cph6). Reported by Hristijan Manasijev
β οΈ Second advisory, same day: GHSA-5wcm-3v2w-8362 (CVSS 6.5) in the JSON:API resources added in Laravel 12.45. A crafted request to a read-only endpoint could trigger a destructive operation and empty a related table
π¦ Patched in Laravel 12.68.0 and 13.29.0, both released August 25, 2026. The JSON:API issue is fixed from 13.27.0 on the 13.x branch. Patches exist only for 12.x and 13.x
β
To do: run composer update laravel/framework, check config/auth.php for token guards (top priority on MySQL/MariaDB), and run composer audit against published advisories
laravel-news.com/laravel-tokβ¦
π§Ή #LaravelFmt is a code formatter for #Laravel, written in #golang. It formats #PHP, Blade and Livewire 4 files with #TailwindCSS class sorting. No Node, no Prettier plugin, only PHP 8.3+ required
π¦ Installed via Composer as a dev dependency. Currently in public beta (v0.4.0), open source under the MIT license
π Covered file types: PHP (sorted and split imports, trailing ?> removed), Blade echoes, directives and @php blocks, Livewire 4 single-file components, HTML, CSS, Alpine.js expressions, Markdown, JSON, YAML and XML
βοΈ Adopts existing settings from Pint, PHP-CS-Fixer, Mago, EditorConfig and Prettier config files. An init command generates a dedicated config file when needed
π¨ Blade-aware Tailwind sorting: in dynamic classes like bg-{{ $color }}-500 the partial class is pinned in place. The @theme block is loaded first, so custom classes like bg-brand sort alongside the built-in colors
π‘οΈ Alpine attributes get canonical spacing. The rewritten output is verified token by token, and the original is kept if anything moved
β‘ Runs in parallel across all CPU cores while returning results in input order, so --check output stays identical on every run
π Built-in Language Server (laravel-fmt lsp) for format on save and format selection, plus --stdin-filepath for editors that only pipe a buffer
#Blade #Livewire #AlpineJS #opensource #devtools
π laravel-fmt.com/
Micha(el) Bladowski π©πͺ πΊπ¦ retweeted
For those running older PHP versions, either switch to packages.sury.org or ppa:ondrej/php's, those all have backported fixes for those old versions
ποΈ #MistralAI released #Voxtral 3, a family of speech-to-text and text-to-speech models plus a voice agent SDK that runs listening, reasoning, tool calling and speaking as one real-time streaming pipeline. Target use cases: contact centers, service desks, virtual assistants and hands-free copilots. #VoiceAI #SpeechRecognition #AIAgents
π Voxtral Small Transcribe 3 covers 50+ languages, including all 24 official EU languages, with diarization (who said what) and context biasing for domain vocabulary without fine-tuning. On FLEURS it reaches 4.1% WER, ahead of Gemini 3.5 Transcribe, Scribe v2, GPT Transcribe and Whisper large-v3. The 4B Mini variant costs $0.0035/min.
β‘ Voxtral Realtime Transcribe 3 is built for agents: sub-500ms latency in 35+ languages, native end-of-turn detection from acoustic and semantic signals, so the agent answers fast without cutting users off. Price: $0.008/min.
π£οΈ Voxtral Mini TTS 3 adapts emotion, pace and emphasis to the conversation across 35+ languages and 50+ dialects, with explicit style controls, phoneme hints for unusual names and better handling of numbers, dates and email addresses. Price: $13 per 1M characters.
π Pro Voice reproduces a speaker's character, emotional range and speaking style across languages from 30 minutes of audio, aimed at brand voices and professional use cases.
π€ The voice agent SDK is built on #LiveKit. Stages stream in parallel, so each turn completes in under one second, and the agent stops talking when interrupted. It supports function calling, web search, retrieval, SIP telephony, WebRTC and existing IVR/contact-center software. LLM, voice and language are swappable.
πͺπΊ Voxtral 3 runs via Mistral's EU, US and global API endpoints or self-deployed on-premises, with control over audio retention. Voice agent API: $0.04/min with Mistral Small 4, $0.08/min with a larger model. #DataSovereignty
mistral.ai/news/voxtral-3/
good night π΄
#notai
ALT A serene sunset view over a river framed by a bridge structure and tree-lined banks, creating a peaceful twilight atmosphere.
ALT A serene landscape features a grassy field, trees, and a clear blue sky with clouds. A path runs alongside, with a person walking in the distance.
ALT Vibrant yellow fields under a blue sky dotted with clouds, framed by a dirt road and mountain scenery in the background.
ALT A serene riverside view features a calm waterway, scattered leaves, and a partly cloudy sky, suggesting a peaceful autumn atmosphere.
π© #Anatomy is an #opensource #AgentSkill that explains a technical idea by building it as a real, working object: interactive isometric illustrations of machines and systems in #SVG, with optional #WebGL shaders and 3D effects. Made for #ClaudeCode, also runs in #Antigravity, #OpenCode, #Codex and MiniMax Code.
π‘ The core trick: it invents a physical mechanism whose behavior IS the concept. A cache key that skips unchanged work becomes a pin-tumbler lock that only turns when every pin matches. One GPU context serving many canvases becomes a gantry plotter whose single print head visits 16 wells.
𧱠Each figure is assembled from dozens of small shaded solid parts, framed in a card with title, hint and live readout, and moves with eased motion on pointer and keyboard. Every number shown comes from the same small model that drives the parts.
π¨ Three output kinds: plain SVG (standalone HTML, a single .svg or #React / #NextJS components), SVG + WebGL for fire, water, steam, caustics and glow, and a 3D beta mode where moving parts are re-projected and re-shaded every frame. Light and dark themes, plus printable A4 PDF sheets (poster, technical drawing, explainer).
π Self-verification built in: a geometry audit proves no part passes through another and every overlap is drawn in correct depth order. Headless Chrome scripts capture close-ups of every joint, and a line check fails any line that ends in mid-air.
π§ Install via npx skills add wheresryan22/anatomy -g, then prompt: /anatomy explain how a token bucket rate limiter works. Needs #NodeJS 20.10+ with zero npm dependencies, plus Chrome for the checks.
β οΈ Limits: not a chart library, no people or exact maps, and builds are deliberately slow. 3D mode is beta. MIT licensed, 17.1k stars.
π github.com/wheresryan22/anatβ¦
Micha(el) Bladowski π©πͺ πΊπ¦ retweeted
PHP2Shell: you patched, but were you hit? A read-only triage script for your server π¨
laracraft.tech/en/blog/php2sβ¦
Micha(el) Bladowski π©πͺ πΊπ¦ retweeted
My colleague made a website to check if your website is vulnerable to PHP2Shell: php2shell.aikido.io/
We're also releasing PHP images with backported patches for free: gallery.ecr.aws/aikido-dev/pβ¦
Stay safe!
Micha(el) Bladowski π©πͺ πΊπ¦ retweeted
If you are wondering whether your website is affected, we have packaged a Codex skill to help check.
Point your Codex at this repo to guide you through it: github.com/openai/php2shell-β¦
OpenAI models helped researchersβoperating as part of our Patch the Planet initiativeβdiscover critical security flaws in PHP, an open-source programming language used to run an estimated 70% of websites.
Over the past two months, we led a coalition of maintainers, researchers, and security providers to prepare fixes and protections ahead of disclosure. This duration was necessary because the fix was quite intricate and required a major change to the PHP engine. Every site using PHP can now safely upgrade their version to stay secure, in addition to applying mitigations from various security vendors.
Due to the severity of these flaws and PHPβs widespread use, we consider this bug to be one of the most impactful vulnerabilities in recent memory. It also marks a new phase, where AI can find security bugs with internet-scale impact.
This is an example of the Defenderβs Window in action: to our knowledge, frontier AI was able to find this vulnerability ahead of attackers, giving defenders time to prepare.
openai.com/index/coordinatedβ¦
Readers added context they thought people might want to know
βͺOpenAI may claim a role in the coordinated response and patching process. But the initial discovery and exploit development, however, occurred several months earlier by an independent researcher.β¬
βͺx.com/lcfr_hax/statuβ¦β¬