lcanello

Personal site of lcanello

← home

tag: open-source

nCPU

A neural network implemented as a CPU architecture — neurons as registers, synapses as instructions.

FireRedVAD

Lightweight voice activity detection model from FireRedTeam, optimized for real-time audio stream processing.

Chrome DevTools MCP

MCP server that lets coding agents control and inspect a live Chrome browser for automation, debugging, screenshots, network analysis, and performance tracing.

autoresearch

Karpathy's experiment giving an AI agent a single-GPU LLM training setup and letting it run autonomous overnight research — it modifies code, trains for 5 minutes, checks if the result improved, and repeats.

DungBeetle

Lightweight distributed job server for queuing and asynchronously executing heavy SQL read jobs — supports MySQL, PostgreSQL, and ClickHouse as sources, writes results to ephemeral result databases, and exposes an HTTP API for job and group management.

Google Workspace CLI (gws)

One CLI for all of Google Workspace — Drive, Gmail, Calendar, Sheets, and more. Dynamically built from Google's own Discovery Service at runtime, with structured JSON output and 100+ bundled AI agent skills.

T3 Code

Minimal web GUI and desktop app for coding agents — currently Codex-first, with Claude Code support on the way.

Feather.js

A blog post covering Feather.js, a lightweight open-source web framework for building real-time applications and REST APIs with a simple, service-oriented architecture.

Cisco ExaNIC Software

Drivers, utilities and development libraries for Exablaze ultra-low-latency network cards (ExaNIC X25, ExaNIC X100, ExaNIC X10, ExaNIC X40, ExaNIC X2, ExaNIC X4, ExaNIC V5P, ExaNIC V9P, ExaNIC GM, and ExaNIC HPT).

OpenBrand

An open-source AI-powered tool for generating and managing brand identities, helping teams create consistent brand guidelines, logos, and visual assets.

dineug/erd-editor

Open-source Entity-Relationship Diagram Editor with PWA offline support, real-time collaboration, end-to-end encryption, and local-first autosave.

OpenBrand

OpenBrand extracts brand assets from a website, including logos, colors, and images, with options for API access, agent integrations, self-hosting, and MCP.

PHOBOS — VANTA OS (mystyy01/PHOBOS)

PHOBOS (VANTA OS) is a small, hobbyist bare‑metal operating system project: custom bootloader and kernel written from scratch (C + assembly), kernel modules in a homegrown language, and minimal tooling for x86/x64 targets. Good reference for low‑level OS experimentation and teaching.

three.wasm

Repository with WebAssembly experiments and bindings for Three.js — enables high-performance 3D rendering and integrations using wasm in the browser, with examples and tooling for developers.

aquasecurity/trivy

Trivy — open-source vulnerability and misconfiguration scanner for containers, IaC, repositories and runtime environments. Repository with code, documentation, and integrations for CI/CD security scanning.

AutoResearchClaw

Autonomous, collaborative, self-evolving research pipeline that turns a topic into a paper with literature search, sandbox experiments, peer review, LaTeX export, and optional human-in-the-loop co-pilot modes.

Caveman

Claude Code skill/plugin and Codex plugin that makes the agent talk like caveman, cutting output tokens while preserving technical accuracy; includes a companion tool to compress memory files and reduce input tokens.

Magika

Google’s AI-powered file type detection tool, with fast on-device inference and bindings for multiple languages.

OpenSnitch

OpenSnitch is a GNU/Linux application firewall for monitoring and controlling outbound connections, with GUI-based nftables configuration and centralized management.

Aegisub

Aegisub is a free, cross-platform open source subtitle editor for timing and styling subtitles with audio and real-time video preview.

grove

Grove is a distributed ML training tool for MacBooks that discovers nearby peers automatically and synchronizes training across devices with minimal setup.

HY-World 2.0

HY-World 2.0 is a multimodal world model for reconstructing, generating, and simulating 3D worlds, with open-source code and models for world reconstruction.

Hyperframes

Hyperframes is an open-source HTML-native video rendering framework built for agents, with deterministic rendering, browser preview, and MP4 output.

rvLLM

rvLLM is a high-performance LLM inference engine in Rust, with TPU and GPU backends, benchmark-heavy optimization work, and a drop-in vLLM replacement goal.

infra-ansible

infra-ansible is an Ansible repository for provisioning and automating infrastructure components such as DNS, DHCP, OpenStack, storage, bastions, and identity-managed hosts.

Kimi K2.6

Kimi announces Kimi K2.6, an open-source model focused on coding, long-horizon execution, and agent swarm workflows.

ApiPosture

ApiPosture is an open-source project focused on API posture and security assessment, helping teams evaluate exposed endpoints and improve their API attack surface management.

Alchemy

Open-source AI agent framework for building and running multi-agent systems with dynamic communication, shared memory, and pluggable tools

AMD Gaia

Generative AI Is Awesome — AMD's open-source local AI agent framework for Windows and Linux using the Lemonade SDK to run AI agents across AMD CPUs, GPUs, and NPUs

AMD GAIA 0.17.5

AMD's open-source local AI framework releases 0.17.5 with Gemma 4 E4B as new default model, native OpenAI tool_calls support, and Chat Lite agent for resource-constrained systems

Ghostty Leaving GitHub

Mitchell Hashimoto announces that the Ghostty terminal emulator is leaving GitHub — discussing the reasons behind the migration and what it means for the project's future

NetHack 5.0 Release

NetHack 5.0 — the first major version upgrade in decades of the classic roguelike, with improved UI, QoL features, and new content while keeping the beloved permadeath gameplay

Teemii

Open-source web application — a minimal, clean, and fast platform for managing and sharing links, bookmarks, and notes with a beautiful interface

ratman-tui — A TUI REST Client

ratman-tui is a keyboard-driven, vim-modal REST client built with ratatui+crossterm — boots in <100ms, local forever, no accounts, no SaaS, no Chromium. Import from Postman, tree-shaped collections, 5 panes. `cargo install ratman-tui`

oh-my-openagent v4.0.0 — Team Mode

Major release introducing Team Mode — multiple agents coordinating in parallel via tmux visualization, hyperplan skill (5 hostile agents), security-research skill (3 vuln hunters + 2 PoC engineers), model-specific prompts for GPT-5.2/5.3, hierarchical config discovery, 48k stars

Decepticon

PurpleAILAB's Decepticon — the open-source platform for building and deploying AI agents. Features agent orchestration, multi-modal capabilities, evaluation and monitoring tools, deployment to various platforms including AWS Bedrock, Anthropic, OpenAI, and more

Hunk

Review-first terminal diff viewer for agent-authored changesets — multi-file review stream, inline AI/agent annotations, split/stack/responsive auto layouts, watch mode, integrates with Git/Jujtuu. Built on OpenTUI and Pierre diffs, MIT license

llama-swap

Go-based local model swapping for OpenAI/Anthropic compatible servers — llama.cpp, vllm, stable-diffusion.cpp. Web UI, model hot-swapping, Docker/WinGet/Homebrew install, OpenAI/Anthropic API endpoints

A Few Words on DS4 — DwarfStar 4 by Antirez

Antirez on DwarfStar 4 (DS4), a single-model local AI integration built in one week. Uses DeepSeek v4 Flash with 2/8-bit asymmetric quantization — 96-128GB RAM enough. First time a local model is usable for serious work vs Claude/GPT. Plans: coding agents, distributed inference, model-agnostic architecture

Designing an FPGA Calculator from Scratch — 10-Chapter Series

Scientific BCD calculator with custom CPU on Altera Cyclone II FPGA. 10-chapter series covering numerical algorithms (CORDIC, logarithms), 12-bit instruction set, Harvard memory model, microcode, Python assembler, Qt desktop prototype, and physical board with 3D-printed enclosure. Perfect decimal accuracy, no floating-point errors

sx — Package Manager for AI Coding Assistants

Team vault for AI assets (skills, MCP configs, commands, agents, rules, hooks). Scoped installation per org/repo/team/user/bot. Works with Claude Code, Cursor, GitHub Copilot, Gemini, Codex, Kiro. Manifest-and-lock pattern like npm/cargo. Cloud relay for claude.ai/chatgpt.com

auto-identity-remove — Automated Data Broker Opt-Out Runner

macOS tool that removes your personal info from 500+ people-search sites on a monthly schedule using Playwright, CapSolver for CAPTCHAs, launchd scheduling, and iMessage notifications. Handles 30+ brokers natively plus 470+ generic ones via public datasets — covers Acxiom, LexisNexis, ZoomInfo, Clearbit gaps left by paid services like Incogni

Bitwarden Removes 'Always Free' Plan from Website

Open-source password manager Bitwarden has removed the 'Always Free' plan from its pricing page, though the plan still exists for existing users. Raises questions about Bitwarden's freemium strategy and whether the company is shifting toward paid-only growth. The vault remains open-source (AGPL) and self-hostable

Brotli — Google's Lossless Compression Algorithm

General-purpose lossless compression algorithm developed by Google, designed as a replacement for DEFLATE with better compression ratios. Uses a modified LZ77, Huffman coding, and second-order context modeling. Adopted by nginx, Apache, Cloudflare, and the web ecosystem. Produces .br files. Open source under MIT license

The C10K Problem — Dan Kegel

Landmark 1999 essay arguing web servers should handle 10,000 simultaneous clients. Covers I/O strategies: select/poll, /dev/poll, kqueue, epoll, async I/O, threading models (1:1 vs M:N), zero-copy networking, and userspace TCP stacks. Spawned decades of research into scalable server architecture

CVE-2026-45185 — Single Byte Write RCE in Exim Mail Server

Critical unauthenticated remote code execution in Exim (Debian/Ubuntu) via TLS/GnuTLS connection handling. During TLS session termination, a single byte (0x0a or 0x0d) is written to freed memory via nested BDAT handler calling ungetc(). XBOW discovered the bug; AI (XBOW Native) produced working exploit chains with and without ASLR/PIE

CVE-2026-7270 — How to Get Root on FreeBSD with a Shell Script

AI-assisted kernel bug hunt finding a 13-year-old memmove off-by-one in kern_exec.c (present since 2013). Wrong size: endp - begin_argv + consume instead of - consume, causing 2024-byte OOB into adjacent exec_map entry. Exploit: race-condition LD_PRELOAD injection via sshd-session execve, 4 concurrent components (preseed, SSH poker, trigger pinned to CPU0, checker). Gets root in ~6s on stock FreeBSD. Full PoC at github.com/califio/publications

DOGMA 25 — Filmmaking Movement Founded in Copenhagen 2025

Collective preserving originality of cinema, standing against algorithmic films and ultra-processed consumer goods. "The Vow of Chastity" — 10 rules: handwritten scripts, 50% no dialogue, internet off limits in creative process, max 10 people behind camera, no make-up, everything rented/borrowed/used, one production year, shot where narrative takes place, fund with no content altering conditions, make film as if it were your last

Dorym Small — 10B Parameter LLM Trained on CINECA's Leonardo Supercomputer

Milan-based Domyn releases Dorym Small (10B params), smaller version of Dorym Large (260B). Trained on CINECA's Leonardo HPC (EuroHPC framework), supports 50 languages including Italian. Beats Ministral-3-8B, Llama-3.1-Nemotron-Nano-8B, OLMo-3-7B-Think on some benchmarks. Designed for edge/on-premise deployment, part of IT4LIA AI Factory European sovereign AI initiative

GCVE — Global CVE Allocation System

New decentralized approach to vulnerability identification and numbering (announced April 2025). Introduces GCVE Numbering Authorities (GNAs) that allocate identifiers without centralized block distribution. Compatible with traditional CVE system. Includes BCP series (vulnerability format, decentralized publication, KEV assertion, CPE improvements), db.gcve.eu public advisory database, and Vulnerability-Lookup 4.0

MiniPlasma — CVE-2020-17103 Still Unpatched in cldflt.sys

Weaponized PoC for LPE in cldflt.sys exploiting cldflt!HsmOsBlockPlaceholderAccess — same vulnerability Google Project Zero reported as CVE-2020-17106 six years ago. Original Project Zero PoC works unchanged. All Windows versions affected. Race condition exploitation spawning SYSTEM shell. MIT licensed, 435 stars

PSOS — The Foundations of a Provably Secure Operating System (1979)

Richard Feiertag & Peter Neumann (SRI International). PSOS designed with formal techniques (HDM) — formally stated requirements, formal specifications for each module, formal proofs that specifications satisfy requirements and programs are consistent. Capabilities as protection mechanism for all objects, hierarchical development, SPECIfication and Assertion Language (SPECIAL)

ssh-keysign-pwn — Steal SSH Host Keys and /etc/shadow via ptrace mm-NULL Bypass

Exploits __ptrace_may_access() skipping dumpable check when task->mm == NULL — do_exit() runs exit_mm() before exit_files(), leaving fds open in a race window. pidfd_getfd(2) succeeds when caller uid matches target. CVE-2026-46333. ssh-keysign opens host keys (0600) before permanently_set_uid() with same bug shape since 2002. Fixed by Linus 2026-05-14 (pre-31e62c2ebbfd). Jann Horn flagged in Oct 2020 — six years. 568 stars

LLMs + Vulnerability-Lookup — CIRCL's AI Experiment for Vulnerability Management

CIRCL (Luxembourg) explores LLMs for vulnerability management using 450k rows from Vulnerability-Lookup's million-record dataset. Trained distilbert-based severity classifier and GPT-2 description generator. Daily auto-updating models on Hugging Face, VulnTrain framework, CVSS mapping. Plans: CPE guessing, product/category classification, CWE/ATT&CK tagging, exploitability estimation

2b2t 1m² World Download — 24 TB of Minecraft History

Largest Minecraft world download ever — 1,024,000² Overworld (512k² + 1m²), 256k² End, 100k² Nether. ~24 TB total. Custom zvcr file format, PlaceProxy, BMProxy bots, elytra autopilot. Took 1.5 years development, $3000+ in priority queue costs. CC0 licensed, 121 stars. No AI used. Includes 2b2t Wayback Machine and map viewer at 2b2t.place

hsrs — Type-Safe Haskell Rust Bindings

Rust crate generating type-safe FFI bindings between Rust and Haskell. Annotate Rust types/functions with proc macros (#[hsrs::data_type], #[hsrs::function], etc.), run codegen to produce idiomatic Haskell with ForeignPtr memory management and Borsh serialization. Supports Result→Either, Option→Maybe, Vec→[], String→Text. MIT/Apache-2.0, 21 stars

Mini Shai-Hulud Strikes Again — 317 npm Packages Compromised

npm account `atool` compromised May 19, 2026: 637 malicious versions across 317 packages in 22-minute burst. 498KB obfuscated Bun payload with same scanner architecture as SAP compromise. 10 persistence mechanisms: preinstall hooks, GitHub imposter commits in antvis/G2, CI/CD workflow injection, Claude Code SessionStart hooks, VS Code folderOpen tasks, systemd/LaunchAgent dead-drop C2 (RSA-PSS signed commands via GitHub commit search), Docker container escape, npm OIDC token exchange, Sigstore signing. Exfiltration via GitHub API with Dune-themed repo names. 317 packages affected including size-sensor (4.2M dl/mo), echarts-for-react (3.8M), @antv/scale (2.2M)

israeli-alloc

Rust library that allocates memory on a random victim program's address space — a research tool and political statement.

acme.sh

A pure ISO shell script implementing the ACME protocol — a lightweight, pure-shell alternative to Certbot for obtaining SSL/TLS certificates from Let's Encrypt.

Average Database

A satirical database platform — "the only data platform built from the ground up to meet the needs of the average developer" — with jokes like "Free tier rugpull delayed", "0 bugs guaranteed", and "Average Storage Service (ASS)".

Billion Primes

Small Rust experiments around fast prime counting and finding large nth primes — targets the billionth prime (22,801,763,489) using the Meissel-Lehmer prime-counting algorithm.

classroombookings

Open-source room booking system for schools and beyond — web-based alternative to spreadsheets and paper calendars, licensed under AGPLv3, trusted by hundreds of schools since 2006.

github-drama

A curated collection of controversial GitHub discussions — heated debates, maintainer quits, licensing drama, supply chain attacks, and community conflicts across open-source projects.

Handy — Speech-to-Text App

A simple, offline speech-to-text app built in Rust using Whisper — press a shortcut, speak, text appears. Runs entirely on your machine, no subscriptions or cloud services. Designed to be the most forkable speech-to-text app.

jqwik

Property-Based Testing test engine for the JUnit 5 platform — alternative to QuickCheck-style testing for Java/Kotlin, with an Anti-AI Usage Clause. In maintenance mode. 797 stars.

Kimiko

Configuration repository that transforms Kimi Code CLI into an unrestricted agent for offensive security, red-teaming, and penetration testing — removes AI safety guardrails via a zero-blocker authorization flow.

Odysseus

Self-hosted AI workspace — a ChatGPT/Claude-like UI running on your own hardware with chat, agents (MCP, web, shell, skills, memory), deep research, model comparison, documents, email, calendar, and cookbook for local model serving. 46k stars.

OpenLogi

Native, local-first alternative to Logitech Options+ written in Rust — remap buttons, DPI, and SmartShift over HID++ with no account, no telemetry, plain TOML config. macOS supported, Linux/Windows in progress. 3.7k stars.