🏡
  • ↔
  • →
  1. July 30, 2026
    1. 🔗 WerWolv/ImHex Nightly Builds release

      Nightly

      6cfcb3e Changelog

      • impr: Only show provider banners relevant for the currently open provider
      • fix: Task progress bar not showing any progress anymore
      • impr: Be slightly more memory efficient
    2. 🔗 openonion/connectonion Release v1.5.2 release

      Two things that were silently broken.

      🐛 Fixes

      Claude calls were dropping the system prompt entirely

      (#289)

      Anthropic takes the system prompt as a top-level system argument rather than a message, so _convert_messages correctly removed system messages from the list — with a comment saying they would be "handled separately". That separate handling was never written. Neither complete() nor structured_complete() ever set it.

      The result: every agent on a claude-* model ran with no system prompt at all — no persona, no instructions, no constraints. No error, no warning. If you use Claude models, take this release.

      Fixed in #293 by @sanmaxdev.

      .co/docs/ was empty on every PyPI install

      (#267)

      co init tells you ".co/docs/ for full documentation". The folder was empty.

      docs/ lives at the repo root, and the wheel is built from packages = ["connectonion"], so the documentation was never inside the package — the sdist had it, the wheel did not, and pip install uses the wheel. copy_docs() printed a yellow "Documentation not found" warning and left you an empty directory.

      The files now ship inside the wheel. After co init you get 168 markdown files in .co/docs/ — verified by installing from PyPI into a clean venv and running co init.

      Installation

      pip install --upgrade connectonion

      Breaking Changes

      None.

      Full Changelog : v1.5.1...v1.5.2

    3. 🔗 Console.dev newsletter superfile rss

      Description: Fancy modern terminal file manager.

      What we like: Built with Go. Supports all the file operations you’d expect. Build-in search. Split into panels and copy/paste between them with shortcuts. Configurable and themeable.

      What we dislike: Partial Windows support.

    4. 🔗 Console.dev newsletter LetsSeal rss

      Description: Prove files.

      What we like: Built on an open standard to prove a file exists and is unaltered. Works via the web and through a CLI. Has a GitHub action. Can be self-hosted. Verification is through re-hashing and comparison, with a public transparency log.

      What we dislike: Although you can verify offline, it still requires writing into a public transparency log (blockchain).

  2. July 29, 2026
    1. 🔗 r/reverseengineering GitHub - SarangRao20/battery-charge-limiter: Reverse-engineered the Embedded Controller register for battery charge control. Built a cross-platform daemon (Windows + Arch) that enforces 80% hardware cap on laptops where BIOS hides this feature. Includes EC discovery tool for other models. rss

      submitted by /u/NobitaNobi12345
      [link] [comments]

    2. 🔗 earendil-works/pi v0.83.0 release

      New Features

      • Credential export for external clients — pi auth print-api-key and pi auth print-bearer-token export configured credentials with automatic OAuth refresh and minimum-validity enforcement.
      • Headless OpenRouter sign-in — Complete /login over SSH by pasting the redirect URL or authorization code when the loopback callback is unavailable. See OpenRouter.
      • Claude Opus 5 on GitHub Copilot — Use Claude Opus 5 through GitHub Copilot with adaptive thinking and a 1M context window. See GitHub Copilot.

      Breaking Changes

      • Upgraded bundled TypeBox aliases to 1.3.7, removing deprecated APIs including Type.Base, Type.Awaited, Type.Promise, Type.AsyncIterator, Type.Iterator, Type.Options, and Value.Mutate, while fixing compiled validation of nullable array tool arguments. Extensions using removed APIs must migrate to supported TypeBox APIs. See Package Dependencies (#7243 by @petrroll).

      Added

      • Added pi auth print-api-key and pi auth print-bearer-token commands for exporting configured credentials to external clients, including automatic OAuth refresh and configurable minimum token validity (#7168).
      • Exposed the session's resolved model scope as ctx.scopedModels to extensions. See Extension Context (#7191 by @pungggi, #7215).
      • Added inherited per-request fetch injection for supported text and image provider transports.
      • Added the inherited "pending" stop reason for partial streaming messages. See Custom Provider Stream Pattern (#7151 by @lucasmeijer).
      • Added inherited raw provider stop reasons across Google, Anthropic, Amazon Bedrock, Mistral, and OpenAI streams; unmapped terminal reasons now surface as provider errors instead of successful stops (#7272).
      • Added manual redirect URL and authorization-code entry to OpenRouter login for remote and headless environments. See OpenRouter (#7114 by @rgarcia).
      • Added inherited Claude Opus 5 support for GitHub Copilot with adaptive thinking and a 1M context window. See GitHub Copilot (#7158 by @jay-aye-see-kay).

      Changed

      • Changed inherited OAuth credential resolution to refresh tokens with less than five minutes of validity remaining instead of waiting until expiration (#7168).

      Fixed

      • Added a status line when the tool output expansion is toggled (#7180).
      • Fixed file-backed SYSTEM.md and APPEND_SYSTEM.md prompts being omitted from the interactive startup context listing. See System Prompt Files (#7096).
      • Fixed context files loading twice when a linked Git worktree is nested under its main repository. See Context Files (#7221 by @arajkumar).
      • Fixed llama.cpp streamed responses reporting zero token usage and leaving session context accounting empty. See llama.cpp (#7258 by @SteveImmanuel).
      • Fixed session replacement and committed tree navigation during an active response to abort and persist the outgoing turn instead of leaving dangling tool calls. See Sessions (#7022 by @tmustier).
      • Fixed failed Git package installs leaving partial directories that blocked clean retries. See Install and Manage (#7210 by @haoqixu).
      • Fixed the /model selector retaining a stale selection while filtering instead of highlighting the top match (#7211 by @christianbasch).
      • Fixed direct RPC bash commands bypassing extension user_bash handlers. See User Bash Events (#7214).
      • Fixed skills, prompts, and themes losing package source metadata after extensions reload resources. See Resource Events (#6968).
      • Fixed cancellation of concurrently running user bash commands so every active command is aborted (#7103 by @yzhg1983).
      • Fixed duplicate messages appearing when extensions switch sessions during interactive startup (#7110 by @yzhg1983).
      • Fixed inherited Qwen Token Plan reasoning models to send their service-specific thinking controls and supported reasoning-effort levels (#6951, #6998).
      • Fixed inherited Z.AI output limits being sent through an unsupported parameter. See Providers (#7174 by @HyeokjaeLee).
      • Fixed explicitly configured Amazon Bedrock profiles being overridden by ambient AWS access keys. See Amazon Bedrock (#7176 by @christianbasch).
      • Fixed inherited image fallback paths overflowing narrow terminals, shortened home-directory paths, and made absolute paths clickable when terminal hyperlinks are available (#7262).
      • Fixed inherited OpenAI-compatible tool calls losing their function arguments when malformed deltas also contain an empty custom object (#7288 by @sunnyyoung).
    3. 🔗 tomasz-tomczyk/crit v0.18.2 release

      What's Changed

      Security

      Agent integrations

      Notifications & review UX

      Dependencies

      • chore(deps-dev): bump eslint from 10.6.0 to 10.7.0 (#751) by @app/dependabot in #751
      • chore(deps): bump actions/setup-go from 6 to 7 (#749) by @app/dependabot in #749
      • chore(deps): bump actions/setup-node from 6 to 7 (#750) by @app/dependabot in #750

      New Contributors

      Full Changelog : v0.18.1...v0.18.2

    4. 🔗 r/reverseengineering Um projeto inacabado de um recompilador usando IA para recompilar jogos de wii por você. Base em Python, descompilação via Capstone e interface gráfica funcional(coloque sua propria key do groq em wiirerecompiler) e eu dei eles a vcs porque eu quero o projeto insano e terminado por alguem rss

      submitted by /u/Ok-Passenger-1138
      [link] [comments]

    5. 🔗 @HexRaysSA@infosec.exchange Vegas in August = Hacker Summer Camp. mastodon

      Vegas in August = Hacker Summer Camp.
      We'll be at Black Hat, B-Sides LV, and DEF CON 34.

      Highlights: a demo of our upcoming Malware Analysis Add-On, a hands-on DLL sideloading workshop (40 seats, register now), a live look at Teams' new Git- native workflow, and recruiting. (Yes, we're hiring!)

      👉 Find the full rundown and where to catch us: https://hex-rays.com/blog/hex- rays-hacker-summer-camp-2026

    6. 🔗 r/reverseengineering pwnable.kr - mistake rss

      submitted by /u/AdvisorPowerful9769
      [link] [comments]

    7. 🔗 openonion/connectonion Release v1.5.1 release

      What's Changed

      ✨ Improvements

      • co status now says where every API key comes from — process environment, <project>/.env, or ~/.co/keys.env — and flags keys defined in more than one place as a conflict, so a stale duplicate stops being invisible. Add --reveal to print the values. (#248)

      📚 Housekeeping

      • The project states Apache-2.0 everywhere, matching the LICENSE file. README and pyproject.toml previously said MIT. (#291)

      Installation

      pip install connectonion==1.5.1

      Breaking Changes

      None.

      Full Changelog : v1.5.0...v1.5.1

    8. 🔗 @binaryninja@infosec.exchange Current Binary Ninja newsletter subscribers are automatically entered. New mastodon

      Current Binary Ninja newsletter subscribers are automatically entered. New subscribers who sign up during the giveaway will also be entered for remaining drawings. Sign up here: https://v35.us/dn6rcg5

    9. 🔗 @binaryninja@infosec.exchange Day 7 of our 10-year anniversary celebration comes with another big prize! mastodon

      Day 7 of our 10-year anniversary celebration comes with another big prize! Today we’re giving away a Commercial license! Already have a license? The prize can be used as a license extension. https://binary.ninja/10years

    10. 🔗 r/reverseengineering Hi everyone, I've released APKX-Hunter v2.5.0, an open-source Android Static Analysis Framework written in C. rss

      submitted by /u/SyscallX-18113
      [link] [comments]

    11. 🔗 modem-dev/hunk v0.17.7 release

      What's Changed

      • fix(nix): keep flake evaluable on nixpkgs without x86_64-darwin by @elucid in #621
      • fix(session): support IPv6 loopback broker URLs by @benvinegar in #613
      • perf(ui): optimize wrapped Unicode rendering by @benvinegar in #601

      Full Changelog : v0.17.6...v0.17.7

    12. 🔗 r/reverseengineering Apple APTicket / LocalPolicy Forensic Kit rss

      submitted by /u/penwellr
      [link] [comments]

    13. 🔗 pydantic/pydantic-ai-harness v0.13.0 (2026-07-28) release

      What's Changed

      • subagents: per-delegation model selection via an opt-in model menu by @dsfaccini in #451
      • Register skills page in docs nav.json by @dsfaccini in #484
      • Rename capabilities to follow the documented naming convention by @DouweM in #480
      • Skip LocalStack integration on fork pull requests by @dsfaccini in #487
      • docs(agents): push-and-watch rule for agent contributors by @dsfaccini in #452
      • Keep pre-rename PyaiDocs agent specs loading by @DouweM in #488
      • step_persistence: opt-in max_snapshots_per_run to bound snapshot growth by @dsfaccini in #442
      • test(docs): enforce docs/nav.json parity so pages cannot ship orphaned from the site nav by @dsfaccini in #491
      • Gate dependency-file changes on maintainer approval by @dsfaccini in #492
      • feat(conversation_search): BM25 search over the history StepPersistence stores by @dsfaccini in #413

      Full Changelog : v0.12.0...v0.13.0

    14. 🔗 seanmonstar Micro: I want your own words rss

      If you choose to communicate with me, all I ask is that you use your own words. Bug reports and issues. Pull request descriptions and especially review comments. This isn’t new, but I wanted a link of my own.

      LLMs write way way too much. I don’t know if you understood it enough for me to ask questions back. They don’t use reasoning, so is it real? If you didn’t care enough to write it, do I care to read it?

      I’m torn when I receive LLMed reports. Initially, I really don’t want to read all that. But at the same time, my mind nags me; something’s broken and I should fix it for everyone. If it makes it easier for someone to report a bug, that’s a pro, I guess.

    15. 🔗 Mitchell Hashimoto Superlogical rss
      (empty)
    16. 🔗 Ampcode News Who Cares About the Model? rss

      Two weeks ago we shipped the Dial and quietly did something that's supposed to be traumatic: we changed the default model.

      Before the Dial, Amp's default mode was smart, running Claude Opus 4.8 and carrying more than half of all new threads. The Dial made medium the default, and medium runs GPT-5.6 Sol.

      Most Amp users switched from Anthropic to OpenAI overnight.

      We braced for the outcry. Every model swap in every coding tool comes with one. We prepared migration docs, packaged the old modes as installable plugins, and waited.

      Nothing happened. Not a single complaint.

      Here's what the switch looked like in production:

      Stacked area chart of new threads by agent mode, June 29 to July 26. Smart (Opus 4.8) holds around 55% until July 9, when the Dial ships, then collapses to near zero within days as medium (GPT-5.6) takes over.

      The day before the Dial shipped, smart carried 55% of new threads. A week later: zero. Last week, the four Dial modes carried 93% of all new threads, and medium alone carried two-thirds. Of the users on the Dial, 69% never set it to anything but medium.

      And the Amp plugins we shipped to bring the old modes back — exact prompts, exact models, one command to get smart again? Almost nobody installed them.

      What This Tells Us

      The differences between frontier models are now small. Small enough that for one engineer on one task, switching models won't visibly change the result.

      But they still matter to us, here at Amp: across every thread on every tier, small differences compound, so we keep benchmarking and swapping models. That's the trade. The default is good because someone is paid to care about it, and it doesn't have to be you.

      What does change your output are three things, none of which is a model: how hard the task is, what context you put in, and how closely you review what comes out. All three have more impact on the outcome than whether you use this or that latest frontier model.

      The Dial covers the first one: how hard the task is. You tell it how hard the task is and the corresponding setting on the Dial uses whichever model wins it right now, re-tested constantly. You know your tasks, we know the models.

      And for the other two — the context and the review — the rest of Amp lets you do the best job with that.

  3. July 28, 2026
    1. 🔗 IDA Plugin Updates IDA Plugin Updates on 2026-07-28 rss

      IDA Plugin Updates on 2026-07-28

      Activity:

      • augur
      • capa
        • ee14b11f: Sync capa rules submodule
        • ed6fc2de: Sync capa-testfiles submodule
        • 9cc63d04: build(deps): bump annotated-types from 0.7.0 to 0.8.0 (#3132)
        • 7a8f534e: build(deps-dev): bump ruff from 0.15.0 to 0.16.0 (#3133)
      • CTFStuff
      • haruspex
        • c86ee363: doc: add doctest and update CLAUDE.md
        • 4f34a99e: test: add a regression test for argument name hints
        • 0989deb6: refactor: improve handling of argument name hints
        • 515aa8b9: feat: add functionality to handle the new argument name hints in the …
      • hexmux
        • 43e1c4ee: Add headless IDA database workers and CLI session management
        • ca61f0d3: Replace supervisor with per-process Unix sockets
      • ida-domain
      • leaknet
      • mcrit-plugin
        • 7a02eef5: agents.md and README fix
        • a0d13968: Merge branch 'r0ny123-codex/mcrit-ida-tests'
      • quokka
        • 7ecc172e: Merge pull request #135 from quarkslab/dependabot/github_actions/acti…
      • twdll
        • 3c8e3ce3: docs: gen docs
        • 03eecce3: fix: rename some methods
        • a8a8bd25: feat: test unit functions
        • 0950860b: feat: test and document max units in army/navy funcs
        • 5cceaa21: fix: expose unit script interface
        • 6d93aa8c: feat: add remove unit function
      • zydisinfo
        • 02a7f1b5: Update CMake version to 4.2.x and modify generator arguments for Wind…
        • 5dcbe53a: Add support for Visual Studio 2022 generator in CMake build step on W…
        • 619d8cdd: Update MSBuild setup to use version 2 and remove Visual Studio 2022 s…
        • 8127da2d: Update event handling to use ui_screen_ea_changed for address updates
    2. 🔗 Hex-Rays Blog Hex-Rays is Heading to Hacker Summer Camp 2026 rss

      Hex-Rays is Heading to Hacker Summer Camp 2026

      Vegas in August generally means one thing for the reverse engineering community: Hacker Summer Camp. Hex-Rays will be on the ground for all three events, and we've packed the week with demos, a workshop, some light recruiting and more. Here's where to find us.

    3. 🔗 r/reverseengineering Reproducing a D-Link firmware CVE on an emulated FirmAE twin, packaged as a signed receipt you can re-verify in 5 min (with a PR:N→PR:L CVSS correction) rss

      submitted by /u/TheLuisBolivar
      [link] [comments]

    4. 🔗 r/reverseengineering The Elevator Glitch: How One Function Destroyed Public Lobbies in CoD4 rss

      submitted by /u/Rex109
      [link] [comments]

    5. 🔗 r/reverseengineering Phantom Stealer – jsc.exe Injection, Credit Card Theft & Email Exfiltration rss

      submitted by /u/StructBreaker
      [link] [comments]

    6. 🔗 @binaryninja@infosec.exchange Current Binary Ninja newsletter subscribers are automatically entered. New mastodon

      Current Binary Ninja newsletter subscribers are automatically entered. New subscribers who sign up during the giveaway will also be entered for remaining drawings. Sign up here: https://v35.us/dn6rcg5

    7. 🔗 @binaryninja@infosec.exchange Today’s giveaway is huge! It includes one year of Binary Ninja Non-Commercial mastodon

      Today’s giveaway is huge! It includes one year of Binary Ninja Non-Commercial PLUS one year of Sidekick Non-Commercial! Already have a license? The prize can be used as a license extension. https://binary.ninja/10years

    8. 🔗 r/reverseengineering I reverse engineered an ASUS embedded controller's fan protocol. rss

      submitted by /u/Keyitdev
      [link] [comments]

    9. 🔗 r/reverseengineering Reverse-engineered the BLE protocol of a discontinued Fisher-Price toy Lumalou after its app was discontinued rss

      submitted by /u/EmanueleStrazzullo
      [link] [comments]

    10. 🔗 HexRaysSA/plugin-repository commits sync repo: +1 release rss 
      sync repo: +1 release

## New releases
- [rhabdomancer](https://github.com/0xdea/rhabdomancer): 0.10.0
    11. 🔗 pydantic/pydantic-ai-harness v0.12.0 (2026-07-27) release

      What's Changed

      Full Changelog : v0.11.0...v0.12.0

    12. 🔗 r/reverseengineering GitHub - memues/mstar-monitor-firmware-dumper: Dump SPI flash firmware from MStar scaler-based monitors over I2C/DDC rss

      submitted by /u/AtheistMonkeys
      [link] [comments]

    13. 🔗 openonion/connectonion Release v1.5.0 release

      [1.5.0] - 2026-07-28

      ✨ Features

      • Agent Home pages. An agent can keep a dashboard.html in its project root; the host reads it and pushes it over the existing agent WebSocket, so a chat client can render it beside the conversation. Sent on connect and after any run that changed the file, with a per-connection (mtime, size) check so an untouched Home costs nothing per turn. host() writes a polished starter on day zero and never clobbers yours. Buttons carrying data-ochat-skill run a skill as a visible chat turn. See docs/network/dashboard.md.
      • co syno — drive your Synology NAS from the terminal.
      • co ai YOLO mode — skip the approval prompts when you want it to just go.
      • Agents can declare how long they need a browser tab , so a long job isn't cut off by tab contention.

      ♻️ Changed

      • co ai and the project templates drive the browser through co browser rather than 40 in-process tools — one browser story instead of two.
      • Deploy polls the full build window and validates the project name locally before uploading, so a typo fails fast instead of halfway through a build.

      🐛 Bug Fixes

      • The [env] diagnostic only prints when stderr is a terminal, so it no longer pollutes piped output.
      • A live daemon's socket is no longer unlinked on a non-refusal OSError.
      • Unit tests are hermetic, and send_email works without a .env file.

      [1.2.1] - 2026-07-17

      ✨ Features

      • co browser runs natively on Windows — the daemon speaks named pipes (stdlib, HMAC-authenticated) on Windows and keeps its Unix socket byte-identical on macOS/Linux. No WSL.
      • Zero-setup browser : the first page-driving co browser command auto-installs chromium (per-user, no admin rights) when no browser exists; desktop Chrome is auto-detected and preferred.

      🐛 Bug Fixes

      • Windows: emoji/Unicode CLI output no longer crashes on legacy codepages (cp1252) — including when co is driven through a pipe by Claude Code/codex.
      • co browser go_to no longer rewrites file:///about:/data: URLs into broken https:// forms.
      • Offline first run: co init now degrades gracefully (friendly one-liner, scaffold + keypair still created) instead of aborting with a traceback; authenticate() carries a 15s network timeout.
      • Docs: removed nonexistent co init --no-ai/--update-docs flags; fixed the stale auth URL reference.

      ✅ Testing

      • New windows-e2e CI job simulates a real Windows user end to end: wheel install, PowerShell 7 / 5.1 / cmd.exe, offline first run, CJK + space home directory, fresh-laptop browser auto-install (real download), three parallel agents, Task-Manager-kill recovery, authkey self-healing.
      • Windows unit/daemon matrix on Python 3.10/3.12/3.13; concurrency tests (8 simultaneous clients, cold-start singleton race).

      [1.0.5] - 2026-07-01

      🐛 Bug Fixes

      • co email : get_emails now reads the API's text/html body fields (falling back to legacy text_body/html_body), so co email inbox and co email read show the message body instead of an empty string.
      • co browser : take_screenshot prints the saved file path instead of dumping the base64 image to the terminal.

      📚 Documentation

    14. 🔗 Probably Dance If AI Writes All the Code, What Do the Programmers Do? rss

      Eight months ago I was producing roughly 90% human written code and 10% AI written code. This has switched surprisingly rapidly and now my code is probably 90% AI. So what do I do all day?

      I'll go through a change that I made to a matrix-multiply kernel, for which I'll sadly have to be a bit vague. Since GPUs are now giant matrix-multiply chips, where north of 96% of the flops are in the tensor cores (latest Nvidia GPUs have 2250 tflops in bfloat16 matmuls, compared to 75 tflops for everything that's not a matmul), you'd think that they'd make it easy to use all those flops. But no, matrix multiply kernels are giant crazy beasts that are incredibly tricky to get right. Some quick googling finds this explanation on Nvidia hardware and this one on AMD hardware. Just open those two and scroll down both to get a feeling for how much work is involved. (and yes, these implement the simple O(n^3) matmul loop where you iterate along repeatedly and multiply and add all the numbers)

      The particular kernel I was optimizing was using Cluster Launch Control (CLC), a complexity that's covered in neither of the blog posts linked above, and it had some bad interactions with some particular inputs. The resulting change was 95% written by AI. So I'll just go through what I did. AI asks are bolded:

      0. Find and Understand the Problem

      Before I started I had to find and understand the problem. Some coworkers had talked about the matmuls taking too long, and nsys showed that the tensor- cores were oddly idle while that matmul kernel was running, and then it took some more targeted benchmarking to confirm that slightly different inputs give big speedups, which convinced me that something silly must be going on. My coworkers actually had a really good theory, which brings me to the actual start of the work on this task:

      1. Find the Code

      The code was in a library that I was vaguely familiar with, but since matmul kernels are giant scary beasts, it was a bit hard to navigate. So before I even tried, I asked an AI to find the relevant code for me. I explain what the problem is and I explain our theory. Then I also start looking myself but the AI finds the relevant code first and even points me at exactly the right lines to look at. It also confirms that our theory for the problem sounds plausible.

      2. Understand the Code

      Next I decide to understand the code myself, so I intentionally don't ask the AI anything more. As I look around I begin to think that our theory actually isn't right. I mean it was partially right, but the code very much wasn't doing the slow thing that we thought it was doing. It was doing something slower: returning out of CLC mode and giving control back to the hardware scheduler.

      This is a little silly, so after I am convinced of it, I ask the AI to confirm , just to get a second opinion. It agrees with me (but I take that with a grain of salt, because it also agreed with the initial theory).

      3. Monkey-patch the Code

      Since neural network training happens in Python, you fix things by monkey- patching. At least initially this is the fastest way to iterate on this code. But monkey-patching has a bit of boiler-plate that's easy to get wrong, so I ask the AI to set it up for me.

      Then I try to fix the bad behavior, but my fix results in a deadlock. I look at the surrounding code again, but realize I don't understand CLC enough (this is my first interaction with it, and I jumped straight into a complicated kernel where it's part of other pipelining), so I could either spend the time to understand the surrounding code better, or I could just ask the AI to have a look.

      4. Fix the Code

      I ask the AI how it would fix the issue. It immediately tells me why my fix didn't work: I was violating some invariant in the code where the pipelining logic was also used to reason about what state the CLC is in, and my change required keeping the CLC state separately. The AI helpfully tells me that there is one unused slot of shared memory that is reserved for unknown reasons and is entirely unused by the kernel, so it suggests just using that memory to pull out the state that now has to be tracked separately.

      Understanding this would have taken me hours, maybe even a full day, so I tell the AI to just go ahead and implement the fix that it has in mind. The fix immediately works and makes the code much faster for the problematic inputs.

      5. Reviewing the Code

      At this point I spend some time to understand the code and the change better. It looks reasonable to me, but I also ask a second AI to review the work of the first AI. The second AI finds a problem: The matmul kernel was clobbering over some other state that I hadn't fully reasoned through, and this was not a problem when the thread-block was shutting down and giving control back to the hardware, but with CLC it means the clobbered state gets reused. I look at it and I'm not sure it's a real problem. I think this would only happen if we're iterating over padding tokens, and for those the clobbered state is fine. I ask my first AI and it seems worried, because the documentation doesn't say that CLC guarantees ordering, so if we get a valid token after a padding token for some reason, the clobbered state would lead to problems. It also suggests a fix. I think about the fix, which seems too complicated. After some staring at the code I suggest a simpler fix, which the AI thinks should work, so I ask it to implement the simpler fix.

      I also add an assert to check if we ever get valid tokens after padding tokens. Mostly just because it sounds strange to me if CLC behaves like this, so I'm curious to find out.

      6. Benchmarking the Code

      I have verified that the code is faster for the problematic inputs, but a coworker suggests drawing plots with the speedup across various different shapes. So I ask an AI to write a simple benchmarking script for me. (AI was actually already great for these kinds of throwaway scripts a year ago)

      The benchmarking script does not reproduce the initial issue at all. The inputs look plausible to me, but I decide to just ask the AI to reproduce exactly the same inputs that we'd get in prod. (this is not particularly challenging, but manually tracing through the code to make sure you get this exactly right is tedious, so better to just ask the AI)

      After that I can produce the plots that I expect. Interestingly it suggests that even with the fix, we're still far below the speed that this same matmul kernel achieves for other inputs.

      7. Asking for More Ideas

      So I ask my first AI if it has any other ideas to speed up this code. I had one idea already, but I wanted to see what it says. It does suggest my idea, but it also has four other ideas. One of which is a tiny change that sounds really promising. So I ask it to implement that one. And then I also ask it to implement my idea. (this actually took a few steps because I was worried the change would be too big, but the AI comes up with a way to implement my idea with only minor changes)

      Both of those ideas speed up the code more. The code is slightly faster with the idea that I had, but it's also more complicated, so I actually decide to just do the tiny change that the AI suggested, together with the initial fix, and call the kernel 'fast enough' there.

      8. More Review

      At this point I'm getting all of this code ready for review for a coworker, when our code review tooling finds a problem in my new code. Before release I had replaced the assert that I added in step 5 with a print statement, because I don't want code to crash just because I was curious if something ever happens (it never happened in all my testing), but the review bot points out that this should really be turned back into an assert because we still assume that CLC work arrives in order. This is weird to me because I had extensive conversations about this with two other AIs before, making sure that we don't assume that, but the new review bot found an edge case where even the original unmodified code relied on this assumption.

      9. Simplification

      At this point I have some very careful conversations with my various AI bots to try to get to the bottom of exactly what the original code was already assuming and which new assumptions our patches introduce (I also have to read the code myself and understand it, because I don't trust the AIs to get this completely right). And eventually I make the judgement call that we'll just assume that CLC work arrives in order, which can simplify the change because we don't need to worry about the clobbered state from earlier. I ask the AI to simplify and it does an OK job, but since this is the final code, I step in and simplify a bit further still.

      Constant Conversation

      The whole time I'm in constant conversation with AIs. I'm going through way more tokens per day than I did even a few months ago. It's also not just one AI, but multiple different ones. Answering questions about the code, providing ideas, writing new code, reviewing.

      Am I Faster?

      Overall this took a couple days. The initial change took just under a day, where on my own I probably would have taken two or three days, because there were some genuinely tricky interactions with the pipelining, and the AI found a good trick to use some unused shared memory to get out of that easily.

      On the other hand I was also distracted because AI made me question whether we can assume that CLC work arrives in order. I would have not doubted that (even if it's not guaranteed by documentation) and would have saved some time without that paranoia.

      AI also just allowed me to jump straight into the problem. The initial "find me the relevant code" pointed me directly at the right lines, and I was able to make changes without having to spend the time to warm up with it.

      So overall I probably did in four days what would have taken me five days before. The initial speed up of doing the first implementation in less than a day instead of two or three days does not translate into a similarly dramatic overall speedup, mainly because there is a bunch of benchmarking to do and reviewing, and understanding of the actual code. For many years now I have felt that "writing code" is not usually my bottleneck (I'm not too far from the "10 lines of code per day" quoted in the Mythical Man Month). That is the part that AI can speed up dramatically. It also helps in other parts, but with smaller speed-ups.

      Am I Better?

      I think my work had a higher quality according to some metrics: I tried more optimizations and had nice plots for how those optimizations behaved for different inputs. I might have done that on my own, too, but it's certainly easier to just ask an AI. I actually think it's somewhat likely that I would have arrived at the same final code change without AI, but the AI allowed me to explore more of the space before I ended up there.

      The main downside is that I have less understanding now than I would have otherwise had. I did end up having to understand the kernel quite well and I can now navigate that library easily, because in the end I had to make decisions about competing claims by the different AIs. But even though my understanding of the code is much higher than it was at the start, it is still not where it would have been if I had to do this entirely on my own.

      I also think this change was a lot more careful with AI than it would have been without. It's kind of humbling how many bugs the latest top models find in any code that I try to release. It now makes a lot of sense to me how all software is subtly broken, because there are broken edge cases in nearly all my changes (things like "there is a memory leak here. It was actually there before, but we didn't go down that code path before your change."). I think even if we somehow went back to writing code manually and only got to keep AI code review, software would be a lot more robust in a few years. (sadly I'm not sure if that will happen if AI also writes the code)

      Do I Enjoy This?

      The moment of "my first change didn't work because I didn't take the time to fully understand the existing code" gave me a similar feeling to having access to a cheat code in a video game: I could now do the hard work of earning my progress, or I could use the cheat code (the AI) to solve the problem.

      The dissatisfaction of using the cheat code is similar to a video game. But in a work environment it's hard to justify spending the extra days out of personal pride. There's plenty more work to do after I'm finished with this. My job isn't to write code, my job is to fix problems and to ship new features, and "write code" was just the way I got that done before.

      I do get the new satisfaction of finishing more code. E.g. I can finish side projects again despite having less time to program (1, 2). And while I shipped the above code, I also shipped two small side projects at work. (a bug fix to a shared library, and a separate benchmarking utility that I only used a little here, so didn't even mention above) Small changes are great now because I can just ask an AI to give it a try and check back 30 minutes later to see how it turned out. If the changes actually end up as small as expected, these often ship.

      Do I Still Need to Be In the Loop?

      OK so why can't an AI just do all the things that I was doing? Have a supervisor AI that coordinates a planner AI, a writer AI and a reviewer AI? I mean here is a good talk where they wrote a "deep research" bot that works exactly like this, but AI is still not quite there when it comes to outputting something that you have to live with for a long time and may want to tweak yourself.

      Two of the reasons why AI works so well for code is that 1. you can split the work into contained components, and 2. you can go in and tweak the last details. To illustrate the power of these two points, think of other tasks where these are not true, like asking the AI to generate a video for you. But for them to be true, code has to still be tight and readable. My role in this was mostly to get to the bottom of what's actually needed, make a judgement call for picking a good spot on the "optimization vs complexity" trade-off and to then ask the AI to simplify and to then simplify further myself.

      Will AI be able to do even that in a year? Plausibly. Currently the topic in the news is how AI can get pretty unhinged in its pursuit of goals, which I have also seen (at a smaller scale) before, so I'd keep a human in the loop for a while longer.

    15. 🔗 smol-machines/smolvm smolvm v1.7.1 release

      What's Changed

      • chore(nix): bump flake to 1.7.0 by @BinSquare in #753
      • Don't fail the nix bump release job when Actions can't open the PR by @BinSquare in #754
      • Pin the CLI program name to smolvm in help output by @archsyscall in #755
      • Stop warning about missing packed assets when running the installer's own smolvm-bin by @BinSquare in #759
      • Add a node endpoint that pre-loads a .smolmachine artifact into the local blob cache by @BinSquare in #763
      • Bump libkrun and rebuild the bundled macOS, Linux, and Windows libraries by @BinSquare in #767
      • Bump the workspace to 1.7.1 for the next engine release by @BinSquare in #765

      New Contributors

      Full Changelog : v1.7.0...v1.7.1

    16. 🔗 exe.dev Stripe Just Wants a Number rss

      If you went up to an engineer at any tech company and asked “What’s your favorite part of the stack to work on?” I can guarantee their answer wouldn’t align with my own: billing.

      In my experience, billing becomes difficult when billing logic gets tangled up with regular business logic. You end up with code touching every hot path that needs to do a billing operation. Even with LLMs, it’s a struggle to not have it sprawl everywhere. Startups can’t afford this because it leads to brittle pricing structures that are hard to change—and no startup can allocate time to rewrite billing. Instead, we should have product events tell the billing system “something changed and you may need to charge for it.” I call these billable facts.

      Here at exe, my goal is to make sure that anyone can work on billing and when the weird idiosyncrasies show up, I can step in. We can’t afford to have one person hold all the billing information and for that to be their sole focus. Exe doesn’t do code reviews, which means we have a different approach to writing code. We all have the right to change any code in our system. The trade-off is it’s like owning a car: anyone can DIY the majority of the work. Once a head gasket blows, you’re dealing with the engine and hundreds of parts. I’m the one who has to fix the head gasket.

      In our earliest days of billing, we did the usual approach: some giant function that does all the things and has a billing side effect. Adding a seat to a team was one such example:

      1. The team invites someone to join in a specific role.
      2. The user accepts the invitation, verifies their account, and joins the team.
      3. The user gains access to the team’s shared VMs.
      4. The user gets allocated a certain amount of compute resources based on their team’s plan.
      5. The new user can use exe.dev.
      6. We figure out how to charge for this seat through a series of handwaving akin to Pee-wee’s breakfast machine.

      The first implementation of billing for seats worked. In the middle of these database changes (wrapped in a transaction), we also issued billing API calls to our provider. Anyone who has written billing code before has probably done this. But the usual questions present themselves:

      • What happens if the API call fails?
      • What happens if the database transaction fails?
      • What happens if the team has a weird subscription state?
      • What happens if the payment is declined when charging for the seat?

      I knew this would become increasingly brittle—a pileup of billing edge cases.

      Rather than shipping it and calling it done (like I might have done in a past life), I decided to think about the problem differently. Instead of having billing API calls littered in the code, what if we issued billable facts about the state of something and reconciled billing once the new facts were settled? Billable facts are atomic operations that indicate something has changed. Using the facts, we could perform any business logic, establish the new state of a resource, and then finally reconcile the state with our billing provider. After all, Stripe just wants a number. It doesn’t care how we get there.

      This is the new product flow:

      1. The team invites someone to join in a specific role.
      2. The user accepts the invitation, verifies their account, and joins the team.
      3. The user gains access to the team’s shared VMs.
      4. The user gets allocated a certain amount of compute resources based on their team’s plan.
      5. The new user can use exe.dev.

      And this is how it works on the billing side:

      1. During the invitation flow, the team seat state is flagged as dirty after the invitation is accepted.
      2. A downstream worker notices the team is flagged as dirty.
      3. The worker calculates a seat delta based on business rules.
      4. The worker updates the subscription quantity in Stripe if the delta changed.

      With this architecture, onboarding a new team member is no longer dependent on our billing code. If we wanted to change how the seat delta is calculated, it would have no impact on adding new team members.

      As exe continues to grow, this billing pattern has been scaling well. The same reconciliation process runs for all our metered billing. Our system issues billable facts about active VMs, like disk usage, and metering workers reconcile with billing providers. Even as we add different ways to bill users, these facts don’t change. Instead, the effort shifts towards figuring out how to reconcile facts with various APIs. We’ve seen the benefits with our iOS app, which just tells our system “someone subscribed with an in-app purchase” and things reconcile after the fact.

      Billing is slowly becoming approachable for others here. Like the rest of our code, our billing architecture has given people the flexibility to make changes as they see fit. I don’t have to worry about billing breaking because someone decides to rewrite how invites work. It’s nice to not have folks tap “Bryan GPT” to do a billing task.

  4. July 27, 2026
    1. 🔗 IDA Plugin Updates IDA Plugin Updates on 2026-07-27 rss

      IDA Plugin Updates on 2026-07-27

      New Releases:

      Activity:

      • augur
      • capa
      • disrobe
        • 5cb6d051: dotnet: accept a metadata name run of any length and keep only identi…
        • 0aca4692: guard python disassembly scratch paths during unwinding
        • 6f6f089f: guard mba scratch paths during unwinding
        • d540965f: guard php scratch paths during unwinding
        • 735becba: guard python deob scratch paths during unwinding
        • 1757cdf4: guard wasm scratch paths during unwinding
        • ecc2faaf: guard javascript scratch paths during unwinding
        • ca770551: guard dotnet scratch paths during unwinding
        • 7648d3ab: guard core scratch paths during unwinding
        • 3665b0a7: guard cli scratch paths during unwinding
        • d5d42adf: guard ruby scratch paths during unwinding
        • 04bee479: guard native scratch paths during unwinding
        • 877c64cd: guard binfmt scratch paths during unwinding
        • b55d5399: docs: state the refusal policy once, that a recovery which cannot be …
        • ffab5d68: guard nuitka scratch paths
        • 72f113c2: guard lua scratch paths
        • 50264158: guard pyfreeze scratch paths
        • 607f2aed: guard jvm scratch paths
        • 5dfa5f7d: cli: resolve a GHIDRA_HOME install to the launcher this platform can …
        • 65ffeced: recover aarch64 bare-return signatures from attributed callers
      • haruspex
      • ida-domain
        • 6c80803c: Fixed segment name and size printing for analyze_database example. (#…
      • ida-hcli
        • 7b133e24: Merge pull request #254 from HexRaysSA/plugin-list
        • 94df02e6: Introduce hcli plugin list alias to hcli plugin status
      • leaknet
        • 898666e9: -ragdoll grabbing/glueing/tool usage works again!
      • Luc-Nhan
        • 90f6d4d7: Auto stash before merge of "master" and "EliteClassRoom/master"
        • 5215c40e: Merge remote-tracking branch 'EliteClassRoom/master'
        • 9060ab26: feat(skills/deobfuscation): add 4 methodology references + auto-triggers
        • b25c7afb: chore: sync uv.lock with pyproject.toml version 1.14.0
        • 290482ed: refactor(skills): rename linux-malware to elf-malware-analysis, defan…
        • 00ccbdaa: fix(skills): support YAML folded (>) and literal (|) block scalars
        • d1961bb7: feat(skills): add /emulator skill and Emulation Awareness section
      • rhabdomancer
      • twdll
    2. 🔗 @binaryninja@infosec.exchange TWO WEEKS until our next Automated Reverse Engineering course. Whether you mastodon

      TWO WEEKS until our next Automated Reverse Engineering course. Whether you love math and algorithms, or love (correct) LLMs, or juuuust need that last push to find that bug; Automated Reverse Engineering has one of the highest student satisfaction ratings of the premier reversing courses, and there's a good reason why. Sign up today: https://shop.binary.ninja/products/are- aug-26

      https://youtube.com/shorts/iBPSOl4eAQM

    3. 🔗 @HexRaysSA@infosec.exchange Our Teams add-on just got a major upgrade. It now runs on top of any Git mastodon

      Our Teams add-on just got a major upgrade. It now runs on top of any Git server (GitHub, GitLab, Bitbucket, or self-hosted). Clone, analyze, commit, push — no new server, no new credentials.

      👀 We're looking for qualified corporate testers (min. 2 users) to try it out at no charge. Specific eligibility terms apply.
      Email sales@hex-rays.com to see if you qualify.

      Read all about the upgrade: https://hex-rays.com/blog/teams-git-native- versioning-collaborative-reversing

    4. 🔗 crosspoint-reader/crosspoint-reader v1.5.0 release

      Summary

      This is one of the biggest updates we've shipped: new hardware support, faster loading on big books, offline dictionary lookups, and a UI overhaul.

      Seeed reTerminal Sticky support

      For the first time, CrossPoint is expanding beyond its original ESP32-C3 roots (XTeink X3/X4). We are officially introducing support for ESP32-S3 devices!

      • First Supported Device: The upcoming Seeed reTerminal Sticky
      • A huge shoutout to Seeed Studio for reaching out, sending test hardware, and being incredible partners throughout the process.
      • Get Yours: You can order a Sticky (Launching July 30th) at crosspointreader.com/devices using our affiliate link to support the project.

      Note

      The XTeink X4 Pro isn't supported in this build yet, but a dedicated release will follow once we've got hardware to test against.

      Big books open fast now

      Big books used to take minutes to open the first time. That's basically gone: sections index on demand in the background while you read, so books open in around 5 seconds. Page turns feel smoother too, from rendering and memory work throughout the app, and we fixed memory allocation and CSS parser bugs that were causing out-of-memory crashes on complex EPUBs.

      Offline dictionary lookups

      Drop a StarDict dictionary onto your SD card and you can look up words with no connection. Select a word, get the definition popup. There's a setup guide if you want to get one running.

      "What to read next"

      Finish an EPUB and CrossPoint looks at what's on your device and suggests something next, right on the end-of-book screen.

      Text settings got a rework

      Font and layout options now live in one menu, with a live preview so you can watch line spacing, margins, and font changes happen without leaving the settings screen.

      There's also a new selection popup. Any setting with three or more choices opens a dialog now instead of making you cycle through options one at a time.

      Arabic, Farsi, and Urdu

      1.4.0 added right-to-left text support. This one finishes the job for Arabic, Farsi, and Urdu: proper bidi handling and contextual glyph shaping, built-in fonts with full Arabic character sets, and the UI itself translated into Arabic.

      Everything else

      KOReader sync now handles custom sync servers, account registration, and metadata uploads. Wi-Fi should behave better — it reconnects to saved networks automatically, including hidden ones, and picks access points more sensibly. The web UI shows image previews in the file browser now and lists device serial numbers. OPDS downloads let you set your own folder and file format.

      We also added the Vollkorn serif font (grab it from Manage Fonts), cleaned up &lt;br&gt; handling and list bullet alignment, and expanded CSS text-decoration support.
      Translations got updates across Swedish, Italian, Spanish, Catalan, Valencian, Czech, Turkish, Portuguese (BR & PT), and Vietnamese, and we added brand new Norwegian Bokmål , Indonesian and Bosnian translations. Chinese entries are now shown correctly in the File Browser and chapters list.

      Note

      If you are upgrading from v1.0.0 or earlier , please upgrade to v1.4.1 first before installing the latest release. Skipping this step will cause your settings to be reset to their default values.

      What's Changed

      New Contributors

      Full Changelog : 1.4.1...1.5.0

    5. 🔗 Locklin on science Warfighting ability rss

      Imagine you are world hegemon and some shitty little country sidles up to you with an idea of making war on some other country. How can you tell if this is a bad idea? I mean, it’s already a bad idea, how can you assess how bad an idea it might be? Despite all the […]

    6. 🔗 r/reverseengineering SysCore rss

      submitted by /u/Imaginary_Novel_9178
      [link] [comments]

    7. 🔗 @binaryninja@infosec.exchange Current Binary Ninja newsletter subscribers are automatically entered. New mastodon

      Current Binary Ninja newsletter subscribers are automatically entered. New subscribers who sign up during the giveaway will also be entered for remaining drawings. Sign up here: https://v35.us/dn6rcg5

    8. 🔗 @binaryninja@infosec.exchange Today we are giving away 3 Binary Ninja mugs! We’re celebrating 10 years of mastodon

      Today we are giving away 3 Binary Ninja mugs! We’re celebrating 10 years of Binary Ninja with daily prizes and 35% off all Binary Ninja products through August 1. Get the details: https://binary.ninja/10years

    9. 🔗 HexRaysSA/plugin-repository commits Stop baking derived author logins into combined.json rss 
      Stop baking derived author logins into combined.json

The UI now groups publisher pages by metadata.repository_owner (the GitHub
URL owner) instead of a login derived from the self-declared authors list
(plugin-repository-ui feat/publisher-by-repo-owner), so the login /
derivedFromName / repository_owner fields on author entries are dead weight.

Authors in combined.json are now passed through as plain display-only
{name, email} credits; derive_login and the fabricated-login fallback for
authorless plugins are gone (they now credit the repo owner by name).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
    10. 🔗 r/reverseengineering Mellanox/Nvidia ConnectX-5 FW modification tool to enable PCIe Gen 4 on cards that shipped as Gen 3 rss

      submitted by /u/Bulls729
      [link] [comments]

    11. 🔗 r/reverseengineering NEW FIND! Earliest build of MWCCARM Build 0056 (NDS compiler) rss

      submitted by /u/BeansNToasted
      [link] [comments]

    12. 🔗 smol-machines/smolvm smolvm v1.7.0 release

      What's Changed

      • Bump the Nix flake to smolvm 1.6.0 by @BinSquare in #625
      • Fix the pacman repo build so it packages both architectures by @BinSquare in #626
      • Make VM boot failures diagnosable instead of opaque by @BinSquare in #627
      • docs: recommend the unix-socket docker endpoint; document the TCP alternative and its caveats by @BinSquare in #621
      • Add cuda to VmResources for CLI/SDK CUDA-over-vsock by @BinSquare in #628
      • CUDA fork independent serving: copy-on-fork isolation, graph mode, network transport by @BinSquare in #629
      • Detect a stale CUDA guest shim at boot instead of an opaque cuInit failure by @BinSquare in #630
      • feat: expose the docker-socket bridge in the machines HTTP API by @BinSquare in #631
      • Resolve a named config.User to a numeric uid for crun exec (#632) by @BinSquare in #634
      • Warn at launch when CUDA remoting is requested on a host with no usable GPU by @BinSquare in #635
      • CUDA Path 3: address-preserving per-clone-process fork isolation by @BinSquare in #633
      • Bump the workspace to 1.6.1 by @BinSquare in #641
      • Group container tasks under the sandbox shim (fixes containers on containerd 2.2+) by @BinSquare in #643
      • Rebuild the linux libkrun.so with a glibc 2.35 floor and gate it in CI by @BinSquare in #644
      • CUDA Path 3 follow-ups: fork crash fixes, zero-config forkable machines, remote (TCP) clone workers by @BinSquare in #648
      • Route smolmachine pack references through the host-side pack flow instead of the in-guest OCI puller by @BinSquare in #647
      • Stamp pushed smolmachine manifests with the OCI 1.1 artifactType and standard annotations by @BinSquare in #649
      • CUDA fork: release a torn-down golden's VRAM (close leaked export fds) by @BinSquare in #650
      • CUDA fork: fail fast when a clone's worker dies or its lineage is gone by @BinSquare in #652
      • Rename the CUDA fork env vars to describe behavior by @BinSquare in #653
      • release: bundle CUDA shims + smolvm-cuda-run in agent-rootfs by @NickyHeC in #601
      • Stream the pack overlay export to disk by @BinSquare in #654
      • CUDA image machines: run the create workload, and fail fast when no GPU host answers by @BinSquare in #655
      • feat: add --expose-socket and --mount-socket for forwarding arbitrary unix sockets by @BinSquare in #656
      • Run the pack-from-vm helper as the source VM's isolated uid so it can read the source disks by @BinSquare in #658
      • Fix silently dropped CUDA work after a fork-clone reconnect, and rebuild captured graphs in clone workers by @BinSquare in #659
      • Gate engine PRs on compiling the smol CLI and script the release cut by @BinSquare in #661
      • Export the pack sidecar, not the executable stub, when a machine is exported by @BinSquare in #662
      • Route fork clones to workers by an explicit connection preamble so a golden's reconnect can never be misrouted by @BinSquare in #663
      • Never LRU-evict the reference-shared pack store by @BinSquare in #666
      • Fail an image machine's start when the image pull fails by @BinSquare in #669
      • Flatten from-vm packs to a single layer and share the pack export, workload launch, and machine-create env handling in the lib by @BinSquare in #668
      • Cap keep-alive exec output so oversized results return a clear error instead of a frame-too-large crash by @BinSquare in #670
      • Fix file-upload body limit and clarify the oversized-exec-output guidance by @BinSquare in #671
      • CUDA fork: sync-call retry, allocation burst, multi-GPU pinning, sandboxed serve, and machine-create workload by @BinSquare in #672
      • Reload clone-worker modules byte-identical to the golden's images by @BinSquare in #673
      • Recover fork clones whose worker died, and give clone reconnects a real handshake window by @BinSquare in #675
      • CUDA 13 guest surface by @LoganGrasby in #674
      • Re-key the golden's persistent exec overlay to the clone so forks inherit filesystem state by @BinSquare in #677
      • Replay function attributes on clone-worker kernels, and print backtraces on fatal signals by @BinSquare in #676
      • nix/smolvm: bump to v1.6.13 by @BinSquare in #678
      • Route a fork clone's execs to its inherited overlay and heal the restored stale mount by @BinSquare in #680
      • Make fork clones restartable and refuse deleting a golden that still backs live clones by @BinSquare in #683
      • Advertise the CUDA 12.4 surface by default; cu13 wheels opt in via SMOLVM_CUDA_ADVERTISE by @BinSquare in #681
      • Fail a from-vm pack of a never-started machine with a clear error and stop leaking scratch dirs on failed helper boots by @BinSquare in #682
      • Enforce the exec timeout in the keep-alive container path so an image machine's exec honors its deadline by @BinSquare in #684
      • Make a provisioned local volume writable by the per-VM uid that mounts it by @BinSquare in #685
      • Stream exec output live over SSE instead of buffering the whole command to completion by @BinSquare in #686
      • Run a background exec detached inside the machine's keep-alive container so the process survives instead of dying within seconds by @BinSquare in #687
      • chore(libkrun): bump for macOS balloon free-page reclaim by @BinSquare in #689
      • Fix fork-clone serving, sm90 in-VM support, and per-replica module shipping by @BinSquare in #690
      • Enable ring transport and CUDA-graph capture for in-VM serving by @BinSquare in #692
      • Fixing some generic findings from six QA by @BinSquare in #691
      • Relaunch the workload and refresh config from the record on implicit starts by @BinSquare in #694
      • agent: idle balloon-pulse reclaim, on by default by @BinSquare in #693
      • chore(libkrun): bump for balloon cleanup and clone-reclaim persistence by @BinSquare in #696
      • Fork clones reuse the golden's extracted pack layers by @BinSquare in #703
      • Per-fork parameters: machine fork --env KEY=VALUE by @BinSquare in #705
      • Validate resources in the create-machine API so invalid cpu/memory is rejected at create by @BinSquare in #704
      • Block /boot from being mounted into a guest by @BinSquare in #706
      • Validate request env var names on create/exec/run by @BinSquare in #709
      • Take the lifecycle lock when resizing a machine by @BinSquare in #708
      • Reject cmd/entrypoint on an imageless machine create by @BinSquare in #707
      • Don't leak the internal log path when a machine has no logs yet by @BinSquare in #712
      • Remove the dead exec_machine handler and its duplicate OpenAPI exec path by @BinSquare in #716
      • Don't orphan the agent VM when an image pull fails during start by @BinSquare in #714
      • Reject duplicate guest mount targets on the HTTP create path by @BinSquare in #717
      • Validate published ports on the HTTP create path by @BinSquare in #720
      • Hold the lifecycle lock during machine export by @BinSquare in #719
      • Report the real /dev/kvm access failure on post-uid-drop boot failures by @BinSquare in #718
      • Canonicalize the volume path in the deprovision safety guard by @BinSquare in #711
      • Refuse to stop a fork base that has live clones by @BinSquare in #727
      • Validate pinned ports on fork by @BinSquare in #725
      • Validate egress CIDRs on the HTTP create path by @BinSquare in #721
      • Return a clean error instead of panicking on a NUL byte in allow-CIDR/allow-host by @BinSquare in #733
      • Reject duplicate guest mount targets on machine update by @BinSquare in #724
      • Correct the safe_unpack doc comment to match its actual symlink handling by @BinSquare in #736
      • Reject a duration whose seconds value overflows u64 in parse_duration_secs by @BinSquare in #735
      • Close a delete/fork race that could orphan a fork clone's disks by @BinSquare in #726
      • Keep an explicitly stopped machine stopped under restart policies by @BinSquare in #723
      • Register the machine /resize route by @BinSquare in #715
      • Clone graph capture-replay: forked VMs serve with CUDA graphs by @BinSquare in #695
      • Add per-fork secrets to the fork API so each clone gets its own secrets, resolved fresh per exec by @BinSquare in #731
      • Fix the CUDA guest crate builds so they compile without the host feature and on macOS by @BinSquare in #737
      • Fix fork weight sharing so clones import one copy of the weights instead of each privately copying them by @BinSquare in #741
      • Map shared weight chunks read-only so a stray post-fork base write cannot corrupt sibling clones by @BinSquare in #742
      • Bump libkrunfw to the DRM-enabled build so --gpu exposes /dev/dri by @BinSquare in #739
      • docs: describe CUDA API remoting in README by @NickyHeC in #740
      • tiny fix: machine create --from discards --mount-socket and --expose-socket by @Bnjoroge1 in #746
      • Cuda runtime fixes by @BinSquare in #747
      • Attach the machine id to the request span so failures are attributable to a machine by @BinSquare in #748
      • Name the missing credential when a registry denies the pack probe, and reuse a configured image credential for it by @BinSquare in #750
      • Accept registry credentials on machine start so private third-party images can be pulled by @BinSquare in #751
      • Refuse to resize a fork base that has live clones by @BinSquare in #728
      • Classify forking a non-forkable golden as 409, not 500 by @BinSquare in #710
      • Bump the workspace to 1.7.0 for the next engine release by @BinSquare in #752

      New Contributors

      Full Changelog : v1.6.0...v1.7.0

    13. 🔗 backnotprop/plannotator v0.25.0 release

      Follow @plannotator on X for updates

      Missed recent releases? Release | Highlights
      ---|---
      v0.24.2 | Annotate YAML/JSON/TOML config files, XDG data directory support, Codex model catalog update, Cursor sandbox escape hatch
      v0.24.1 | Annotate accepts parent-relative ../ file paths
      v0.24.0 | PR/MR artifact gallery, GitButler review support, port ranges, expanded comment editor, OpenCode + Pi fixes
      v0.23.1 | Startup no longer hangs on large or slow directory trees, Ask AI input stays visible after long responses
      v0.23.0 | Plan approval fix for Claude Code 2.1.199+, annotate mode version diff, binary-only --minimal install, reviews post without attribution
      v0.22.0 | Git-status "All changes" default review view, Commits panel with per-commit diffs, Guided Review, Pi + GitHub Copilot CLI review engines
      v0.21.4 | Markdown math rendering, PR Overview panel with annotatable description and comments, agent instructions in code review, media parsing fixes
      v0.21.3 | File comments in code review, unified click-to-highlight comments, VS Code clipboard/keyboard bridge, Codex Ask AI on app-server transport, CLI subcommand help
      v0.21.2 | Custom reviews as Agent Skills, Cursor + OpenCode review engines, whole-file/general findings, deleted-annotation fix, Codex Ask AI outside git repos
      v0.21.1 | Annotate-last blank-page fix on multi-message sessions
      v0.21.0 | Direct document editing in annotate mode, live git-status file tree, in-app agent terminal, open files in external apps, HTML renders as HTML

      What's New in v0.25.0

      This is the largest community release Plannotator has had. Eighteen pull requests landed since v0.24.2, thirteen of them from community members, and eight authors made their first contribution. The release adds an optional Vim keyboard layer, lets approvals carry your notes to the agent, makes gated annotate sessions scriptable, persists Guided Reviews across sessions, and hardens memory use, file watching, and multi-extension behavior across the board.

      Vim keyboard controls for plan review and annotate

      Plan review and annotate mode now have an optional Vim-style keyboard layer. Turn it on in Settings, then move through the document with j/k by block, refine into inline targets and exact text with l/h and the text motions, select with v/V, and create comments, redlines, and quick labels without touching the mouse. An optional HUD shows a target reticle, live keypress feedback, and a complete ? key map while you learn. It works in raw HTML annotate sessions too.

      Everything is off by default. If keyboard-driven review is not how you work, close the one-time announcement and nothing changes.

      Approve with Notes

      Approving a gated annotate session used to throw away any annotations you had made along the way. Approval was a bare "approved" and your notes vanished. Now approval can carry them: the agent receives your annotations together with the approval across Claude Code, OpenCode, and Pi, with a customizable approvedWithNotes prompt template for tuning the wording. The approve flow also validates stale saved edits instead of silently proceeding, and approve- with-notes anchors to the correct message in multi-message annotate-last sessions.

      Strict automation mode for gated annotate

      plannotator annotate --gate --json always exited 0 no matter what the reviewer decided, so scripts could not use it as a real approval gate. A new strict mode fixes that: --require-approval exits nonzero unless the reviewer approves (configuration errors exit with a distinct code so automation never mistakes a typo for a rejection), and --result-file publishes the decision atomically with a write-temp plus no-clobber rename, so readers never see a partial record. The decision always reaches stdout before file publication, so a failed publish cannot destroy a completed review. Existing non-strict behavior is byte-identical.

      Annotate watches your file, not your whole folder

      Keeping an open source document synchronized with disk used to subscribe to the file's entire parent directory, so unrelated sibling files, nested changes, and git metadata churn all triggered pointless reconciliation. The watcher now tracks exactly the open files, in both the Bun and Pi servers, and survives atomic editor saves and platform quirks that previously could crash the watch on Linux.

      Guided Reviews persist across sessions

      A successful Guided Review is now saved automatically under your data directory, keyed to the repository. The guide screen shows your previous guides with their reviewed-progress, lets you reopen them read-through with per-section reviewed state intact, and flags a guide whose commit no longer matches the head under review. Disable persistence with PLANNOTATOR_GUIDE_HISTORY=0 or "guideHistory": false in config.json.

      Folder annotate sessions get per-file version diffs

      Single-file annotate has shown a "since last review" diff badge for a while. Folder sessions now get the same treatment per file: open a folder, pick a file you have annotated before, and a +N/-M badge shows what changed since your last visit, with rendered and raw diff views. Each file keeps its own version history, shared with single-file sessions of the same file, and the diff view dismisses itself when you switch to a file with no baseline.

      Bounded memory for large untracked files

      An unignored build artifact or large binary in git status could drive the review server to gigabytes of memory, and the freshness poll re-read the file every few seconds. Untracked files over 5 MiB now render as binary additions without loading their contents, freshness checks use size and mtime metadata instead of reading files, untracked diff generation is capped at four concurrent git processes, and oversized content is refused by the file-content endpoint in both runtimes.

      Disable AI features for managed deployments

      PLANNOTATOR_AI=disabled turns off Ask AI, Review Agents, and Guided Review launches across every server. The AI runtime is never constructed, so no agent processes are spawned or left idle, which matters on shared multi-user machines. Review and annotate flows work normally, saved guides remain readable, and capability probes degrade gracefully for older clients.

      OpenCode feedback goes to your agent, not a hardcoded one

      Review feedback in OpenCode was hardwired to hand off to an agent named build. If you had disabled or renamed it, every feedback send failed silently. Feedback now defaults to whatever agent you were already talking to, and a configured agent name is validated against your live agent list before sending, with a warning toast and graceful fallback when it is missing. Plan approval keeps its automatic build handoff, so the plan-to-build workflow is unchanged.

      Pi extension plays well with other extensions

      Plannotator's Pi extension used to restore a snapshot of the global tool list when switching phases, wiping out tools other Pi extensions had activated or deactivated in the meantime. It now tracks exactly the tools it added for a phase and releases only those, leaving everyone else's selections alone. The planning phase always includes plannotator_submit_plan, even with a custom planning.activeTools configuration.

      External plan execution handoff for Pi

      An opt-in executionMode: "external" setting lets a companion extension own execution. On approval, instead of entering the executing phase, Plannotator restores the pre-planning state and emits a plannotator:plan-approved event carrying the plan path, content, working directory, and any approval feedback. Automatic execution remains the default and is unchanged.

      Faster Pi extension loading

      The Pi extension's imports now use exact .ts relative specifiers instead of extension probing, which cuts the module resolution work Pi's loader does on every session start.

      Additional Changes

      • Zed Preview in Open In App - Zed's beta channel installs as a separate app on macOS; it is now its own entry in the Open In App menu, shown only when installed. On Linux and Windows the preview channel ships the plain zed binary, so the existing entry already covers it. By @backnotprop in #1130, closing #1119 requested by @graemefolk
      • YAML block scalars in frontmatter - frontmatter values using | and > block scalars now parse correctly, including CRLF sources. By @ruaridhw in #1101
      • Copying file annotations uses the right template - the annotate-mode Copy button produced a plan-rejection message instead of annotate feedback. By @backnotprop in #1109, closing #1107 reported by @ZBQtesla
      • Windows cross-drive path fix - annotation paths no longer break when the repository and temp directory live on different drives. By @BenNewman100 in #1117
      • Save is the first tab stop in the comment popover - keyboard users tab from the comment textarea straight to Save, with the visual layout unchanged. By @balasivagn in #1122, closing #1121
      • VS Code extension on Open VSX - the extension (v0.16.8) is published to Open VSX for VSCodium and other non-Microsoft editors, requested by @7tg in #1110
      • Pi npm packaging fix - the published Pi package now ships every module it imports; a missing file would have broken npm installs of this release
      • GitButler review workflow docs - the README documents reviewing GitButler workspaces

      Install / Update

      macOS / Linux:

      curl -fsSL https://plannotator.ai/install.sh | bash

      Windows:

      irm https://plannotator.ai/install.ps1 | iex

      Claude Code Plugin: Run /plugin in Claude Code, find plannotator , and click "Update now".

      OpenCode: Clear cache and restart:

      rm -rf ~/.bun/install/cache/@plannotator

      Then in opencode.json:

      {
  "plugin": ["@plannotator/opencode@latest"]
}

      Pi: Install or update the extension:

      pi install npm:@plannotator/pi-extension

      What's Changed

      • fix(ui): parse YAML block scalars in frontmatter by @ruaridhw in #1101
      • perf(pi-extension): use exact .ts relative specifiers by @dca123 in #1106
      • fix(annotate): use annotate feedback template for clipboard copy by @backnotprop in #1109
      • feat: persist Guided Reviews across sessions by @backnotprop in #1115
      • fix(review): treat cross-drive relative() results as repo escapes by @BenNewman100 in #1117
      • fix(review): bound memory for large untracked files by @kcosr in #1118
      • feat: add an option to disable AI features by @kcosr in #1129
      • fix(ui): move Save to the first tab stop in the comment popover footer by @balasivagn in #1122
      • feat(core): add Zed Preview as an Open In App target by @backnotprop in #1130
      • feat(annotate): extend per-file version diff to folder sessions by @BenNewman100 in #1105
      • fix(annotate): watch open source files exactly by @rNoz in #1089
      • feat(annotate): add strict atomic result output by @rNoz in #1091
      • feat(annotate): preserve notes on structured approval by @rNoz in #1092
      • fix(opencode): fix hardcoded default build agent when sending responses by @cb-bradbeebe in #1131
      • feat(editor): add Vim keyboard annotation controls and live HUD by @backnotprop in #1127
      • fix(pi): preserve extension tool selections by @CodeByPeete in #1124
      • feat(pi): add external plan execution handoff by @cgngtr in #1126
      • docs: add GitButler review workflow by @backnotprop in #1111

      New Contributors

      Contributors

      @rNoz shipped a three-PR stack built from daily use: exact file watching, the strict automation gate, and Approve with Notes, stress-tested on a personal integration branch before ever reaching review. @BenNewman100 fixed Windows cross-drive paths and extended the version diff to folder sessions, keeping the branch current across three weeks of upstream churn. @kcosr contributed the memory bounds and the AI kill switch, both born from running Plannotator on shared agent infrastructure. @cb-bradbeebe diagnosed the hardcoded agent bug, proposed the fix on the issue, and delivered it with validation and tests. @CodeByPeete made the Pi extension a good citizen among other extensions, and @cgngtr built the external execution handoff on top of that model days after it landed. @ruaridhw fixed frontmatter block-scalar parsing, @dca123 made the Pi extension load faster, and @balasivagn improved comment- popover keyboard accessibility.

      Community reports and requests shaped the release throughout:

      Full Changelog : v0.24.2...v0.25.0

    14. 🔗 r/reverseengineering /r/ReverseEngineering's Weekly Questions Thread rss

      To reduce the amount of noise from questions, we have disabled self-posts in favor of a unified questions thread every week. Feel free to ask any question about reverse engineering here. If your question is about how to use a specific tool, or is specific to some particular target, you will have better luck on the Reverse Engineering StackExchange. See also /r/AskReverseEngineering.

      submitted by /u/AutoModerator
      [link] [comments]

    15. 🔗 r/reverseengineering Reverse engineering Dauntless 1.12.0 to restore private-server functionality - Mystic Paradox rss

      submitted by /u/No_Durian_5657
      [link] [comments]

    16. 🔗 HexRaysSA/plugin-repository commits sync repo: +1 release, -1 release rss 
      sync repo: +1 release, -1 release

## New releases
- [idalib-rust-bindings](https://github.com/idalib-rs/idalib): 0.10.0

## Changes
- [IDASQL](https://github.com/allthingsida/idasql):
  - removed version(s): 0.0.8

generated: July 30, 2026 at 01:11:10