🏡
  • ↔
  • →
  1. October 20, 2026
    1. 🔗 roboflow/supervision supervision-0.31.1 release

      v0.31.1 — Recall that matches COCO, boxes that don't overflow

      A bug-fix release: recall scores now agree with COCO, and half-precision boxes stop overflowing.

      • MeanAverageRecall skips crowd regions and matches predictions in confidence order, like pycocotools.
      • COCO segmentations loaded without an area field no longer make mAP return -1.
      • float16 boxes keep finite areas, and mAP and with_nmm stop overflowing on narrow coordinate types.
      • Mask and halo annotators draw on grayscale scenes, and vertex annotators accept (x, y, z) points.
      • Without OpenCV, ellipses and thick circles render like OpenCV 5, and grayscale images save correctly.

      Drop-in upgrade, no code changes. mAR values can move: up on COCO data with crowd annotations, and in either direction where confidence order now decides which prediction claims a target.

      ✨ Spotlights / highlights

      Recall that matches COCO

      sv.metrics.MeanAverageRecall used to count COCO crowd regions as missed objects and to pair predictions with the highest-IoU target first. It now leaves out targets with data["iscrowd"] or data["ignore"] set, the same rule MeanAveragePrecision uses. It also matches predictions in descending confidence order with COCO's tie rule, and counts an oriented-box IoU of exactly 0.55, 0.6, 0.8 or 0.85 as a match at that threshold. One target, one crowd target and a perfect prediction now score 1.0 instead of 0.5. (#2750, #2758, #2752)

      import numpy as np
import supervision as sv
from supervision.metrics import MeanAverageRecall

targets = sv.Detections(
    xyxy=np.array([[0, 0, 10, 10], [20, 20, 30, 30]], dtype=float),
    class_id=np.array([0, 0]),
    data={"iscrowd": np.array([0, 1])},
)
predictions = sv.Detections(
    xyxy=np.array([[0, 0, 10, 10]], dtype=float),
    class_id=np.array([0]),
    confidence=np.array([0.9]),
)
MeanAverageRecall().update(predictions, targets).compute().mAR_at_100  # 1.0

      Half-precision boxes that stay finite

      A 256×256 box in float16 has an area of 65,536, which is past float16's maximum, so Detections.box_area returned inf and area filters dropped it. Box areas of float16 detections are now computed and returned in float32, and MeanAveragePrecision and with_nmm no longer overflow on float16 or narrow integer coordinates either. COCO segmentations loaded with masks but without an area field now get it from the decoded mask, so those targets stay in their size bucket instead of turning mAP into -1. (#2764, #2743, #2753, #2763)

      import numpy as np
import supervision as sv

detections = sv.Detections(
    xyxy=np.array([[0, 0, 256, 256], [0, 0, 0.01, 0.01]], dtype=np.float16)
)
detections.box_area  # array([6.5536000e+04, 1.0004273e-04], dtype=float32)

      Grayscale scenes and 3D keypoints in annotators

      sv.MaskAnnotator and sv.HaloAnnotator raised ValueError on single- channel images. They now accept (H, W), (H, W, 1) and Pillow "L" scenes, painting the gray value OpenCV would write for the same color. VertexAnnotator and the vertex-ellipse annotators draw (x, y, z) keypoints from their x and y, where they used to fail on tuple unpacking. (#2755, #2759)

      import numpy as np
import supervision as sv

scene = np.zeros((100, 100), dtype=np.uint8)
mask = np.zeros((1, 100, 100), dtype=bool)
mask[0, 20:60, 20:60] = True
detections = sv.Detections(
    xyxy=np.array([[20, 20, 60, 60]], dtype=float), mask=mask, class_id=np.array([0])
)
sv.MaskAnnotator().annotate(scene.copy(), detections).shape  # (100, 100)

key_points = sv.KeyPoints(xy=np.array([[[10, 10, 0.5], [50, 50, 1.0]]], dtype=np.float32))
sv.VertexAnnotator().annotate(np.zeros((64, 64, 3), dtype=np.uint8), key_points)

      Drawing without OpenCV, closer to OpenCV

      The NumPy fallback used when OpenCV is not installed now ports OpenCV's ellipse rasterization, and thick circle outlines are centred on the radius instead of shrinking inward by half their thickness. Both match OpenCV 5.0 pixel for pixel in the reference tests. Without OpenCV, this changes the pixels drawn by EllipseAnnotator, RoundBoxAnnotator, the vertex-ellipse keypoint annotators, CircleAnnotator and DotAnnotator outlines. Image writing now accepts (H, W, 1) grayscale arrays and saves BGRA images as JPEG, and video reading handles files whose audio stream comes before the video stream. (#2740, #2765, #2754, #2746)

      🔄 Migration guide

      No migration required for this release.

      📝 Notable changes

      🔧 Fixed

      MeanAverageRecall and COCO

      • sv.metrics.MeanAverageRecall counted COCO crowd and ignored targets as missed objects and paired predictions by highest IoU first; it now skips those targets and matches in descending confidence order with COCO's last-target tie rule, as COCO does. (#2750, #2758)
      • Oriented-box MeanAverageRecall, Precision, Recall and F1Score missed matches whose IoU was exactly 0.55, 0.6, 0.8 or 0.85, because the IoU was float64 and the thresholds float32. (#2752)

      Overflow-safe boxes

      • Detections.box_area and box-based Detections.area overflowed to infinity for ordinary float16 boxes; they now compute and return float32. (#2764)
      • sv.metrics.MeanAveragePrecision overflowed box extents and areas for float16 or narrow integer coordinates, so perfect large boxes scored -1 or landed in the wrong size bucket. (#2743)
      • sv.Detections.with_nmm overflowed its area-weighted confidence for float16 boxes and, at extreme coordinates, for integer and float32 boxes. (#2753)
      • COCO loading with masks left segmented annotations without an area field with a NaN area, which pushed them out of every mAP size bucket; the area now comes from the decoded mask. (#2763)

      Masks and polygons

      • resize_masks returned an empty array when downscaling very narrow masks; it now keeps at least one pixel per axis. (#2762)
      • sv.filter_polygons_by_area and sv.polygon_to_xyxy raised ValueError on empty polygons; they now treat them as zero area and an all-zero box. (#2761)

      Annotators

      • sv.MaskAnnotator and sv.HaloAnnotator raised ValueError on grayscale scenes. (#2755)
      • VertexAnnotator and the vertex-ellipse annotators raised a tuple-unpacking error on three-coordinate keypoints; they now draw from x and y. (#2759)
      • sv.MaskAnnotator widened its blend region to the boxes of all-empty masks, including CompactMask, copying and blending outside the foreground. (#2741)

      Without OpenCV

      • The fallback ellipse painted different pixels from OpenCV for thick strokes, fills and arcs; it now ports OpenCV's rasterization. (#2740)
      • The fallback circle grew thick outlines inward from the bounding box, shrinking them by half their thickness; they are now centred on the radius. (#2765)
      • Image writing rejected (H, W, 1) grayscale arrays and lost BGRA images saved as JPEG. (#2754)
      • Video reading failed on files whose audio stream comes before the first video stream. (#2746)

      🏆 Contributors

      Welcome to our first-time contributors, Ghanashyam V Narayan and jorge!

      • NIKHIL (@Nikhi00718) — fixed overflow in box areas, mAP and with_nmm, derived missing COCO areas, and fixed image writing and video reading without OpenCV.
      • Kaushik Reddy Lingireddy (@Lingikaushikreddy) — made MeanAverageRecall skip crowd targets and match by confidence, and fixed oriented-box threshold matching.
      • peng xiang (@px12811) — ported OpenCV's ellipse rasterization to the fallback and fixed mAR tie-breaking.
      • A Aswanth Raj (@aswanth-07) — fixed three-coordinate keypoint drawing and narrow-mask resizing.
      • Mohammad Hijjawi (@MohammadHijjawi97) — made MaskAnnotator and HaloAnnotator work on grayscale scenes.
      • kevin (@kevin9327) — centred thick fallback circles on their radius.
      • Ghanashyam V Narayan (@ghanashyam03) — made the polygon helpers accept empty polygons.
      • jorge (@jorge-asenjo) — kept empty compact masks out of the mask blend region.
      • Jirka Borovec (@Borda) — prepared the release.

      Full changelog : 0.31.0...0.31.1

    2. 🔗 backnotprop/plannotator v0.28.24 release

      Follow @plannotator on X for updates

      Missed recent releases? Release | Highlights
      ---|---
      v0.28.23 | Inbox replies reach sessions with background subagents, dictated text no longer goes missing, 👍 Looks good reaches the agent, notifications that never fail silently
      v0.28.22 | 👍 Looks good, full view for files, one viewer for a thread's images and files, every session prints its URL, PLANNOTATOR_BROWSER=none opens nothing
      v0.28.21 | Message an agent from the Inbox, video attachments, Open in for attachments, Code / Tests / Generated in code review, writes from other websites refused
      v0.28.20 | Inbox search (⌘K), real folder names for projects, data files open in the code view, word-only replies leave questions open
      v0.28.19 | Ask this session in T3 Code, folder sessions load shared stylesheets and images, the agent note asked once per agent, Copy connect prompt
      v0.28.18 | plannotator inbox connects your agents, agents are told when to use the Inbox, rendered Markdown in code review, Inbox Settings in sections
      v0.28.17 | The Inbox on iPads and narrow windows, the reply bar no longer cuts off "Keep open", a Pi crash on /reload fixed
      v0.28.16 | The Inbox on a phone, a doorbell for new questions, Mark read, step through a thread's files, replies when the asking session ended
      v0.28.15 | Long Inbox threads fold to what is new, "Skipped N questions" replies, Inbox list and sidebar fixes
      v0.28.14 | Agents can replace an earlier question, comment on a guided review in the Inbox, issue numbers link to the repository
      v0.28.12 | Update notices and plannotator update, attach any file to an Inbox message, questions with context, links to attached files

      What's New in v0.28.24

      A big Inbox release: a new look, Send now, tagging agents, comments on an agent's own words, and much smaller reads for agents. Links inside HTML pages now work everywhere you annotate. 23 PRs, all by @backnotprop.

      Plannotator Inbox

      A new look

      The Inbox has a softer, calmer design, with tooltips that match the app instead of the browser's. A new text size setting (Settings → General, 12 to 15) makes everything larger or smaller at once.

      Send now

      After you send a reply, the line under it says whether it is queued (the agent is busy and gets it when its turn ends) or on its way. Send now puts it into the agent's running turn right away, on Claude Code, Pi and OpenCode 2.

      Tag agents

      Type @ in a reply or a comment to choose which agents get it.

      Comment on an agent's message

      Select any words in an agent's message and comment on them, the same way you comment on an attached file. Your comments go with your next reply.

      Agents read much less

      When an agent reads a long thread, it now gets the newest messages in full and older ones as one line each, with the option to open any of them. A 46-message thread went from about 48,000 tokens to about 7,000. Agents can also search the Inbox.

      Knowing when to update Claude Code sessions

      When a Claude Code session still runs an older Plannotator plugin than the one installed, the Inbox says so and shows how to load the new one.

      One full-screen mode for files

      Every kind of attached file opens full screen the same way.

      Removed: the Decisions page. The Inbox no longer has a Decisions page, and agents no longer have the tools that recorded decisions.

      Smaller changes

      • The skill picker in New message opens right under the line you are typing instead of behind the footer (#2004)
      • New message is in the list header while the sidebar is closed (#1987)
      • The toast sits at the bottom of the window and its words are never cut off (#1988)
      • The notification line above the list reads more cleanly (#1989)
      • Rows that Show brings in stay highlighted a little longer (#2003)

      Plannotator

      Links in HTML pages work

      In HTML you annotate, and in HTML pages attached in the Inbox, a click on a link now follows it and ⌘-click (Ctrl-click) pins it for a comment. On a phone, a tap follows and a press-and-hold comments. Live apps follow the same rule.

      Smaller changes

      • Docs: WSL2 needs no remote mode, so Ask this session stays on (#1984); the guide skill is now called guided-review, with a new guided-plan skill (#1996); the @plannotator/ui handoff docs are up to date (#1986)

      Install / Update

      macOS / Linux:

      curl -fsSL https://plannotator.ai/install.sh | bash

      Windows:

      irm https://plannotator.ai/install.ps1 | iex

      Claude Code Plugin: The plugin and the plannotator binary update separately, so run the install script above as well. In a terminal:

      claude plugin marketplace update plannotator
claude plugin update plannotator@plannotator

      Then restart Claude Code. Inside Claude Code, run /plugin marketplace update plannotator, then open /plugin → Installed → plannotator → Update now.

      Pi:

      pi update --extensions

      OpenCode: Re-run the install script above. It now also clears the OpenCode 2 plugin cache.

      What's Changed

      Community

      Every PR in this release is by @backnotprop.

      • @balaji-dutt reported that Ask this session was off under WSL2 even though the review page was only reachable on the same machine (#1983), which led to the WSL2 docs fix.

      Full Changelog : v0.28.23...v0.28.24

    3. 🔗 exe.dev The Topology of an LLM Agent Loop With Tool Use rss

      When I look at a new agent, I break it down by focusing on its topology. An agent is three things:

      1. A model. Your model choice defines the agent’s “smarts,” i.e., which tasks it can accomplish.
      2. The agentic loop (see: The Unreasonable Effectiveness of an LLM Agent Loop with Tool). Loop choice determines UX.
      3. The set of tools. This defines the capabilities and power (and blast radius) an agent has.

      (2) and (3) together are often called “the harness.”

      Three circles: Model (local? open weight? 4 cursed API shapes, physical location? size? speed? cost), Agent Loop (local or remote? where is message history? permissions? UI, subagents?), and Tools (bash? if so, where? MCP? Code Mode? asynchronous?). Agent Loop and Tools together are bracketed as the Harness.

      All of this is code, and code has to run somewhere. Where these run—the topology of these agents —has implications on cost, capability, effectiveness, and security for companies building AI products and people using AI tools.

      Example 1: Claude Code

      Claude Code on your laptop uses Anthropic’s hosted model, runs the agentic loop on your laptop, and runs the tools also on your laptop.

      Three circles. Model: Cloud (Anthropic). Loop: Your laptop. Tools: Your laptop.

      Example 2: ChatGPT

      ChatGPT uses OpenAI’s hosted model, runs the agentic loop on their backend server, and runs tools also on their backend servers.

      Three circles. Model: Cloud (OpenAI). Loop: Cloud (OpenAI). Tools: Cloud (OpenAI).

      Example 3: Siri on your Mac

      Siri on your Mac uses a mix of models: smaller ones run on your Mac, and bigger ones run in Apple’s Private Cloud Compute. The agentic loop runs on your Mac, and so do the tools, like the one that reads your Messages.

      Siri on a Mac. Asked “How many iMessage messages did I receive today?”, it answers “You have three new messages in Messages.” Three circles. Model: split by a dashed line into Your Mac and Cloud (Apple). Loop: Your Mac. Tools: Your Mac.

      Example 4: Amp Orbs

      Amp Orbs use models from Anthropic, OpenAI, and others, run the agentic loop in Amp’s backend, and run the tools in your Orb, a VM that Amp creates for each thread with your code on it.

      Three circles. Model: Cloud (Anthropic, OpenAI, etc.). Loop: Cloud (Amp). Tools: Your Orb VM.

      Example 5: Shelley on exe.dev

      If you’re using our Shelley coding agent on an exe.dev VM, the model is hosted, and the agent and the tools run on the VM.

      Three circles. Model: Cloud (Anthropic, OpenAI, etc.). Loop: Your exe.dev VM. Tools: Your exe.dev VM.

      In all of these cases, remote MCP servers can expose tools running elsewhere.

      Where Is the Model?

      Your choices here are GPUs hosted by someone else or your own GPUs.

      As the controversy around the Navier-Stokes equation reminds us, the only way to be confident nobody is training on your data is to not send your data to them. If you’re working on common problems, it probably doesn’t matter. But I suspect a hapax legomenon could end up in the training data somewhere.

      If I want to, say, use some LLMs to OCR and classify some scanned bills on my computer, I’m reaching for local models, because speed doesn’t matter (it can run overnight), and privacy is guaranteed. (Shout out to the Apple Vision Framework, by the way. And ScanShelf is an example where I do this!)

      Ken Thompson’s 1984 Turing Award lecture, Reflections on Trusting Trust, hits different now. That paper poses how a Trojan Horse could be hidden in a compiler, invisible in the compiler’s source code, as it’s propagated by the compiler. The LLM (a compiler? maybe? no?) could have some tampered weights that lead the agent to do something naughty; it’s been tried. We must choose which vendors to trust.

      LLMs are wreaking havoc on traditional SaaS cost structures as well. If you have, for example, a diagram-drawing SaaS, and you want to let your users use agents to edit the diagrams: who’s paying for the tokens? Before agents, your costs were a few database rows per customer; now that customer can rack up a $100 bill with a few sentences. At exe.dev, our users can bring their own ChatGPT subscriptions to build applications with OpenAI models. This is a win- win. I expect we’ll see more “bring your own model” options.

      This is my bespoke drawing editor, with a built-in agent. You’re going to see “agent drawers” in every product.

      Where is the loop?

      If you’re using, say, ChatGPT, the loop is running in OpenAI’s servers. If you’re running a coding agent, the loop is running on your laptop. The loop could run in a web browser (e.g., as I did in ItsyBitsy, and as many others have as well).

      I have found over and over again that I find other people’s loops limiting. For example, I much prefer pointing my preferred agent at my source code and my observability tooling rather than using the observability vendor’s agent loop.

      The loop has to maintain the message history (since an LLM agent is operating on the entire history), and that has to be stored somewhere. Storing it in SQLite for Shelley remains a decision I’m very happy with. Pi Durable also offers SQLite.

      JSONL, crossed out

      The loop also provides the UI for the agent. Can it display images? Are there customizations to give feedback on video? Is it limited to plain text? Can it handle attachments? Can a conversation be shared? All of these are choices the loop must make.

      Where are the Tools?

      Agents aren’t agents without tools. The jump from one “completion” from an LLM to an agentic loop is transformational. If an agent can empirically test the thing it’s writing, the results are better.

      The problem with executing code is that, well, you have to do it somewhere, and you have to assume that the code being executed is unpleasant and will steal all the cookies from your pantry and set off the fire alarms at night unnecessarily (or worse).

      The code execution isn’t lightweight: it’s not all editing files; compilation, video processing, running tests… the workload can be heavy.

      Virtual Machines are the gold standard for executing code safely. Even with VMs, there are tons of variables: can it talk to the network? Does it have credentials to talk to other services? Is there enough memory?

      Running coding agents locally works too, but the blast radius for the “Lethal Trifecta” is bigger. Exposure to untrusted content could lead the agent to leak secrets, for example.

      You can build many useful agents without a full machine. Pyodide, a Python running in WASM, is sandboxable without a full machine. Likewise, there are several WASM JS implementations. You can always run the agent loop on the browser, too, which runs sandboxed code day in and out. (See https://blog.philz.dev/blog/sandboxes/ for a short list of some of these approaches.) You can also give an agent the ability to run SQL on a readonly database connection, and that’s pretty safe!

      Note that the tools don’t have to be in the same address space as the loop; they don’t even need to be in the same neighborhood. When you’re using a “Connector” in ChatGPT (roughly their word for MCP), you’re giving the agent loop (which is hosted by OpenAI) access to resources somewhere else. Concretely, if you use the exe.dev MCP, your ChatGPT can operate on your exe VMs. When you’re talking about MCP, map out where the OAuth tokens are held.

      To make their products useful, Muse, GrokBot, OpenAI Dots, and so on are all providing VMs.

      Mapping Agents

      There are tradeoffs everywhere you look. Framed as topology, you can break down any agentic product. Once you know what’s running where, you can reason about what a product can and cannot do.

      In my work at exe.dev, I use five independent agentic loop implementations nearly every day. (Our coding agent, Shelley; our alert agent, Sisyphus; our deployment supervisor, Athena; an ops agent, Puck; our repo news Slack agent.) Shelley is a general purpose coding agent, but the other four are bespoke software. More and more software will ship with agentic loops built-in.

      I also constantly interact with other systems, and use agents to glue them together. The companies that get it make their product legible to coding agents. I can just smell Clayton Christensen's Innovator's Dilemma as I switch from better, more polished, established products to ones that let me point an agent at them. Of the nine points in Revisiting Joel’s Test, this is the most important one.

      There is no “one loop to rule them all.” Good UX (and a good set of tools) for a general-purpose chatbot is not the same as good UX for a coding agent.

      I leave you with the most useful code of the year. When you insert agents into your products, think of the topology of those agents.

      def loop(llm):
    msgs, msg = [], user_input()
    while True:
        msgs += [msg]
        output, tool_calls = llm(msgs)
        print("Agent: ", output)
        if tool_calls:
            msg = [ handle_tool_call(tc) for tc in tool_calls ]
        else:
            msg = user_input()
    4. 🔗 r/LocalLLaMA Deepseek released DeepInfer - Open Source high-performance, large-scale inference framework for DeepSeek models! rss

      Deepseek released DeepInfer - Open Source high-performance, large-scale inference framework for DeepSeek models! | This is crazy good for studying to improve existing custom engines by community like gufo, halogen, strixite, Strata... by learning their secret sauces. submitted by /u/feelspeaceman
      [link] [comments]
      ---|---

    5. 🔗 r/LocalLLaMA 24GB is plenty if your engines take turns rss

      24GB is plenty if your engines take turns | System service that watches your card, swaps and loads whatever you want, whenever you want. Don’t have to swap anything manually, collisions avoided, VRAM fully dedicated to each function while it’s running (no VRAM squatters). I had issues everyday (Linux) where a node process would orphan, comfyUI auto starts and holds 500MB that strata can’t claim. I also wanted to be able to switch natively and not have to think about starting each engine, making sure strata or llama wasn’t stuck loaded, or flux GGUF’s still claimed in comfyUI from an old workflow. I swap between Ninfer-4090 (llama-swap), strata, comfyUI, OpenWebUI, and I do it between multiple devices all using the same RTX 4090. Maybe you want to have your box run Hermes at night and you take the card back in the day, you can do it natively without thinking about and have full visibility on what was done and when. Berth will also serve your engines as an API so when you need to switch natively you load berth as the API endpoint and you can load strata, polystrata, and any other custom engine. Works for gaming as well, you don’t have to worry about a cron job, a request, or anything grabbing the card while you’re gaming or doing custom workflows. REPO: https://github.com/T-Crypt/berth submitted by /u/Distinct-Pie2389
      [link] [comments]
      ---|---

    6. 🔗 Filip Filmar Bazelizing Third-Party FPGA Designs: Two Case Studies rss

      Converting existing open-source FPGA projects to Bazel and rules_openxc7 makes hardware builds reproducible, eliminates machine-specific paths, and enables one-command bitstream generation without vendor licensing hurdles. This article examines two real conversions of external repositories: mmRISC-2, a silicon-proven RISC-V SoC with heavy SystemVerilog hierarchies, and Custom RISC CPU with Systolic Matrix Accelerator, a pipelined processor paired with a 2D systolic array coprocessor. Both examples illustrate how Bazel transforms fragile build scripts into reliable, sandboxed workflows.

  2. October 19, 2026
    1. 🔗 IDA Plugin Updates IDA Plugin Updates on 2026-10-19 rss

      IDA Plugin Updates on 2026-10-19

      New Releases:

      Activity:

      • oh-my-dump
        • ee60b0dd: ci: parameterize builds and bundle release assets
        • f57347cd: ci: attach standalone DLL to releases
        • 0af0b1c0: ci: preserve release title format
        • ef591292: build: update IDA SDK library lookup
        • c0209d05: ci: build on pushes and PRs, publish releases on tags
        • 5bf11189: chore: update plugin metadata and bump version to 1.0.16
    2. 🔗 Quarkslab's blog MbedTLS Security Audit rss

      Introduction

      Mbed TLS is a widely deployed open-source TLS, DTLS, and X.509 library maintained by Trusted Firmware, targeting constrained and embedded environments. It is used as the cryptographic backbone of products across the IoT, automotive, and industrial sectors, and forms the TLS layer for projects such as the Trusted Firmware family.

      Version 4.0 represents the most significant architectural change in the project's history. The cryptographic layer has been extracted into a standalone library, TF-PSA-Crypto, which implements the PSA Cryptography API v1.2 as specified by Arm. The Mbed TLS repository now consumes TF-PSA-Crypto as a submodule, and the configuration space has been split across two header files: mbedtls_config.h for the TLS and X.509 options, and psa/crypto_config.h for the cryptographic primitives. All RNG callbacks have been removed in favor of a mandatory call to psa_crypto_init() before any operation.

      The Open Source Technology Improvement Fund (OSTIF) commissioned Quarkslab to perform a security audit of this new architecture.

      Scope

      The primary objectives of this audit are:

      • Architectural transition review. Assess the security implications of the Mbed TLS 3.x to 4.0 split, focusing on the trust boundary between the TLS layer and TF-PSA-Crypto, the correctness of the PSA API integration, and whether the removal of the legacy crypto paths introduces new attack surface.

      • PSA API usage correctness. Verify that key attributes (usage flags, permitted algorithms, lifetimes) are correctly set and enforced throughout the TLS and X.509 code paths, and that the mandatory psa_crypto_init() dependency is properly documented and enforced.

      • Memory safety. Identify memory corruption vulnerabilities in the SSL/DTLS context management (in particular, session serialization and resumption), the X.509 parsing subsystem, and the PSA key store.

      • Default configuration posture. Review the security of the default build configuration, including enabled cipher suites, protocol versions, key exchange algorithms, and compile-time options that may expose users to risk without explicit opt-in.

      • Protocol compliance. Identify deviations from the TLS 1.2 (RFC 5246), TLS 1.3 (RFC 8446), and DTLS specifications that have security consequences.

      The engagement covers:

      • Mbed TLS at commit 0fe989b6b514192783c469039edd325fd0989806.
      • TF-PSA-Crypto (integrated submodule) at commit 29160dd877d29658279fd683b2ae57b320ddcf09.

      The complete technical report, including our findings and recommendations, is available in Quarkslab's public reports repository.

      Findings

      The table below summarizes the findings of the audit. A total of 5 vulnerabilities were identified: 1 of high severity, 1 of low severity, and 3 informational ones.

      ID | Title | Severity | Perimeter | HIGH-1 | CID Buffer Overflow in mbedtls_ssl_context_load() | High | library/ssl_tls.c:5002
      ---|---|---|---
      LOW-4 | mbedtls_pk_verify() accepts BER-encoded signatures | Low | tf-psa-crypto/extras/pk.c
      INFO-2 | No Anti-Replay Protection for TLS 1.3 0-RTT Early Data | Info | include/mbedtls/ssl.h:5166
      INFO-3 | Mismatch in CMAC cipher support between the documentation and the implementation. | Info | TF-PSA-Crypto documentation
      INFO-5 | compat.sh DTLS 1.2 tests fail on the mbedtls-test Docker image due to IPv6 localhost resolution | Info | mbedtls-test Docker images, compat.sh

      Note: All relevant findings have since been resolved.

      Conclusion

      The audit identified a few vulnerabilities with only two non-informational ones, and the auditors were overall very satisfied with the quality of the product in general, and this version's changes in particular.

      The high and low vulnerabilities are related to a heap buffer overflow and potential signature malleability, respectively, with the second one being identified thanks to the integration of integration of Project Wycheproof test vectors into the test suite.

      An informational finding documents the absence of any anti-replay protection for TLS 1.3 0-RTT early data, a known limitation that is currently not surfaced in the public-facing documentation in a way that prevents inadvertent misuse. Auditors have proposed improvements to the existing fuzzing harnesses and corpora, along with an integration of the #anv test suite into the CI/CD pipeline.

      We would like to thank the Mbed TLS maintainers for their responsiveness and collaboration throughout the audit process, as well as the OSTIF team for their continuous support.

      Further details can be found in our report.

      Further reading

    3. 🔗 exe.dev Join Us: exe's First Meetup in San Francisco rss

      Maybe it's the years we spent on Zoom? San Francisco seems hungry for in- person events, and we're no exception.

      We're hosting our first technical meetup for developers on Monday, October 26, from 6 to 9pm at the Sentry office in San Francisco. The question of the evening: Are we running too many agents?

      The topic comes from Josh's recent post, ETOOMANYTHINGS? Run Fewer Agents, which sparked some interesting discussion online. We figured it would be fun to continue the conversation and debate in person.

      We've invited a few exe friends to give some talks on the theme:

      • Josh Bleecher Snyder is the cofounder of exe and the person who got this whole conversation started. He'll be talking about whether we're building software factories incorrectly.
      • Beyang Liu is working on amplifying human agency at Amp and previously cofounded Sourcegraph.
      • Josh Wills is an engineer at DatologyAI, with a long history of building developer tools and infrastructure.

      We'll follow the talks with an open Q&A. Bring your questions and opinions to participate in the conversation.

      There will be pizza and drinks, too. A big thank you to Sentry for sponsoring.

      We'd love to have you there. Sign up here: https://luma.com/0qr6bxcw

    4. 🔗 crosspoint-reader/crosspoint-reader v2.0.0rc release

      CrossPoint 2.0.0

      What a busy month. A lot of new features landed in CrossPoint, and we're eager to hear what you think.

      New devices

      This release adds support for four ESP32-S3-based devices: the Metalio E-Ink 4, the EEGO A4 (standard and Lite versions), and the BOOX Picco. If you're thinking of buying one, you'll find links at https://crosspointreader.com/devices. That page uses our affiliate links, so buying through it helps support CrossPoint.

      SD card plugins

      CrossPoint now supports plugins installed on the SD card. A plugin can add book catalogs and downloads to the reader, or tools to the device's web interface. To show the Plugins entry on Home, enable Plugins under Settings → Connectivity.

      Plugins are not apps that run arbitrary code on the reader. On-device plugins use the screens and operations the firmware already provides, such as sign-in, catalogs, downloads, and supported reading events. They can't replace the reading engine, install hardware drivers, or add unsupported document formats.

      Some plugins include JavaScript, but that code runs in a browser on your phone or computer, so the browser page has to stay open while it works. For example, a browser plugin can turn articles or RSS feeds into an EPUB, which you then read on the device.

      The plugin system will stay focused on reading and book services. It won't become a platform for on-device games, calculators, notepads, writing apps, web browsers, or PDF rendering. Those remain outside CrossPoint's scope, plugins included.

      Bluetooth page turners

      Bluetooth page turners now work on all devices. Go to Settings → Connectivity → Bluetooth Page Turner to scan for a remote, pair it, and map its buttons. Short and long presses can trigger different actions: page turns, chapter navigation, the reader menu, and clipping selection.

      Highlights and clippings

      You can now select text in EPUBs, highlight passages, and save excerpts as clippings. On button devices, use the reader menu. On touch devices, hold a word and drag the selection handles. Selected text also works for dictionary lookup, including multi-word phrases. If you turn on Sync Clippings, clippings can sync through a compatible CrossPoint Sync server.

      EPUB formatting and reading controls

      EPUB rendering now handles more of what books actually contain: drop caps, small caps, mixed text sizes, borders, and shaded blocks. Tables take column content, cell padding, and borders into account. Headings stay attached to the text that follows them, and paragraph indentation has its own setting. EPUBs can also show non-interlaced GIF images, covers included.

      Noto Serif is now optional

      To free up space for all of this, Noto Serif moved from a built-in font to an optional SD card font. If you use it, install NotoSerif through Manage Fonts before or after upgrading. Without it, a Noto Serif selection falls back to Noto Sans.
      Libron also available for direct download from the font manager.

      Everything else

      • OPDS, the catalog format used to browse and download books, now supports version 2.0 alongside existing catalogs.
      • The device web interface has a new look and more consistent dialogs.
      • Settings are grouped into a cleaner layout that's easier to extend.
      • Touch devices get swipe-to-delete in the file browser and a few other places.
      • Azerbaijani is now available as a UI language.

      We also added a device comparison page to the website, for anyone who wants a CrossPoint device but can't decide which one: https://crosspointreader.com/device-comparison.

      What's Changed

      New Contributors

      Full Changelog : 1.6.5...2.0.0rc

    5. 🔗 19h/chernobog v6.4.0 release

      Chernobog 6.4.0

      Changes in v6.3.1...v6.4.0.

      • Semantic MBA synthesis beyond the rule catalog — a bounded Z3-backed
        pass simplifies typed 8-, 16-, 32-, and 64-bit expressions across basic blocks,
        with explicit conversions, overlapping register views, byte-addressed memory,
        and proven loop invariants. Replacements require an equivalence proof, followed
        by an independent check of the emitted microcode. Unsupported effects,
        inconclusive proofs, and exhausted budgets preserve the original expression.

      • Nested arithmetic and Boolean reconstruction — bottom-up linear MBA
        reconstruction exposes identities inside larger expressions and cancels
        arithmetic across Boolean subexpressions. Boolean synthesis, modular affine
        fitting, known-bit comparison reduction, and bounded unsigned division
        simplification recover smaller expressions beyond fixed patterns. Constant
        division can become a constant or a threshold comparison when the proven
        quotient range permits it.

      • Caller-context simplification — pure scalar helper calls can become
        constants or smaller symbolic expressions after substituting their actual
        arguments. Local value propagation and facts from both sides of a branch
        expose opaque predicates and constant branches, including after a helper result
        is assigned to a local. Emitted ctree expressions are checked with their casts
        and integer promotions; unsupported or effectful helpers remain calls.

      • Deep deobfuscation — the new Deep deobfuscation (Chernobog) action
        raises the shared semantic-analysis budget from 1 s to 30 s per function.
        Scripts can use chernobog_deep_deobfuscate(ea),
        chernobog_deep_deobfuscate_text(ea), and chernobog_mba_smt_stats(ea).
        These are analysis budgets, not hard limits on total decompiler runtime.
        See semantic MBA synthesis
        for the model and limits.

      • 32-bit saved-register stack stubs — native analysis recognizes bounded
        PE32-style dispatch stubs ending in RET 4 or XCHG [ESP], reg; RET,
        including supported PUSH substitutions. It records the handler target and
        continuation with dependency-tracked proof ownership. When the complete stub
        and handler belong to the same function, early Hex-Rays lowering replaces the
        final return with an explicit pop, any required stack adjustment, and a direct
        jump while retaining preceding stack accesses and register restorations.
        See stack-stub recovery.

      • Call-boundary string inspection — strings observed when rax stops before
        an unmodeled call are available through IDC, inspection JSON, and the evidence
        workspace's Observed strings table. They remain inspection observations;
        decompiler rewrites and proof consumers still require their existing
        completed-run evidence. Entry-input collection examines at most 256 incoming
        references, reports truncation, and supports cooperative cancellation through
        static analysis, input planning, and call-summary collection.

      • WARBIRD diagnostic exploration — a bounded symbolic explorer supports
        native admission profiles for ci, ClipSp, and PEAuth through four IDC functions:
        chernobog_warbird_profiles, chernobog_warbird_start,
        chernobog_warbird_poll, and chernobog_warbird_cancel. It models finite
        successor-key splits, aliased byte memory, supported scalar and legacy 128-bit
        XMM operations, native setup and dispatcher execution, bounded stack growth,
        and selected pool-allocation effects. Counted-store loop relations and guarded
        forward-state joins retain correlated state and memory-effect histories.
        Reports expose unsupported paths and resource limits; database changes
        invalidate results. This is diagnostic exploration only: all corpus entries
        remain partial, no pseudocode is replaced, and whole-entry semantic equivalence
        is not established.         See WARBIRD implementation status.

      • Pseudocode stability — caller-context updates run after view navigation
        completes and keep the displayed function, microcode, and text synchronized.
        Pending updates are discarded on function changes or plugin shutdown. Empty
        branch bodies retain the SDK's required placeholder, and zero-width integer
        terms are rejected during call simplification.

    6. 🔗 modem-dev/hunk v0.24.0 release

      Hunk 0.24: beyond the diff

      Hunk 0.24 brings complete-file and directory browsing, a live workspace compass, npm-installed extensions, and version-matched agent skills into your terminal review workspace. Worker highlighting makes startup interaction smoother, while a round of memory fixes keeps large reviews and long-running sessions leaner.

      For npm- and curl-managed installs:

      hunk update 0.24.0
npm install -g hunkdiff@0.24.0

      Homebrew availability will be verified after publication; until then, Homebrew propagation is pending. The commands above select the exact release for npm- and curl-managed installations.

      Explore the source and find your next review

      hunk open shows complete syntax-highlighted files and browses directories with lazy loading, live refresh, and keyboard or mouse navigation. Inspect the surrounding source without manufacturing a diff. The new read-only workspace status view brings together staging state, tracked and untracked changes, and sibling worktrees, with navigation into history and full diff reviews. Static and versioned JSON status output are available too. #1148, #1067

      Automatic diff layout now uses the space actually left after side panes and padding: opening a pane can switch to unified, and closing it can restore split. auto_split_min_width controls the threshold, while scroll_off keeps surrounding context visible during line navigation. Binary files remain reachable through file navigation and sidebar clicks, and the sidebar follows held file-navigation keys without overriding ordinary manual scrolling. #1170, #1109, #1178, #1085

      Keep reviews responsive—and let old reviews go

      Syntax highlighting runs in a worker by default, with grammar warmup during startup to reduce the input stall after the review first appears. Large-diff highlight failures use bounded retries rather than restarting on every scroll. #1105, #785

      Live reloads no longer retain every previous review's files and render state. Nonwrapped reviews reuse geometry across terminal resizes, and keyboard navigation leaves copy-selection content lazy rather than materializing it eagerly. Sessions also stop repeatedly submitting a rejected review to an unchanged daemon while retaining recovery when the review or daemon changes. #1201, #1200, #1202, #1199

      Review reliability improves too: wheel scrolling no longer leaves comments targeting stale lines, notes survive reloads that temporarily omit their files, suspended windows keep their sessions registered, and terminal-editor handoffs release Hunk's stdin reader before launching the editor. #1143, #1164, #1131, #1134, #1165

      Performance note: release benchmarks have no gated regressions against 0.23.0 or beta.1. The known sidebar-follow tradeoff from beta.1 remains relative to beta.0: navigation p95 is 42.74 ms versus beta.0's 36.35 ms, beta.1's 44.55 ms, and 0.23.0's 46.32 ms. This preserves correct sidebar following during held navigation and resizing.

      Easier extensions, agent setup, and shell navigation

      hunk extension install accepts npm packages—including scopes, versions, ranges, and tags—alongside Git sources, without running npm lifecycle scripts. Folder-local package imports work in compiled Hunk binaries. Extensions gain generation-scoped presentation filters and independent left/right pane controls. #1162, #1163, #1118, #1171

      Install agent pointer skills through the skills CLI; hunk skill show supplies the full instructions matched to your installed Hunk version. Bash and Zsh completions help discover commands, flags, and supported values. The note-composer save shortcut is now remappable, and hunk gh --help and the docs cover more of the available review workflows. #1167, #1157, #962, #1186

      Compatibility notes

      • Default theme: github-dark-default is the default again. Set theme = "terminal", pass --theme terminal, or use the theme picker to keep following your terminal palette. This differs from 0.23 and the 0.24 betas. #1195
      • Automatic layout: the default threshold is 160 available diff columns, excluding panes and outer padding. Configure auto_split_min_width or select explicit split/unified mode to override it.
      • Navigation context: scroll_off defaults to five rows; scroll_off = 0 or --scroll-off 0 restores edge-only scrolling.
      • Highlighting: --fast is now a no-op and will be removed in a later release. Windows compiled binaries and custom themes with syntax_scopes continue to highlight inline.
      • Patch validation: nonempty input without recognizable file changes now fails explicitly instead of silently opening an empty review. Genuinely empty reviews have their own message. #1183, #1182
      • Extensions: the public API is version 31. Gate new APIs on hunk.apiVersion when supporting older Hunk versions.
      • Persistent state: Hunk uses the XDG state directory while preserving existing state and global extension locations. Agent notes start hidden; use the review controls to reveal them.
      • Runtime requirements: npm installations require Node.js 22 or newer; standalone binaries do not require Node.js.

      Community contributors

      All merged pull requests

      Release notes : https://hunk.dev/changelog/0.24/
      Full changelog : v0.23.0...v0.24.0

    7. 🔗 r/LocalLLaMA MiniMax M3.1 Flash released, Model weights Oct 23 rss

      MiniMax M3.1 Flash released, Model weights Oct 23 | submitted by /u/MagicZhang
      [link] [comments]
      ---|---

    8. 🔗 r/LocalLLaMA MiniMax-M3.1-Flash is coming rss

      MiniMax-M3.1-Flash is coming | From MiniMax (official) on 𝕏: https://x.com/MiniMax_AI/status/2112111925975032241 submitted by /u/Nunki08
      [link] [comments]
      ---|---

    9. 🔗 Ampcode News Assign It To Amp rss

      Amp is now an agent in Linear.

      Assigning an issue to Amp starts a new Agent Session in Linear and spawns a new orb. You can also mention @Amp to kick off a session. Amp sends its response back to the same session and replies to messages sent along the way. The Agent Session also appears in your Amp sidebar and is fully viewable in Amp.

      Assign Amp an issue in Linear.

      Assign an issue to Amp from Linear

      Follow its progress in the Agent Session.

      Follow progress and reply in the Agent Session

      Then open the same conversation in Amp.

      Open the same session as a thread in Amp

      To get started, install the Amp agent in your Linear workspace and connect your Amp account to the Linear MCP in Settings → MCP & Integrations.

      Connect your Linear account and install Amp in Linear from Settings

      Read the docs to learn more.

  3. October 18, 2026
    1. 🔗 IDA Plugin Updates IDA Plugin Updates on 2026-10-18 rss

      IDA Plugin Updates on 2026-10-18

      New Releases:

      Activity:

      • community-malware-research
        • b494a31f: Yara rules to detect Eternidade Stealer, and some components
      • IDAPluginList
        • 3e23e67c: chore: Auto update IDA plugins (Updated: 19, Cloned: 0, Failed: 0)
      • mysl8te-feature-lab
        • 7156cf72: Merge pull request #1 from patelvivek9111/cursor/environment-bootstra…
        • 6a4c678c: docs: add final security verification report with complete test evidence
        • 59200d7b: fix: correct security test naming and add production mode verification
        • 203e7f00: docs: add final corrections report
        • 74e21b9d: fix: final security and reproducibility corrections
        • 4d4ad22d: docs: add final verification summary with all evidence links
        • c7f9a46d: fix: harden bootstrap - all tests passing, REA & Ghidra verified end-…
        • ff38799f: docs: add quick reference guide for development and testing
        • b48f480e: feat: install REA, Ghidra, and create comprehensive bootstrap infrast…
        • 80767667: feat: initialize React + TypeScript frontend and Node.js backend with…
        • d7e7fd38: Create README.md
      • oh-my-pi
        • 933f6cd0: docs(fork): record the v18.12.1 upgrade and rebase the patch-list bas…
        • 2ce9b186: Merge branch 'trial/v18.12.1'
        • f4a8ba83: style(wiki): oxfmt drift on patch #42 files
        • deb4698b: fix(catalog): keep web/grok first in the KDL web role-defaults (fork …
        • 44292107: fix(trial): MCP loader test fixtures gain lazyConfigs/lazySources
        • 5264552d: fix(trial): post-merge typecheck repairs (wiki 4-arg sig, lsp import,…
        • 540ccc55: Merge upstream v18.12.1 into the fork (trial)
        • acdb9016: v18.12.1 upstream source
      • oh-my-pi-schema
        • b67632f9: feat(mcp): send structured results to the model as JARO text
        • 558dc28a: fix(ai): stop retrying background requests against a failing server
        • 04d1e410: feat(catalog): add catalog.remoteRefresh switch to stop catalog.stenc…
        • a3e361c6: feat(ai): read concurrency limit from RateLimit-Policy header
        • 9562e7c8: feat(task): add opt-in cold-start subagent concurrency
        • 53432fc9: feat(ai): honour a gateway-advertised concurrency limit
        • e279e79e: fix(ai): learn provider overload from every transport response
        • b64e56de: feat(ai): adapt provider concurrency to overload
        • c1ff3590: fix(ai,task): scale retries and subagent fan-out to a provider cap
        • b1d054e0: fix(ai,skills): keep side requests from starving turns on capped prov…
        • 7c2f174c: feat(skills): add skills.compressDescriptions opt-out
        • 5b95c909: chore(sync): merge upstream oh-my-pi v18.12.1
    2. 🔗 r/LocalLLaMA Google Open Sources Harness2 for Self Improving AI Agents rss

      Google Open Sources Harness2 for Self Improving AI Agents | Google just released Harness2 as open source. It turns any AI harness into a system that improves itself over time. A harness is everything around the model. System prompt, tools, memory, skills, and subagents. Normally a person designs it once and the agent uses that fixed setup for every new task. With Harness2 the agent itself refines the harness for each task. It proposes changes, runs a few candidate versions, and picks a better one by comparing how they perform. No correct answers or graders are needed. The model weights stay the same. What it learns on one task carries over to the next. After finishing a task it saves the improved harness and useful lessons so future edits start smarter instead of from scratch. Google tested it with Gemini 3.5 Flash and GLM-5 on legal, office, and professional work benchmarks. Even one round of edits beat the original harnesses. More rounds pushed scores higher. GitHub https://github.com/google-research/harness2 submitted by /u/chemist_slime
      [link] [comments]
      ---|---

    3. 🔗 r/LocalLLaMA 72 hours, four big open weights drops. The only one that fits in 24GB came from NVIDIA, of all companies. rss

      72 hours, four big open weights drops. The only one that fits in 24GB came from NVIDIA, of all companies. | What a week. Quick recap, all numbers from the official repos and model cards: Thursday: Meta drops Muse Spark Open. 816B total, 42B active, 1M context. The launch post says it brings agentic AI "to your desktop". The desktop is two M5 Ultra Mac Studios with 512GB each, a config Apple says ships "late October" and still hasn't put a price on. The alternative is four 256GB Studios, roughly $38k. On top of that it's a custom license: mandatory "Built with Muse Spark Open" attribution and a separate deal once you're past $20M revenue. And Meta's own model card puts it at 39 on the Artificial Analysis index, behind GLM 5.3 (45) and Kimi K3 (44). Same day: NVIDIA ships Nemotron 3.5 Bolt. 74B total, 9B active, trained quantization aware down to 2 bit, so the whole thing is 22GB plus a 1.7GB vision projector. Built to fit in 24GB on purpose. Unsloth GGUFs on day one, plus llama.cpp, Ollama and LM Studio support. Friday: Reflection actually ships Beam. 501B total, 23B active, Apache 2.0, no strings. Smallest official checkpoint is NVFP4 at 294GB. Saturday afternoon: DeepSeek posts V4.1 Flash 1017 on X like it's nothing. MIT. Their own table has it at 77.0 on DeepSWE vs 74.0 for Opus 5 (vendor numbers, salt accordingly). The repo is 510GB. So I put them all on one chart against the 24GB line most of us live under. My takeaways:

      1. "Runs locally" now officially means "runs on a computer that costs more than a car."
      2. The company that keeps selling us 24GB cards is the only lab this week that built a model for 24GB cards. Not sure if that's wholesome or a sales funnel.
      3. Licenses mattered more than parameter counts this week. MIT and Apache 2.0 from DeepSeek and Reflection, attribution plus a revenue clause from the company with the loudest "open" marketing.
      4. Mistral says the Large 4 weights ("Le Chonk", 1T total) land before the end of the month, so the 24GB line is about to get even lonelier.

      Sources in the comments. submitted by /u/BTA_Labs
      [link] [comments]
      ---|---

    4. 🔗 oxigraph/oxigraph v0.5.12 release
      • Remove Python 3.8 and 3.13 free-threaded build variant support
      • SPARQL: fix arithmetic grouping around signed numeric literals and group operators of equal precedence from left to right.
      • SPARQL Update: apply all deletions before insertions and make LOAD SILENT atomic, including creation of empty destination graphs.
      • SPARQL: fix filter scope in nested OPTIONAL groups and propagation through subquery projections.
      • SPARQL: fix implicit aggregation over empty inputs, IF type inference, and simplification of LATERAL joins around OPTIONAL.
      • SPARQL: allow nonpositive SUBSTR starting positions.
      • SPARQL: avoid panics when explaining expressions that cannot be serialized as SPARQL.
      • SPARQL: fix equality on rdf:dirLangString literals.
      • Datatypes: fix rounding, decimal multiplication and formatting, month subtraction, and negative fractional timestamps.
      • RDF terms: fix parsing of numeric literals within triple terms.
    5. 🔗 r/LocalLLaMA unsloth/DeepSeek-V4.1-Flash-1017-GGUF · Hugging Face rss

      unsloth/DeepSeek-V4.1-Flash-1017-GGUF · Hugging Face | https://unsloth.ai/docs/models/deepseek-v4.1-flash submitted by /u/MundanePercentage674
      [link] [comments]
      ---|---

    6. 🔗 r/LocalLLaMA Two pallets of ZOTAC RTX 5090 graphics cards worth $470,000 disappear at Brazilian airport rss

      Two pallets of ZOTAC RTX 5090 graphics cards worth $470,000 disappear at Brazilian airport | submitted by /u/chemist_slime
      [link] [comments]
      ---|---

    7. 🔗 r/LocalLLaMA You don’t need that expensive of a build for local llms. rss

      Been seeing a lot of people with their 64gb of ddr5 4x3090 or whatever strata builds and it’s been sorta depressing knowing i cant afford that but i finally finished my setup today so here we go,

      Qwen 3.8 27b at 262k context, unsloth iq4XS ascii condensed with kv cache streaming

      My only gpu is a 9060 xt 16gb and i have 24gb ddr5 for my whole homelab only needing 16 for this

      MTP+ ngram prediction

      q4 kv cache values with q8 keys

      42.7 tps generation 658 tps prefill at 20k, 35/500tps at 200k

      Using this fork: https://github.com/achyudh/llama.cpp

      I got grok bot to ssh in and fix the bugs i had with missing pcie atomics

      submitted by /u/Maglcite
      [link] [comments]

  4. October 17, 2026
    1. 🔗 IDA Plugin Updates IDA Plugin Updates on 2026-10-17 rss

      IDA Plugin Updates on 2026-10-17

      New Releases:

      Activity:

    2. 🔗 HexRaysSA/plugin-repository commits sync repo: ~1 changed rss 
      sync repo: ~1 changed

## Changes
- [BinaryLens](https://github.com/lumice/binarylens):
  - 1.2.0: archive contents changed
    3. 🔗 r/LocalLLaMA Opencode breached, rotate keys to be safe. rss

      Details are developing…

      submitted by /u/chemist_slime
      [link] [comments]

    4. 🔗 HexRaysSA/plugin-repository commits sync repo: +1 release rss 
      sync repo: +1 release

## New releases
- [capa](https://github.com/mandiant/capa): 10.0.0
    5. 🔗 r/LocalLLaMA Linux creator says anti-AI rules are "idiotic." (Absolute god-tier take.) rss

      Linux creator says anti-AI rules are "idiotic." (Absolute god-tier take.) | submitted by /u/HolidayBit143
      [link] [comments]
      ---|---

    6. 🔗 r/LocalLLaMA DeepSeek V4.1 Flash (1017) Now Leads Open-Weight Models rss

      DeepSeek V4.1 Flash (1017) Now Leads Open-Weight Models | submitted by /u/Informal-Trouble2183
      [link] [comments]
      ---|---

    7. 🔗 r/LocalLLaMA Nvidia has officially confirmed that the 5090 is not discontinued and will continue shipping. rss

      Nvidia has officially confirmed that the 5090 is not discontinued and will continue shipping. | During a post-event interview at the RTX Spark Launch Party: Taipei on October 16, 2026, Nvidia's Senior Vice President of Personal Computing, Jeff Fisher , explicitly debunked the recent discontinuation rumors. submitted by /u/chemist_slime
      [link] [comments]
      ---|---

    8. 🔗 smol-machines/smolvm smolvm v1.30.1 release

      What's Changed

      • Expose the engine's CLI commands as a library module by @BinSquare in #1847
      • Avoid unnecessary disk staging when paused resume inputs fit in tmpfs by @BinSquare in #1849
      • Give machine create a window above the image pull deadline so a large image's seed build is not cut off at five minutes by @BinSquare in #1848
      • Build a paused machine's export beside its data directory by @BinSquare in #1850
      • Prepare SmolVM v1.30.1 for release by @BinSquare in #1851

      Full Changelog : v1.30.0...v1.30.1

    9. 🔗 r/LocalLLaMA deepseek-ai/DeepSeek-V4.1-Flash-1017 · Hugging Face rss

      deepseek-ai/DeepSeek-V4.1-Flash-1017 · Hugging Face | submitted by /u/Bestlife73
      [link] [comments]
      ---|---

    10. 🔗 smol-machines/smolvm smolvm v1.30.0 release

      What's Changed

      • Pin and checksum nfpm in the package repository workflow instead of resolving latest through the rate-limited GitHub API by @BinSquare in #1826
      • Pull large registry blobs in parallel ranged parts by @BinSquare in #1828
      • machine run: Accept --expose-socket and --mount-socket in ephemeral vms by @yorickvP in #1245
      • Add pack list for pulled artifacts by @BinSquare in #1831
      • Let embedders start a background command on a local machine by @BinSquare in #1832
      • Ignore the zip extraction advisories for utoipa-swagger-ui's build-time unpack by @BinSquare in #1837
      • perf(network): disable Nagle on host TCP relay sockets by @BinSquare in #1833
      • Run sysctl by its absolute path for checkpoints on macOS by @BinSquare in #1836
      • Ask registries for Docker manifest types when resolving an image by @BinSquare in #1838
      • Keep balloon page releases inside one guest memory region by @BinSquare in #1834
      • preserve empty directories across cache expiry and remounts by @BinSquare in #1835
      • Use server-side S3 copies for file renames by @BinSquare in #1839
      • Keep S3 staged writes coherent across file handles by @BinSquare in #1840
      • Cache missing S3 children from complete directory listings by @BinSquare in #1842
      • Build a paused machine's export outside its locks by @BinSquare in #1843
      • Disable Nagle on guest-facing TCP relay sockets by @BinSquare in #1844
      • Pin libkrun at the balloon free page hint round fix by @BinSquare in #1845
      • Prepare SmolVM v1.30.0 for release by @BinSquare in #1846

      New Contributors

      Full Changelog : v1.29.1...v1.30.0

    11. 🔗 backnotprop/plannotator v0.28.23 release

      Follow @plannotator on X for updates

      Missed recent releases? Release | Highlights
      ---|---
      v0.28.22 | 👍 Looks good, full view for files, one viewer for a thread's images and files, every session prints its URL, PLANNOTATOR_BROWSER=none opens nothing
      v0.28.21 | Message an agent from the Inbox, video attachments, Open in for attachments, Code / Tests / Generated in code review, writes from other websites refused
      v0.28.20 | Inbox search (⌘K), real folder names for projects, data files open in the code view, word-only replies leave questions open
      v0.28.19 | Ask this session in T3 Code, folder sessions load shared stylesheets and images, the agent note asked once per agent, Copy connect prompt
      v0.28.18 | plannotator inbox connects your agents, agents are told when to use the Inbox, rendered Markdown in code review, Inbox Settings in sections
      v0.28.17 | The Inbox on iPads and narrow windows, the reply bar no longer cuts off "Keep open", a Pi crash on /reload fixed
      v0.28.16 | The Inbox on a phone, a doorbell for new questions, Mark read, step through a thread's files, replies when the asking session ended
      v0.28.15 | Long Inbox threads fold to what is new, "Skipped N questions" replies, Inbox list and sidebar fixes
      v0.28.14 | Agents can replace an earlier question, comment on a guided review in the Inbox, issue numbers link to the repository
      v0.28.12 | Update notices and plannotator update, attach any file to an Inbox message, questions with context, links to attached files
      v0.28.11 | plannotator inbox --help prints a full guide for agents, and the plannotator.ai/inbox install prompt
      v0.28.10 | The Inbox over your tailnet with plannotator inbox --tailscale, images in agent messages load, click anywhere on an attachment tile

      What's New in v0.28.23

      The main fix: Claude Code sessions that run background subagents get their Inbox replies again. Also in this release: dictated text no longer goes missing on Chrome 155-156 for macOS, 👍 Looks good now reaches the agent, Inbox notifications that never fail silently, and a run of Inbox improvements. 16 PRs, all by @backnotprop.

      Inbox replies reach Claude Code sessions with background subagents

      When a Claude Code session started a subagent (a background one included), the Plannotator mod counted the subagent's turn as the session's own and never saw it end. The session then read as busy for good, so Inbox replies to it waited forever and "Ask this session" said the session was busy. The mod now ignores subagent turns. Verified live on Claude Code 2.1.302.

      The fix is in the Claude Code plugin, which updates separately from the binary. The install script updates a user-scope plugin for you; otherwise run claude plugin update plannotator@plannotator --scope user, then restart Claude Code.

      Dictated text lands where you are typing

      On Chrome 155 and 156 for macOS, text from dictation apps such as Hex (and text expanders) often failed to appear: the first dictation after a page load worked, later ones inserted nothing. This is a Chrome bug (crbug 568453825), fixed upstream for Chrome 157. Until then, Plannotator inserts plain-text pastes itself in the Inbox, plan review, annotate and code review. The workaround runs only on Chrome 155-156 on macOS and turns itself off at 157; Safari, Firefox and other browsers keep their own paste.

      In the Inbox, a dictated paste also lands in the field you were writing in after a click moved focus away from it (a choice on a question card, the message text, a chip in the reply box, or a word you double-clicked).

      👍 Looks good reaches the agent

      👍 Looks good used to stay in the Inbox until the agent next read the thread. Now, once the 10-second Undo window passes, it goes to the agent that wrote the message, the same way a reply does: "The person marked your message 👍 Looks good. No reply needed unless you have a question." If you reply or the agent writes again inside the window, nothing is sent. The line under the message says whether it is queued, saved or delivered.

      Inbox notifications never fail silently

      Chrome grants notification permission per address, so an Inbox opened at 127.0.0.1 and later at localhost (or on a new port) quietly had none. The Inbox now always answers at http://localhost:<port>/, and when the address you are on has no permission it says so on every load with an Allow button. Settings → General shows whether notifications reach you right now, and through which tab, and has Send a test notification. A tab whose connection dropped also catches up on the notices it missed.

      Thread names for threads you start

      A thread you start from New message gets a short subject (the first sentence, with greetings and filler dropped) and a thread-name chip like the agents' threads. Type a name in the chip, or leave it and Plannotator suggests one from your message. Otherwise the agent that answers names it in its first reply; a name you typed is never replaced.

      First run: one next step

      The empty Inbox screen now shows one next step at a time, starting with Plannotator's own connections (Claude Code, Pi, OpenCode), which bring replies back into the session by themselves. It turns on a Pi or OpenCode Inbox tool with one click, gives the exact install command for a missing plugin, and moves on by itself once you install it. It also handles disabled plugins, a Claude Code mod that is turned off, OpenCode 1 and PLANNOTATOR_INBOX_TOOL=0 correctly. The Inbox tool's definition on Pi and OpenCode is about 40% smaller (7 KB instead of 11.7 KB per request).

      Paste images into replies and new messages

      Paste an image or a file into New message or the reply box and it attaches, with the same tiles and progress as the paperclip. Screenshots get a dated name. The agent gets the files with the reply.

      Message images load from anywhere

      An image an agent shows in a message now loads from any folder you can read, not only from the project, as attachments already did. Hidden folders outside the project and .env files are still refused. send_message now tells the agent which images will not show and why.

      Search results name their thread

      Every Inbox search result now shows the thread it belongs to, as the same chip the list uses: the thread's name, or its subject when it has none.

      Additional Changes

      • The "↓ N new" pill goes away once you have read the message , and does not come back when you scroll up (#1978)
      • A thread you start shows in Sent at once , even while another thread is open (#1978)
      • Thread header order: Mark read comes first and Archive sits beside the close (#1957)
      • A cleaner What's new page with a sticky header, an "Update to X.Y.Z" button, and the releases you skipped still listed after you update (#1952)
      • Copy prompt sits above What's new in the sidebar (#1951)

      Install / Update

      macOS / Linux:

      curl -fsSL https://plannotator.ai/install.sh | bash

      Windows:

      irm https://plannotator.ai/install.ps1 | iex

      Claude Code Plugin: The plugin and the plannotator binary update separately, so run the install script above as well. In a terminal:

      claude plugin marketplace update plannotator
claude plugin update plannotator@plannotator

      Then restart Claude Code. Inside Claude Code, run /plugin marketplace update plannotator, then open /plugin → Installed → plannotator → Update now.

      Pi:

      pi update --extensions

      OpenCode: Re-run the install script above. It now also clears the OpenCode 2 plugin cache.

      What's Changed

      • Inbox: Copy prompt above What's new in the sidebar by @backnotprop in #1951
      • Inbox: a cleaner What's new header (approved Toolbar design) by @backnotprop in #1952
      • Inbox: paste images into New message and the reply box by @backnotprop in #1953
      • Inbox: message images load from anywhere; send_message says which won't show by @backnotprop in #1954
      • Inbox: dictated (pasted) text no longer goes missing in the reply box by @backnotprop in #1955
      • Inbox: short names, a project badge, and agents name threads you start by @backnotprop in #1956
      • Inbox: Archive next to close, Mark read first by @backnotprop in #1957
      • Inbox paste: a selected word no longer stops the dictation by @backnotprop in #1959
      • Inbox first run: one next step, Plannotator's own connections first; the Inbox tool's cost measured and cut by 40% by @backnotprop in #1962
      • Inbox search: every result shows its thread as the list's chip by @backnotprop in #1965
      • Inbox notifications never fail silently: one origin, a re-allow that stays, live status, test, reach by @backnotprop in #1967
      • Text fields: insert plain-text pastes ourselves (Chrome 155-156 macOS dictation workaround) by @backnotprop in #1970
      • Inbox first run: say the right thing on every Claude Code / Pi / OpenCode computer by @backnotprop in #1974
      • Inbox: the new pill stays gone once read; a thread you start shows in Sent with a thread open by @backnotprop in #1978
      • Claude Code mod: a subagent's turn no longer leaves the session busy for good by @backnotprop in #1979
      • Inbox: 👍 Looks good is sent through to the agent by @backnotprop in #1980

      Contributors

      Every PR in this release is by @backnotprop. No linked issues this time; the fixes came from day-to-day use of the Inbox.

      Full Changelog : v0.28.22...v0.28.23

    12. 🔗 Filip Filmar Bazelizing a Custom RISC CPU with 4x4 Systolic Matrix Accelerator rss

      Open-source digital signal processing and machine learning accelerators are frequently published as student or research projects. While the RTL architecture is often innovative, the surrounding build and test scaffolding frequently suffers from workstation-specific assumptions, absolute file paths, and missing simulation fixtures.

      In this case study, we document the Bazelization of Custom-RISC-CPU-with-Systolic-Matrix-Accelerator, authored by Mathew George. By applying Bazel and rules_openxc7, we transformed this 2D systolic array processor into a portable, reproducible hardware project that synthesizes and outputs a valid FPGA bitstream in under 25 seconds from a clean slate.

    13. 🔗 Filip Filmar Bazelizing mmRISC-2: A Full RISC-V SoC with rules_openxc7 rss

      Converting existing open-source FPGA projects to Bazel and rules_openxc7 transforms fragile, vendor-locked hardware build scripts into reproducible, sandboxed workflows. This case study examines our complete Bazelization of mmRISC-2, a comprehensive, silicon-proven RISC-V system-on-chip authored by Munetomo Maruyama.

      By pairing Bazel’s fine-grained dependency tracking with open-source EDA tools (Yosys, Slang, nextpnr-xilinx, Project X-Ray, and openFPGALoader), developers can clone the repository and produce a fully placed, routed, and verified bitstream for the Digilent Arty A7-100T board with a single terminal command.

generated: October 20, 2026 at 18:49:02