Google OAuth Adds DPoP for Refresh Tokens

15 10 2026
Google OAuth Adds DPoP for Refresh Tokens

Google now supports RFC 9449 DPoP binding for OAuth refresh tokens, replacing traditional bearer tokens with application-layer cryptographic keypairs. The design targets infostealer malware and adversary-in-the-middle attacks by binding long-lived credentials to a client-generated asymmetric key. High-throughput access tokens remain standard bearer tokens to avoid per-request cryptographic overhead at the API gateway layer.

It is worth implementing if you are hardening server-to-server integrations or agent architectures against credential theft, but skip it if your stack cannot easily manage client-side key storage and strict nonce handling. The scheme also does nothing to protect standard browser session cookies, requiring you to wait for separate Device Bound Session Credentials proposals for full coverage.

more: https://developers.googleblog.com/announcing-dpop-support-for-google-oauth-securing-refresh-tokens/

my other side: ivo.blogspot.com





HiRO-ACEv2 Climate Downscaling and Simulation Models

15 10 2026
HiRO-ACEv2 Climate Downscaling and Simulation Models

Allen Institute's HiRO-ACEv2 is an open-source machine learning system that downscales coarse 100 km climate data to 3 km resolution. It pairs a coarse atmospheric emulator, ACE, with a fine-scale diffusion model, HiROv2, to simulate rare rain, wind, and pressure events. The full pipeline generates global high-resolution output at roughly one-three-hundredth the compute cost of traditional numerical models like X-SHiELD.

The models and tutorial notebooks are available on Hugging Face if you want to inspect extreme weather generation or run regional downscaling yourself. The major catch is that HiROv2 was trained exclusively on X-SHiELD outputs, meaning it currently only works with that specific ACE baseline and cannot yet ingest historical datasets like ERA5 or projected future climates.

more: https://huggingface.co/blog/allenai/hiro-acev2

my other side: ivo.blogspot.com





Awesome Reverse Engineering tools and frameworks list

15 10 2026
Awesome Reverse Engineering tools and frameworks list

Awesome Reverse Engineering is a curated GitHub repository organizing tools, frameworks, and learning resources by specific tasks like triage, native analysis, and instrumentation. Entries are grouped by objective, such as debugging or unpacking managed code, with commercial options explicitly marked. It provides a structured index that connects practitioners directly to relevant software without wading through generic search results.

It is worth bookmarking if you occasionally need to inspect binaries or unpack proprietary runtimes and want a vetted starting point. However, it is just a directory rather than a tutorial, so you still need to know what questions to ask the tools it lists. Skip it if you are looking for an all-in-one suite or expect hand-holding through your first disassembly session.

more: https://github.com/morluto/awesome-reverse-engineering

my other side: ivo.blogspot.com





AQuA Provides Automated Production Evaluation for Agent Systems

13 10 2026
AQuA Provides Automated Production Evaluation for Agent Systems

AQuA is a framework for diagnosing agent behavior by analyzing production telemetry via Cloud Trace, Logging, or BigQuery. It functions as an ambient quality agent that monitors live sessions to identify silent failure patterns and attribute them to specific code revisions or upstream data sources. The system operates outside the request path and generates actionable, code-anchored insights for human review.

This is worth implementing if you are struggling to manage the drift between your static evaluation datasets and live user traffic. It is not a silver bullet for deployment, as it requires you to write domain-specific goal files and deterministic metrics to be effective. Expect to spend significant time tuning the evaluation prompts before the insights become truly reliable.

more: https://developers.googleblog.com/the-outer-loop-insights-first-an-ambient-quality-agent-that-diagnoses-your-production-agent/

my other side: ivo.blogspot.com





ShellRS: A Native Rust SSH Client and SFTP Tool

12 10 2026
ShellRS: A Native Rust SSH Client and SFTP Tool

ShellRS is a cross-platform SSH client written in Rust that combines terminal access, WinSCP-style dual-pane SFTP, and port forwarding into a single GPU-rendered window using Zed's GPUI framework. It stores host configurations in a local SQLite database while keeping passphrases in the system keychain, and includes a CLI to let AI agents run commands on saved hosts without exposing credentials. The app replaces setups that previously required separate tools like Xshell and WinSCP, and it can be launched directly from bastion hosts.

It is worth trying if you manage multiple remote machines daily and want a fast native binary instead of an Electron app. The catch is that several of the more advanced right-sidebar inspection tools are limited to Linux hosts, and it is still a young project compared to established terminal multiplexers. Skip it if you rely heavily on tmux workflows or need a web-based interface.

more: https://github.com/since2006/shell-rs

my other side: ivo.blogspot.com





Agent Lightning v1.0 trains agents via proxies

12 10 2026
Agent Lightning v1.0 trains agents via proxies

Agent Lightning v1.0 is a 3,500-line open-source framework from Microsoft Research for applying reinforcement learning to existing agent harnesses. Instead of forcing you to rewrite your agent's execution loop inside the training framework, it sits between your agent and the LLM API as an OpenAI-compatible proxy. It records model calls and handles collocated asynchronous training on a shared pool of GPUs.

It is worth a look if you are already maintaining a custom harness like OpenHands or mini-SWE-agent and want to tune it without rewriting your stack. The catch is that splitting rollouts into variable training samples introduces complex data alignment challenges, and it assumes you have the compute infrastructure to run heavy concurrent agent loops. Skip it if you are looking for an out-of-the-box training environment with zero systems overhead.

more: https://www.microsoft.com/en-us/research/blog/agent-lightning-v1-0-a-3500-line-lightweight-agentic-rl-framework-for-training-agents-with-real-harnesses/

my other side: ivo.blogspot.com





Pinvou Agent brings local AI workflows to the desktop

11 10 2026
Pinvou Agent brings local AI workflows to the desktop

Pinvou Agent is an open-source desktop workspace that combines document chat, vector knowledge bases, and design generation into a single Electron application. It supports local models via vLLM alongside any OpenAI-compatible endpoint, and lets you hook up CLI tools and MCP servers. The codebase also includes ACP support for plugging in coding agents like Claude Code or Codex against a local project directory.

If you are tired of juggling CLI windows and browser tabs for different AI tasks, this consolidates them neatly under ~/.pinvou3/ with persistent sessions and local voice input. However, it is a heavy desktop wrapper that still requires managing your own model backends and API keys for cloud endpoints. Skip it if you prefer keeping your workflow strictly inside a terminal or your existing text editor.

more: https://github.com/Pinvou/pinvou-agent

my other side: ivo.blogspot.com





Mediarium: A single-container replacement for the ARR stack

11 10 2026
Mediarium: A single-container replacement for the ARR stack

Mediarium is a new self-hosted Docker container that combines Radarr, Sonarr, Prowlarr, SABnzbd, a torrent client, and Bazarr into one application. It handles search, download, unpacking, and library organization for movies, TV, music, ebooks, and audiobooks on 64-bit Linux servers and NAS hardware. You can migrate existing setups from the traditional multi-container stack without rewriting your library paths.

It is worth testing if you are tired of maintaining half a dozen interconnected services and want a unified configuration file and search bar. However, the project is young and still has rough edges, so production users with complex automation rules should stick with the individual ARR tools for now. Check the documentation for known limitations before moving a primary library over.

more: https://github.com/rdborg/Mediarium

my other side: ivo.blogspot.com





Aurelio: Self-hosted wealth management and financial planning

10 10 2026
Aurelio: Self-hosted wealth management and financial planning

Aurelio is a local-first financial planning app that tracks your accounts, portfolios, debts, and cash flow in a single SQLite database. It requires Node.js 22 and uv, runs locally via shell scripts, and stores records in backend/data.db. The optional AI advisor connects through OpenRouter using your own API key to answer questions and propose data changes.

It is worth a look if you want complete control over your financial data without SaaS subscriptions or cloud lock-in. The catch is the setup friction and the fact that AI-driven features like portfolio analysis cost real money per query and require manual validation. Skip it if you just want a hands-off spreadsheet or a plug-and-play bank aggregator.

more: https://github.com/LosaLosSantos/aurelio-finance

my other side: ivo.blogspot.com





MacMiniMode keeps lid-closed MacBooks awake on power

10 10 2026
MacMiniMode keeps lid-closed MacBooks awake on power

MacMiniMode is a signed macOS package that runs on Apple Silicon or Intel systems requiring macOS 12 or later. It automates clamshell mode without requiring an external display, dummy HDMI plug, or manual terminal commands like caffeinate. When plugged into AC power, it disables sleep with the lid closed; when unplugged, it reverts to normal battery sleep behavior.

It is worth installing if you use an older MacBook as a headless home server and are tired of managing power states manually. The catch is that it solves a very narrow workflow problem and can conflict with third-party cleaner utilities or remote desktop tools that aggressively rewrite power settings. If you only use your laptop as a portable machine, you have no use for it.

more: https://github.com/Pama-Lee/MacMiniMode

my other side: ivo.blogspot.com