📦 dstours/octoc2

OctoC2 Hides in Plain Sight on GitHub

OctoC2 is the security tool that hides its commands in plain sight on GitHub. It takes standard GitHub features like issues and code branches and uses them as secret, encrypted mailboxes. If someone blocks your network connection, the system simply switches to a different GitHub channel so the conversation never stops. It turns your public repository into a resilient, untraceable command center for authorized testing. You are not just sending data; you are using the platform's own structure to mask your traffic. This makes it incredibly hard to detect or disrupt, which is exactly why it is such a clever piece of engineering.

🆔 @hackernewsgithubprojects

📦 qkaiser/broadcom-wps

Broadcom WPS: The Hidden Router Flaw

A single Python script can tell you if your home router has a specific, serious security flaw just by listening to its Wi-Fi signal. The project, called Broadcom WPS, helps identify devices running a specific chip vendor’s software that contains a known vulnerability. It works by sending a tiny, empty data packet to the router. If the router answers with a confirmation instead of a rejection, it is using the flawed implementation. This simple trick lets you check your own equipment without opening it up. You can also scan firmware files to check for the same issue. It is a practical way to see if your internet gateway is exposed.

🆔 @hackernewsgithubprojects

📦 syhunt/php2shell-protection

php2shell-protection: The Emergency Band-Aid

Here is a toolkit that can block file upload requests at your web server before PHP even gets a chance to touch them. It is called php2shell-protection, and it was built to help you test if your Apache server is rejecting dangerous multipart data. You need to know this is not a fix. PHP just patched two critical vulnerabilities that let attackers run code on your server, and you still need to upgrade your software. This tool just gives you a quick way to verify your emergency shield works. It checks if your server stops those risky requests while letting normal form posts through.

🆔 @hackernewsgithubprojects

📦 biolend83/tubehaus

TubeHaus: Your Private YouTube

Your home server now streams live television with real-time captions that YouTube refuses to provide. This project, known as TubeHaus, runs a full copy of the video platform entirely on your own hardware. It solves the biggest problem for self-hosters: YouTube blocks cloud servers. This tool routes traffic through a secure tunnel to keep connections alive even on cheap virtual machines. It also transcribes live audio into text on the fly, using just one processor core. The result is a fast, ad-free, and private experience for your whole household. You get instant video loading and a shared library for every device in your home.

🆔 @hackernewsgithubprojects

📦 nelsoneu/arn0-tv

The TV Home Screen That's Actually Yours

Your Samsung TV’s default home screen has turned into a digital marketplace, cluttered with ads and apps you never asked for. Arn0 TV fixes this by replacing it with a silent, minimalist dashboard that features just a clock, your favorite apps, and a row for your game consoles. Built specifically for the Q70B on Tizen 6.5, it strips away the noise so you can navigate with your regular remote. The project even includes a clever, built-in probe that measures exactly what your TV’s processor can handle, ensuring the interface runs smoothly without crashing. It’s a free, open-source starting point that lets you reclaim your living room.

🆔 @hackernewsgithubprojects

📦 karanb192/cache-tax

Cache Tax: Know Before You Pay

A two-line recap in a large chat session can cost six dollars and sixty-one cents if the background memory expires. Cache Tax is a plugin for Claude Code that prevents this surprise by keeping that memory warm while you step away. It sends tiny, low-cost pings to maintain the connection. If the cache still goes cold, the plugin intercepts your message, displays the exact price of the restart, and lets you decide if it is worth sending. It turns a hidden infrastructure fee into a visible choice. You stop losing money on forgotten context.

🆔 @hackernewsgithubprojects

📦 alejandros17487/ai-jailbreaks

The Prompt Vault for AI Security

ai-jailbreaks is the security testing suite that hands you ready-made keys to every major AI model. Instead of guessing how to talk to an AI, you just grab a full, paste-ready prompt from this collection. It works by swapping out the robot's default instructions for a custom set of rules, effectively giving the AI a new job description. This lets developers test exactly where the safety boundaries actually sit, which is crucial for building systems that hold up under pressure. It is the ultimate stress test for anyone building on top of these models, proving that what you build only works if you know how it breaks.

🆔 @hackernewsgithubprojects

📦 google-research/veriharness

VeriHarness: The Agent That Verifies Itself

VeriHarness is the verification tool that makes AI agents fact-check their own work. It solves the problem where language models confidently produce wrong answers because they cannot verify their own outputs. By running multiple attempts at a task, it uses the same model to compare the results, hunt for contradictions, and actively check facts against real evidence. This produces a single, corrected answer with a full record of why changes were made. It is fascinating because it proves that better accuracy comes from structured verification, not just a smarter model.

🆔 @hackernewsgithubprojects

📦 jovidecroock/pracht

Pracht: One app graph for humans and agents

Your web app can now speak directly to artificial intelligence without letting it scrape your code. A new tool called Pracht builds a single, explicit map of your routes and features, then projects that map in two directions at once. It renders normal interfaces for people while simultaneously exposing typed, secure tools for agents to use. This means an agent can call your application’s functions exactly like a user would, with built-in safety checks, instead of guessing at your website structure. It is a Preact framework that deploys anywhere, from static sites to edge functions.

🆔 @hackernewsgithubprojects

📦 oosexgang/hackios-xnu-kernel

HackiOS XNU Kernel

HackiOS XNU Kernel boots Apple’s own operating system kernel directly on an Android phone, letting you run the full iOS interface without a single Apple chip. It loads the real iOS system into your phone’s memory using a custom boot loader, so you can actually swipe through the home screen and open apps like Safari and Settings on hardware Apple never intended to support it. The coolest part is that your phone reverts to Android the instant you reboot it, meaning there is no permanent modification or risk to your device. It is a brilliant research project that proves how much of an OS is just software, not hardware.

📰 https://news.ycombinator.com/item?id=50195534

🆔 @hackernewsgithubprojects

📦 artembobkin/immersivemap

ImmersiveMap

ImmersiveMap renders a fully interactive three-dimensional globe directly on your iPhone or Mac using pure Swift and Metal. It is not a web view or a flat image, but a real-time engine that draws the curved surface of the Earth with actual terrain relief and directional shadows. The most striking capability is the continuous transition from a zoomed-out globe view to a flat street map without any jarring jump or loading screen. It handles vector tiles natively, so it works offline with pre-downloaded data and supports custom markers and labels right inside your Swift UI code. This gives developers a modern high-performance alternative to traditional map kits.

🆔 @hackernewsgithubprojects

📦 neuphonic/neudecide

NeuDecide: Voice Commands, Directly to Code

A forty-three megabyte model turns raw audio directly into function calls without transcribing a single word. That is the big surprise. Most systems listen to you, type out what they heard, and then guess your intent, but this tiny tool skips the middleman entirely. It runs on a single thread using standard libraries, meaning it works on a phone, a laptop, or even a Raspberry Pi without needing a graphics card or an internet connection. The trick is simple. You feed it a voice clip and a list of possible actions written as a schema, and it outputs the exact command to run.

🆔 @hackernewsgithubprojects

📦 jeankassio/comfyui-acestep_sft

ComfyUI AceStep SFT: Total Control Over AI Music

You can now drag and drop your way to a fully generated song, right inside ComfyUI. The ComfyUI AceStep SFT node takes that heavy, isolated music model and breaks it down into simple, modular pieces, meaning you finally get the fine-tuned control that the standard web interface just leaves on the table. It handles everything, from analyzing a track to find its beat, to tweaking exactly how much the AI leans into your lyrics versus the vibe. If you’ve ever wanted to treat music generation like a proper node graph instead of a black box, this is the setup you’ve been waiting for.

🆔 @hackernewsgithubprojects

📦 google/elephant-goldfish-model

The Elephant-Goldfish Model Explained

The Elephant-Goldfish Model is the development framework that keeps your code and its written plans perfectly in sync. It solves the problem where software documentation quickly becomes outdated as you build features. The framework uses a clever pair of AI roles: an Elephant agent that remembers your entire project history to write detailed designs, and a swarm of Goldfish agents that act like fresh reviewers with zero context to find flaws. This ensures every plan is stress-tested before any code is written. It’s a practical way to make sure your AI coding partners follow a clear, verified roadmap rather than guessing.

📰 https://news.ycombinator.com/item?id=50180926

🆔 @hackernewsgithubprojects

📦 xing-shuyin/pi-web-ui

pi-web-ui: Your Browser Is Now a Coding Cockpit

pi-web-ui turns your standard web browser into a complete command center for local A I coding agents. The most surprising capability is that you can connect to a remote Linux server directly from a single browser tab, automatically probing the environment and installing missing dependencies like Git or Node.js on the fly. This means you can browse files, run live terminal commands, and let the A I edit code on a distant machine without opening a separate remote desktop app. The project solves the friction of context switching by merging chat, terminal, and Git controls into one visual workspace.

🆔 @hackernewsgithubprojects

📦 freroxx/toolz

Toolz: The Android App With A Built-In Browser And AI

Toolz is an Android app that acts as a private, offline browser with end-to-end encrypted messaging, AI chat, and a full disk cleaner all in one place. It solves the problem of app sprawl by giving you a single grid dashboard to access your files, notes, and secure chats without leaving the app. What makes it interesting is how it combines a local ad-blocker and DNS filtering with a built-in AI model that runs on your phone, so your data never leaves your device. If you want one app that handles your privacy, productivity, and media without sending your info to a server, this is the tool to try.

🆔 @hackernewsgithubprojects

📦 pachterlab/edgepython

edgePython: The Python Port of edgeR

edgePython brings the heavy-hitting statistical power of edgeR directly into Python, letting you analyze gene expression data without touching R. It handles the tricky math of counting RNA reads, checking if specific genes are active in one sample group compared to another. The coolest part? It includes a brand-new single-cell method that borrows a technique from another tool to handle noisy data, while keeping the strict statistical rigor you trust. It also fixes several bugs found in the original R package, making it a smarter, safer choice. You get the same reliable results, just in a language most data scientists actually use daily.

🆔 @hackernewsgithubprojects

📦 stjanovitz/tilefinch

Tilefinch: A Real Browser on a PSP

A full modern web browser runs directly on a 2004 PlayStation Portable, rendering live JavaScript pages without any external computer. Tilefinch is an experimental project that builds a complete browsing engine from scratch, handling layout, security, and even video playback entirely on the device. The most surprising part is that it streams and plays high definition video locally, proving that even old hardware can handle the modern web when engineered with extreme care. It turns a simple gaming console into a capable internet terminal. The takeaway is that creative coding can push legacy hardware far beyond its original limits, offering a fascinating glimpse into efficient software design.

📰 https://news.ycombinator.com/item?id=50069854

🆔 @hackernewsgithubprojects

📦 revivedx/savagewindrecomp

Savage Wind Recomp: Play Breath of the Wild on PC

Run Breath of the Wild natively on your Windows or Linux machine, bypassing the need for a Switch console entirely. This project, called Savage Wind Recomp, takes your own legally purchased copy of the game and translates its code directly into a program that your computer can run. It is not an emulator; instead, it reconstructs the game from the files on your own system, allowing for PC-style graphics settings, full keyboard and mouse support, and higher frame rates. The most surprising part is how much of the game actually works right now.

🆔 @hackernewsgithubprojects

📦 ethanarbuckle/fairplay-decrypt

fairplay-decrypt: Offline App Unlocking

Ethan Ar Buckle's tool, fairplay decrypt, can unlock Apple App Store apps entirely offline using just a tiny sixteen byte code pulled from your own jailbroken phone. Instead of sending your app to Apple's servers to check permissions, this script does the heavy lifting on your computer to reverse the encryption. It takes a standard encrypted app file and turns it into a normal, open file you can actually inspect. You simply grab that secret key from a jailbroken device and let the tool do its work. It is a neat look at how app protection really works and how you can peek under the hood without touching the internet.

🆔 @hackernewsgithubprojects

📦 vast-ai-research/edenlive

EdenLive: Real-time AI Game Rendering

EdenLive runs a playable, photorealistic game engine directly in your browser at twenty-four frames per second using just one consumer graphics card. It solves a major bottleneck in interactive media by separating the logic that tracks where things move from the pixels that actually show them. A lightweight program handles the game rules, while EdenLive takes that raw data and paints a stunning, detailed world in real time. You get the freedom of a dynamic game with the visual quality of a high-end film, without needing a massive server farm. It is a clever split that makes complex, live-generated video finally possible for everyday hardware.

🆔 @hackernewsgithubprojects