COSCUP 2026 - Conference for Open Source Coders, Users, and Promoters

COSCUP Opening
UbuCon Asia Introduction
Prime Speaker Introduction

在開源模型生態蓬勃發展的今天，開發者能輕易取得 Gemma4、Qwen3.5 等頂尖的開源大語言模型 (LLM)。然而，當我們想將這些技術落地到金融、醫療等高合規場景時，往往會撞上一面名為「資料隱私」的高牆。受限於個資 (PII) 與法規，團隊根本拿不到真實業務資料來進行 PoC、效果驗證或 RAG 系統的壓力測試。沒有可用資料進行驗證，再好的開源模型也難以推進到實際的業務中。

面對「資料可取用性」的難題，合成資料 (Synthetic Data) 成為破局關鍵方法。

許多團隊最初會嘗試手寫 Prompt 來生成測試資料。但當需求擴增至上千筆，且須同時滿足多樣性、邊界條件與邏輯一致性時，這種做法很快就會面臨品質失控、難以驗證與無法擴展的瓶頸。

本議程將以 Nvidia Open Source 工具 Data Designer 為例、提供可重現的範例 pipeline，包含 synthetic PII / domain QA seed schema、DAG config、validator 設計、LLM-as-a-Judge rubric，以及生成資料的品質檢查報告。所有範例資料與程式碼將以開源授權釋出，讓聽眾會後可以直接改造成自己的 RAG 測試資料或 PoC dataset。

透過這個實戰案例，希望幫助開源開發者與企業 IT 團隊在缺乏真實資料的困境中，利用開源工具鏈「無中生有」打造高品質的測試資料集，讓 AI 落地的最後一哩路走得更穩健。

Hacking Corner 是一個能容納 10 人左右的交誼廳，供會眾自由交流！這是一個可以從快速打牌遊戲到進行長達數小時的開源馬拉松的多功能空間。無論是15分鐘的急速腦力激盪還是一場兩小時的代碼冒險，這裡都是實現你的創意與夢想的場所。

記得至此下方連結閱讀注意事項並登記。
https://docs.google.com/document/d/1ZerJ-5QYcEJ5guhxtK-SBW2BA6RMHtVJnqNIWxRCz18/edit?tab=t.0

Hacking Corner 是一個能容納 10 人左右的交誼廳，供會眾自由交流！這是一個可以從快速打牌遊戲到進行長達數小時的開源馬拉松的多功能空間。無論是15分鐘的急速腦力激盪還是一場兩小時的代碼冒險，這裡都是實現你的創意與夢想的場所。

記得至此下方連結閱讀注意事項並登記。
https://docs.google.com/document/d/1ZerJ-5QYcEJ5guhxtK-SBW2BA6RMHtVJnqNIWxRCz18/edit?tab=t.0

Hacking Corner Bulletin Board

Hacking Room 是一個能容納 10 人左右的區域，供會眾自由交流！在這裡，我時間是你的朋友。這是一個可以從快速打牌遊戲到進行長達數小時的開源馬拉松的多功能空間。無論是15分鐘的急速腦力激盪還是一場兩小時的代碼冒險，這裡都是實現你的創意與夢想的場所。

The hacking room is a free space for casual gatherings, which can hold up to 10 people. There is no time limit in the hacking room. You can play card games with friends for 15 minutes between talks or run a two-hour open-source sprint here. Also, multiple events are available at the same time. It is all up to you!

MySQL is evolving its development process and community engagement. Oracle is shifting from a model where it primarily defined the roadmap internally and released the results as open source, toward a more open, community-oriented approach.

This session introduces MySQL’s Community Engagement Strategy and Community Roadmap, explaining how Oracle is working to expand the MySQL ecosystem by making roadmap discussions more transparent and encouraging broader participation from users, developers, DBAs, and contributors.

We will cover how the MySQL community can engage with the project through public discussions, feedback on bugs and feature requests. Attendees will learn how they can help shape the future of MySQL—not only as users of the database, but as active participants in its ongoing evolution.

In 2004, Ubuntu captured the tech world's imagination as the "friendly Linux" desktop, simplifying computing for a generation of students and developers. Fast forward to 2026, and the landscape has fundamentally transformed. Ubuntu has evolved into the "Invisible Architecture" quietly driving the world's compute—powering public clouds, enterprise Kubernetes, autonomous vehicles, and global AI infrastructure.

This session offers a 15-year engineering perspective on how Canonical scaled its operations from upstream Linux packaging to engineering massive delivery pipelines, managing 10-year LTS security cycles, and establishing FIPS-compliant environments. We will address a critical bottleneck in the modern ecosystem: the "AI Tax"—the immense friction developers face when battling mismatched CUDA versions, kernel headers, and broken NPU drivers instead of building models. We will explore how Canonical collaborates with silicon partners like NVIDIA (GB10/GB300) and AMD to eliminate this complexity, ensuring the hardware is fully optimized right out of the box.

Additionally, the session introduces "Inference Snaps" as the modern unit of truth for AI deployment. We will examine how Snaps bring immutability, reproducibility, and sandboxed security to a "black box" AI world, serving as a trusted "glass box" across thousands of edge nodes. Finally, we will close with a call to action for the open-source community, highlighting how the growing local ecosystem can ensure that the future of AI remains decentralized, trusted, and open.

• Slido Audience Q&A

入職第五天，我拿到了 Claude Code ，開始試著和 AI 同事協作。
第八天，我決定為 AI 寫文件——不是以往的 README.md，是專門餵給 AI 讀的 LLM.md。
第十四天，我把第一個 PR 送出去，同事一看大量的新增檔案，當場傻眼。沒想到幾天後換我審他的 PR 的時候，發現他也開始寫 LLM.md，不只如此，他還寫了一份「文件的文件」，把整套做法立成規範。
這場分享，想講的就是這六十天裡發生的真實故事，以及我們意外發展出的「雙軌文件」玩法：
一份 README 給人類看，另一份 LLM.md 給 AI 看。兩份文件重視的內容完全不一樣。
從這個起點出發，我們一路延伸到架構規範、流程文件、設計 token 系統，慢慢拼出一套團隊能複製的方法論。

我會分享以下幾件事：
- 為什麼 AI 需要跟人類不一樣的文件？
- 雙軌文件怎麼設計、怎麼演化？
- 個人小習慣是如何變成團隊規範的？
- 以及這套做法真正的代價與限制

實踐來自一個 Kotlin / Android 團隊，但核心概念適用於任何 JVM 專案。

無論你是正準備把 AI 工具引入團隊，還是單純對「人跟 AI 一起寫程式」時的工程實踐感興趣，都歡迎來聽聽這段狂踩油門的經歷。

匿名網路社群 anoni.net 是台灣在地的開源社群，這一年持續推廣 Tor、Tails、OONI 這些自由開源的匿名網路工具。

這場開場先說明社群的緣起與運作方式，以及社群如何以開源協作參與國際專案，把 Tor、Tails、OONI 與 Tor University Challenge 的介面翻成正體中文、回報問題、協助在校園架設中繼節點。接著從記者、公民團體、人權倡議者實際會遇到的處境切入：通訊可能被攔截、身分可能被追蹤，消息來源的安全也連帶受影響。這裡也說明為什麼這類高風險工作特別倚賴原始碼可被公開檢視的開源工具，封閉的黑箱軟體無從驗證它有沒有被動過手腳。最後介紹社群 2026 年推進的三個主題，依情境分級的個人隱私指引、校園 Tor Relay 中繼節點建立，以及在合法前提下對匿名支付的開源工具探索。

這些年，各國政府都對人工智慧（ Artificial Intelligence，AI ）做出包含隱私保護、智慧財產權等諸多原則性指引，但實務上，多數國家都尚未對 Vibe coding 程式碼錯誤、代理型AI（AI Agent）指令錯誤、演算法偏誤、AI幻覺等問題的責任歸屬做好準備。

AI 因人而生，以程式碼為基礎，產出程式碼，為人服務，最終也應服膺於人與程式碼。那在這個嶄新的時代，各國政府是如何看待 AI 與人的關係，以及組成 AI 和 AI 產生的程式碼，在這場講座，我們將邀請各方專家學者為我們講述，也彼此辯論。

所有前端框架，其實都在回答同一個問題：資料變了，畫面要怎麼跟著變？過去十幾年，從 React 的 useState、Vue 的 ref 到 Solid 的 signal，各家的答案正悄悄收斂到同一個方向，就是細粒度的響應式。

而提到 Angular，很多人腦中還停在 NgModule 滿天飛、樣板程式碼又臭又長的印象。但這幾年的 Angular 已經是另一個框架了，而帶起這波轉變的核心，就是 Signals。

這場演講會用 Signals 當作一面鏡子，先帶你看懂現代前端框架到底在思考什麼：為什麼「資料到畫面」這個看似簡單的問題這麼難、各框架又是怎麼一步步逼近答案的。接著我們會落到實處，實際看 Angular 的 Signals 寫起來長什麼樣子（會帶到 Angular 的各種 Signals 新語法）。

無論你是好奇 Angular 近況的前端開發者，還是正在做技術選型的人，都希望這場演講能透過 Signals 這個切角，重新認識一個跟你印象中很不一樣的 Angular。

智慧合約的資安事件除了程式碼漏洞本身的問題，更是如何持續監控、快速判斷並即時應對的防禦作業問題。鏈上的威脅會持續出現，留給團隊判斷與應對的時間也和短暫；且「找到一個漏洞」不等於證明它真的可被利用，也不等於能阻止損失發生。

這場演講將介紹一個一個能自主執行防禦流程的 Agent，目標是打通從漏洞發現到實際行動的完整流程。除了審計原始碼或產生單次的概念驗證（PoC），Agent 更會持續掃描鏈上合約、透過設定好的風險訊號與篩選規則，優先挑出最值得檢查的目標，生成並驗證可利用的 PoC，最終再透過模擬估算真實經濟影響，並在獲得授權時執行資金救援以降低實際損失。

我們會介紹整體系統架構，並聚焦在這個流程中最困難的一段：「如何從一個潛在漏洞，推進到可實際利用的 PoC，接著再把 PoC 轉換成真正可以部署的救援合約。」我們也會透過 1–2 個可能造成資金損失的具體漏洞案例（e.g., 重入攻擊），討論在 Harness Engineering 的實作上， Agent 該如何推理漏洞的可利用性、取得所需的鏈上狀態、透過模擬驗證攻擊是否成立，以及如何將 PoC 改寫成可執行的救援邏輯。

我們期待達到的目標，是讓智慧合約安全從週期性的審計，走向持續、端到端的防禦營運；優先處理真正可被利用、具有實質經濟影響，並且能被安全採取行動的風險。

1. 為什麼會研究 Linux Kernel ISA 架構移植
2. 介紹ISA 架構移植大概的有哪些元件組成
3. 架構移植的流程

音樂表演背景的酷選視覺，到數學邏輯演出的音樂，你有聽過 "即興程式"(livecoding) 嗎？一起來看看有什麼開源的工具可以馬上入坑！

https://github.com/toplap/awesome-livecoding/blob/master/README.md

https://vcvrack.com/ https://tixl.app/ https://cables.gl/ https://strudel.cc/ https://git.sr.ht/~rabbits/orca-examples https://0b5vr.com/wavenerd/ https://github.com/wrightwriter/Bonzomatic-Compute https://hydra.ojack.xyz https://estuary.mcmaster.ca/

As system-level hardware isolation has long been a missing piece in the RISC-V ecosystem, emerging standards are now closing that gap. This session provides a general introduction to deploying hardware-enforced Trusted Execution Environments (TEEs) using the RISC-V Worlds ISA extension and the WorldGuard architecture. We will explore how initiators tag execution environments and how target resources enforce access control rules. Transitioning to software, we will cover defining isolation boundaries via Device Tree bindings and managing system domains within OpenSBI. Finally, we will demonstrate integrating this security stack with OP-TEE, leveraging the RPMI TEE Service Group to establish standardized cross-world communication.

To my surprise, giving talks made international conversations easier for me.

I am not good at English, but I keep speaking at global OSS events.
My first international talk was a failure. I just read my script, and I could not follow the Q&A at all. Even after living in the United States for a year, my English did not improve much. But I learned something important: imperfect English can still work.

After joining the LibreOffice community, I began speaking at international conferences. I often felt my English was not good enough. What changed me was a message from the community: sharing your perspective is valuable, even in broken English.

In this talk, I will share my journey, along with practical ideas you can use right away: keeping your English simple, reducing the text on your slides, focusing on one core message, and handling Q&A even when you don't understand everything.

You don't need perfect English to join the global OSS community. If you have something to share, your voice already has value.

Available: Book your topic here

Intro: COSCUP is a large and vibrant event, and it can feel overwhelming for first-time participants. In this one-hour orientation session, experienced COSCUP participants will share practical tips on what to expect, how to navigate the event, and how to make the most of your experience. It's also a great opportunity to meet fellow attendees and start building connections before diving into COSCUP. (This session will be entirely in English)

目前多數語意搜尋與 embedding 系統，通常依賴 Transformer 或向量相似度計算，其複雜度常接近 O(n²)。在大型語料或即時搜尋場景中，這會帶來顯著的計算成本。

本分享將介紹一種不同的 encoding 思路，透過結構化語意表示與詞彙場（semantic field）的概念，將查詢與詞彙評分的複雜度降低至 O(n)。

演講內容包含：

• 傳統 embedding / Transformer 檢索的計算瓶頸
• 一種替代的語意 encoding 架構
• PipeOwl 專案的設計與實作
• 多語言模型（中文 / 日文）的實驗結果
• 與 BM25、Embedding、FAISS 的速度比較

本方法與模型已開源，並提供實際 benchmark 與實作程式碼，期待與開源社群討論另一種語意檢索的可能方向。

相關專案
- https://huggingface.co/WangKaiLin/PipeOwl-1.6-tw
- https://huggingface.co/WangKaiLin/PipeOwl-1.5-jp
- https://huggingface.co/WangKaiLin/PipeOwl-1.4-multilingual

雖然我們每天都在打code，但是文字一直以來都是大坑，分享各種我與各種文字相關場景打交道的心得
* 玩日文遊戲需要中文字幕 -> OCR
* 看網頁文章想要有聲音 -> TTS
* 想要字幕 -> STT 語音轉文字 whisper
* 寫部落格、筆記系統
* pdf跑版 -> 輸入內容沒版型 -> latex or html
* 想用markdown寫一本書? -> pipeline

去年 12 月底，一個海底地震，讓台灣連外的海底電纜壞了七七八八。而受周遭海纜障礙影響，近兩年網路變慢的程度幾乎人人有感！

假設真的有這麼一天，台灣對外的海纜斷光光了，哪些你我日常使用的網站，還能繼續維持服務？又有哪些你每日需要的網站，屆時會壞光光？

自 2023 年底的 g0v 第零次韌性松起，作者即持續關心「海纜障礙對於台灣人日常上網會有多大影響」問題。歷經數次大松的 prototype，及多次對外提案，本研究終於獲得 APNIC Foundation 贊助，與 OCF 聯手合作，於 2025/10 開始執行。

我們擷取了台灣流量前兩千名的網站，對其進行首頁的連線測試。結論是：在對外網路斷光光時，至少有 47% 的網站不會動，另外 43% 也因國際雲依賴而存在高風險。

立刻查看 resilience.ocf.tw/web 檢視測試數據及程式。

還想知道更多更深入的研究發現，以及我們的建議嗎？歡迎一起加入「海纜斷光，到底會怎樣？」討論吧！

大型語言模型產生的繁體中文，常混入中國用語、過度簡化的漢語、錯誤標點與不精準術語，這些輸出會在文件、教學、開放原始碼專案與技術文章中逐漸污染書寫習慣。zhtw-mcp 是個透過 Model Context Protocol (MCP) 整合到 AI 助理的繁體中文書寫檢查器，可依中華民國教育部標點、國字標準字體與兩岸詞彙差異，檢查並修正 AI 產生的中文。

本議程介紹為什麼 AI 中文輸出容易被不精準來源混雜影響，如何將中文潤稿轉化為可測試、可重現、可融入進開發流程的工程議題，並展示 zhtw-mcp 如何自動改善台灣繁體中文書寫材料的品質和文化傳承。

LLMs often generate Traditional Chinese that looks fluent but mixes zh-CN vocabulary, Simplified-Chinese phrasing, inconsistent punctuation, and unstable technical terminology. zhtw-mcp turns this problem into an engineering workflow: a Model Context Protocol server that checks, fixes, and gates zh-TW text using Taiwan-specific language rules.

This talk presents the design of zhtw-mcp, the challenges of handling ambiguous terminology and false friends, and how linguistic linting can be integrated into AI-assisted writing, documentation, teaching material, and open-source development workflows.

掃描工具裝了、CI/CD 跑了，漏洞清單每天在長，但誰在追蹤？誰在修？修完了誰來確認？光有掃描工具不夠，挑戰在「掃完之後」：碎片化報告沒人聚合、供應鏈黑箱、沒有閉環。

本場分享一套全程基於開源工具的 DevSecOps 閉環架構，涵蓋完整 SSDLC：以 Threagile 進行威脅建模、OpenGrep 做 SAST、Trivy 產出 SBOM，搭配 DefectDojo 與 Dependency-Track 進行漏洞聚合與供應鏈監控，並自動開單至 Jira、GitHub 等平台，讓工程團隊在熟悉的介面處理資安問題。未來更可搭配 AI（如 Claude Code MCP）進行自動修補，讓閉環更進一步。

除了介紹工具能做什麼，更會分享每個工具的真實限制，以及落地的三道高牆：開發團隊的抵制、SLA 永遠修不完的焦慮、跨部門推動阻力，以及如何用架構設計化解。

漏洞從被掃出來，到自動開單、PR merge 後自動結案，RD 不需登入任何資安平台。SBOM 自動產出更讓 CRA 合規成為 B2B 競爭優勢。這是我們在實際專案中真實走過的一遍，所有工具均採用 OSI 認可授權。

我們習以為常的 AI 輔助開發或雲端生態系，對於身處矯正機構、偏鄉教育現場或數位資源受限環境的學習者而言，這道「連網門檻」可說是巨大的障礙。

這場演講將展示一套基於 JavaScript 生態系構建的「邊緣開發環境」。在「完全斷網」的環境下，利用現有的開源工具，實現離線開發，且提供不輸給「網路吃到飽」的現代城市開發體驗。

演講內容將深度解析如何整合以下關鍵技術組件，打造一套可單機運行的離線教室：

1. 基礎設施去中心化：利用 Verdaccio 建立本地端 Private npm Registry，預先快取並鏡像必要的依賴項，解決離線環境下無法 npm install 的焦慮。

2. 知識庫 RAG 化：將 MDN (Mozilla Developer Network) 靜態文件向量化，透過 RAG (Retrieval-Augmented Generation) 技術，在沒有 Google 與雲端 AI 的情況下，提供精準的離線技術檢索。

3. AI 導師在地化：透過 Ollama 在本地端部署輕量化 LLM (如 Llama 3 或 DeepSeek-Coder)，並整合 Aider 與 Node.js Runtime，實踐 AI 協作開發、自動化修復 Bug 的現代工作流。

希望透過本分享傳達一個核心理念：這些看似尖端的技術並非遙不可及，透過合理的系統架構與整合，我們能將技術的火種帶進任何有心學習的角落，真正實現「技術平權」。

AI 正在從被動的助理，逐漸變成能夠執行任務、呼叫 API、甚至與其他 agent 協調工作。但如果 agent 要真正進入開放網路與經濟系統，它們需要的不只是更強的模型，而是一套開放且可驗證的經濟基礎設施，也就是本次演講的主題：鏈上支付、身份聲譽，以及可驗證計算。

本場演講將探討區塊鏈與開放網路協議如何支援正在形成的 agent economy，筆者認為區塊鏈本身就是一套與 AI 是配的經濟系統，因此本次演講，我會先從 agent payment protocols 談起，包括 Coinbase 推出的x402 與 Tempo / Stripe 共同推出的 Machine Payments Protocol，我會介紹這些協議如何把支付直接嵌入網路請求流程，使 agent 能夠為 API、資料、算力與服務進行機器原生的支付。
另外，筆者也會介紹 ERC-8004 作為 agent identity、reputation 與 validation 的提案標準，並討論 agent 如何在開放網路中被發現、被支付、被評價與被追責。

最後，我會進一步討論一個目前還未形成市場需求，但將隨著 AI 的發展會有越大的探討空間的技術議題，也就是開源的可驗證計算，在此筆者將會介紹 Eigencloud 與 Brevis 等鏈上可驗證計算項目，去探討EigenAI、EigenCompute、TEE 與 restaking-based validation systems 等可驗證 AI 基礎設施，看看 deterministic inference、verifiable execution 與經濟懲罰機制，如何讓agent 的高風險或者金融行為變得更可信。

The FOSS community thrives because it's built on collaboration, mentorship, and contribution. Drawing from hundreds of podcast interviews with FOSS developers globally, this session highlights how strategic contributions can create benefits for individual developers, corporate employers, and the entire community. Attendees will gain actionable strategies to start contributing effectively while learning how such efforts open doors to leadership, visibility, and long-term relationships within the community.

This talk is about the current status of Open-Source Firmware on Framework Laptops. We will dive through the portfolio of the very popular notebooks from Framework and dig into the current status of Open-Source Firmware on them. Which one's could be potential targets? We will also showcase a PoC running coreboot on one of the AMD Framework Laptops.

隨著雲端運算日益普及，資料隱私與機密性已無法僅依賴軟體層的加密。硬體層級的隔離，以及遠端信任機制，如今已成為不可或缺的要素。本演講將追溯 x86-64 平台上機密運算（Confidential Computing）的演進，並著重探討這些技術如何在雲端環境中被採用。

我們將從 Intel SGX 談起，說明 enclave 如何建立細粒度的信任邊界，接著我們會轉向當今的主流方法：以虛擬機（VM）為基礎的隔離。透過比較 AMD SEV-SNP 與 Intel TDX 的設計，我們將檢視它們在記憶體頁面保護、遠端證明（remote attestation），以及與虛擬化堆疊整合方面的差異。這使既有應用程式能在幾乎不需修改程式碼的情況下，保有硬體層級的機密性，同時在並非完全可信的雲端基礎設施之上，建立可驗證的執行環境。

挑工具之前，先回答三個問題：你要保護什麼、要防的對手是誰、願意付出多少成本。這場用威脅模型把這三個問題搭成判斷框架，讓你在遇到新工具、新威脅時知道如何對號入座。這個框架裡有一條和開源直接相關。當你的對手有能力檢查你的裝置與通訊時，你用的工具能不能被獨立稽核就攸關安全，這也是 Tor Browser、Tails 採用開放原始碼與可重現建置（reproducible build，任何人都能從原始碼編出位元相同的程式、驗證沒被動過手腳）的原因。接著談 metadata（那些沒被加密的連線、時間、聯絡對象等紀錄），就算通話內容沒被監聽，對手仍可能從通聯紀錄知道你在什麼時間聯繫了誰、聯繫多久。對記者與公民團體來說，這類紀錄往往足以反推出消息來源與行動網絡。

MySQL自前年四月將版本發行方式改為長期支持版(LTS)和創新版併行,並且推出了它的第一個LTS版,經過兩年MySQL 9.x創新版的累積新技和新功能,在今年4月推出了它的第二個LTS版 - MySQL 9.7,這個版本將享有8年的支援週期,這段期間9.7將持續提供更新版,而不會加新功能以保證應用系統在更新版之間的相容性,這追求系統穩定性的使用者而言,MySQL 9.7將是一個重要的里程碑-您可以安心的在8年內使用越來越穩定MySQL 9.7.
在這個分享中我將為各位介紹MySQL 9.7帶來的最新功能,以及MySQL長期支持版的使用者能由9.7版得到什麼效益.

維護一個爬蟲不難，但維護超過 100 個、針對不同金融機構網站的爬蟲，是完全不同等級的挑戰。

這場分享來自真實的 production 系統——一個持續從日本各大基金公司抓取 PDF 月報的 Rails
專案。當目標網站從 REST API 悄悄遷移到 Nuxt.js SPA、當基金的列表頁因為
ReactVirtualized 只渲染可見列導致找不到目標基金、當PDF版月報突然只剩 HTML
版的月報——你的 spider 就這樣靜靜壞掉了。

我會分享三種最常見的「壞法」與對應的 Ruby 解法、如何用 Module / Concern 組織大量
spider 的共用邏輯，以及最重要的工程判斷：什麼時候該修，什麼時候該直接刪掉。

臺灣打造了全球最重要的半導體與硬體供應鏈，但在 AI 時代，競爭優勢正逐漸從硬體製造，轉向軟體生態系、開發者社群、資料，以及開放協作。

放眼全球，最具影響力的 AI 生態系幾乎都建立在開源之上。從 PyTorch、Kubernetes、vLLM、ROS，到 Hugging Face，開源專案已成為 AI 發展不可或缺的基礎設施；NVIDIA、Meta、Google 等企業，也都透過開源建立技術影響力與產業生態系。

這對臺灣而言，既是挑戰，也是機會。

臺灣擁有世界級的工程人才與硬體實力，但開源貢獻長期仍以個人熱情為主，企業參與相對有限。當 AI 的創新模式越來越依賴全球開放協作，臺灣如何從「使用開源」，進一步成為「貢獻開源」、甚至影響開源，將是未來 AI 競爭力的重要關鍵。

本議程將分享開源如何從工程師的技術活動，逐漸演變為企業競爭策略與國家 AI 戰略，並介紹 Open Source Flywheel 的概念：透過持續貢獻建立影響力，吸引人才與資源投入，再進一步形成商業化與生態系的正向循環。

我們也將探討開源商業模式，並分享如何透過參與國際開源專案，建立世界級的技術影響力。

AI 正在重塑全球科技產業，而真正的問題已不再是臺灣能否持續製造世界級的硬體，而是臺灣能否成為全球 AI 開源生態系的重要貢獻者，並在下一波技術浪潮中，占有一席之地。

Scala 的型別系統在 JVM 生態系中獨樹一幟，但也因為其強大的功能讓開發者時常不知道如何運用這個優勢去開發型別上更加安全的程式。

在這個 session 中，將會簡單介紹 Scala 型別系統，並利用其底層的推導邏輯打造一個型別安全的自動機，初步帶領開發者理解型別系統並開發的擁有進階型別安全的程式。

在企業環境中，BMC 搭配 IPMI / Redfish 可做到非常完整的 light-out management 功能，但這些功能在 Homelab 使用的家用平台中幾乎不存在。近年市面上雖然有出現很多廉價的 IP KVM ，但大部分都只能控制單一設備，或是需要透過特殊而且設置複雜的 KVM switch 來遠端切換設備。對於有多台設備的 Homelabber 而言無論是軟體設置或是硬體取得上都十分困難。

本分享介紹開源專案 DezKVM，從 USB KVM（DezKVM-Go）專案出發，延伸至 Web-based IP KVM，並透過 USB Tree 與 firmware 設計打造可擴展的多設備架構。同時涵蓋 MCU 韌體、Linux v4l2 / alsa 以及 Golang 串流實作。

這不只是 KVM，而是一個可 scale 的遠端控制架構。
https://github.com/tobychui/DezKVM
https://github.com/tobychui/DezKVM-Go

從 DeepSeek 在 2025 年春節橫空出世以來，有關開源人工智慧的討論正式從技術與開源社群進入公眾視野。然而開源社群與人工智慧的發展其實比 DeepSeek 引發的討論更加深遠。有許多現在人工智慧技術仰賴的訓練架構以開源釋出，甚至開源社群與自由軟體的起源也與 MIT 的人工智慧實驗室相關。近期，開源人工智慧又因為主權 AI 的討論，而成為不同國家關注的焦點。在這樣的背景下，本議程將會聚焦在開源人工智慧的定義、風險討論與各國政策比較上。

首先，開源人工智慧所涵蓋的人工智慧技術究竟為何？只要公開模型程式碼，就可以稱作開源人工智慧了嗎？人工智慧的資料權重，甚至訓練的資料集是否要一併公開，才能算是開源人工智慧？各家大廠所宣稱的開源人工智慧真的是開源嗎？
其次，開源人工智慧由於其容易散布的特性，相較於閉源的人工智慧是否會產生新的風險？抑或是開源所帶來的透明度反而可以作為風險管理的手段與工具？
再者，各國對於開源人工智慧的態度為何？歐盟在《人工智慧法》中，明確規定以免費與開源方式釋出的人工智慧組件，可以不受該法規範。然而該豁免是否有例外與限制？美國政府對於開源人工智慧的態度為何，特別是在中美競爭逐漸蔓延到科技上的競逐，而中國在多款開源人工智慧模型的釋出均佔有主導地位時，美國會如何應對？新加坡對於開源人工智慧的政策又是如何？
以及最後，台灣可以從這些討論中，獲得什麼啟發呢？

AI has had an interesting side effect: it has shifted security from something often treated as an afterthought into a proactive, first-class concern in modern software development. With LLMs, scanning and identifying attack vectors is no longer limited to the codebase; it now extends across transitive dependencies, third-party packages, and entire distributions, resulting in a steady stream of newly uncovered critical CVEs.

Containers sit at the core of modern service deployments. Securing them is critical, and one of the most effective ways to strengthen security is to reduce the attack surface by stripping away everything that isn't essential.

The challenge is doing that in a reliable, efficient and repeatable way.

Luckily, there's a tool built for exactly this: Rocks.

It's an OCI-compliant image builder that lets you chisel away unnecessary packages and dependencies, helping you sculpt a lean, purpose-built container image, much like Michelangelo revealing a masterpiece from a block of "rock".

(pun intended)

More info: https://events.canonical.com/event/146/contributions/944/

This workshop offers a hands-on exploration of the web applications lifecycle, demonstrating how to build and deploy cloud-native, 12-factor applications using a fully open-source toolchain. Participants can use their preferred framework (Go, Flask, ExpressJS, or Spring Boot) to gain practical experience taking an application from source code to a production-like environment.

During the session, we will cover:
- Application Packaging: Building standard OCI images for your
applications.
- Production Deployment: Deploying workloads reliably across diverse
environments.
- Day-Two Operations: Utilizing automated operators to manage complex
tasks like database backups and schema migrations.
- Infrastructure Flexibility: Leveraging Rockcraft, Charmcraft, and
Juju to maintain platform independence, whether self-hosting or
utilizing a public cloud vendor.

Additionally, the workshop features a live demonstration of an AI Agent skill designed to automate these deployment steps, providing a simple, end-to-end approach to managing this open-source stack.

More info: https://events.canonical.com/event/146/contributions/933/

當我們在 PyTorch 中寫下一個模型時，一個高階的 Tensor 運算，究竟是如何一步步轉換成能夠在 GPU、TPU 或 NPU 上高效執行的程式？

在這場分享中，我們會從 PyTorch 出發，沿著模型一路走到硬體，並理解 ML/LLM Compiler 在其中扮演的角色。從 Computation Graph 與 Tensor Operation 開始，我們會看看 Compiler 如何將高階的模型運算，轉換成適合不同硬體架構執行的高效程式。

我們也會將這個流程與傳統程式語言的 Compiler 做比較，了解 ML Workload 在編譯上有哪些不同之處，並透過一個簡單的互動式 Demo，實際觀察 Graph Transformation 與各種 Optimization 如何影響執行方式。

最後，我們會進一步討論，為什麼 ML Compiler 在 LLM 時代變得越來越重要。LLM 的效能不只取決於運算量，也高度受到 Memory Movement、Kernel Execution、Data Layout，以及目標硬體特性的影響。

這場分享的目的並不是教大家如何訓練模型，或深入探討複雜的數學最佳化，而是希望讓軟體工程師建立一個清楚且實用的 Mental Model，理解從「寫下模型」到「模型真正高效地跑在硬體上」之間，究竟發生了什麼。

簡報連結：https://speakerdeck.com/tommyhonym/pytorch-ai-compiler

這個 talk 會把我研究 Andrej Karpathy (Open ai 創辦人） 的 microgpt 筆記走一遍。
microgpt 努力把Transformer、Attention、Embedding 等等元件用最簡單的方式實作，
讓你用最少的負擔理解 gpt 的流程。

或許...你之後就不會覺得 attention 這麼神秘了？
你也會知道漲價的記憶漲價被拿去裝什麼東西 :)

下面是我這次會跟大家 present 的投影片，也有附上滿滿的程式碼解釋的投影片。
https://github.com/timtan/MicroGPT-zh

2026 年，AI coding agent 的 context window 突破百萬 token。這意味著模型已經能輕易吞下專案程式碼、理解依賴關係並完成大部分任務。AI 的能力有了巨大的飛躍，分擔了我們許多技術工作。但身為螢幕前的開發者，我們的大腦並沒有跟著升級。當 AI 能一口氣吞吐海量資訊，人類的工作記憶卻依然被困在 7±2 個項目的生物極限。面對龐大專案與快速推進的進度，我們經常在編輯器中看著眾多開啟的分頁，被迫進行頻繁的脈絡切換，陷入「我是誰？我在哪？我現在要幹嘛？」的困境。

這場分享將以我業餘時間開發的兩個小眾 VS Code 擴充套件為主線。第一款 Quick Prompt 處理了「AI 跑任務 N 時，人已經想到 N+1」的時間差，提供一個內建於開發環境的筆記工具當作思考緩衝區，讓開發者外包記憶、維持思維的連續性。另一款 VirtualTabs 則是一個用於管理分頁群組的虛擬檔案目錄。在實作完 AI context 匯出以及 MCP (Model Context Protocol) 伺服器等整合功能後，卻發現零星收到的 Issues 幾乎全集中在「標亮當前檔案」、「拖曳排序」、「視窗畫面分組」等幫助人類維持空間感的基礎 UI 需求。

這場分享將側重於實務面的開發經驗，分享專案中的技術實作，以及從使用者回饋中獲得的哲學反思：在模型能力幾乎能自己解決技術問題的今天，我們開發工具時，解決的究竟是 AI 的瓶頸，還是人類認知負荷的瓶頸？如果你也對開發者工具或 AI 協作體驗感興趣，歡迎參與本場議程。

Git 是幾乎所有開發者每天都會碰到的工具，但你可能很少想過：它的繁體中文翻譯是怎麼被維護的？

這場分享不會把重點放在「某個詞到底該怎麼翻」的語言學辯論。實際上，Git 繁體中文翻譯社群很小，真正困難的往往不是翻譯決策，而是更務實的問題：要怎麼讓人願意開始翻？要怎麼 review？要怎麼把大家的貢獻整理成符合 Git 上游慣例的提交？

Git l10n 有一套自己的運作方式。翻譯不是隨便一個人改完 .po 檔、送 PR 就結束；要注意提交到哪個 repo、對應的 commit 格式（Signed-off-by）、squash、寄送到 l10n 流程，以及最後如何進入 Git release。這些規則對熟悉 Git 的人來說都不一定直覺，更不用說只是想幫忙修一句中文的新貢獻者。

為了降低門檻，我們導入 Weblate，希望讓不熟悉 Git 流程的人也能直接在網頁上參與翻譯。但導入之後才發現，Weblate 產生 commit 的方式，和 git-l10n 對提交記錄的要求並不完全相容。於是，維護者必須在「讓貢獻變簡單」與「讓 upstream 可以接受」之間，設計出一套實際可運作的中間流程。

本議程會分享 Git 繁體中文翻譯團隊實際踩過的坑：最初是如何從簡體中文基礎建立繁體中文翻譯、如何吸引新貢獻者、如何 review 翻譯品質、如何處理 Weblate 產生的 commit、如何透過人工 squash、Co-Authored-By 與自動化腳本保留貢獻紀錄，最後再把整理好的成果送進 Git 的正式 l10n 流程。

這場議程也會分享，一個翻譯字串從 Weblate 被修改、被維護者 review、被整理成符合慣例的 commit，到最後進入 Git release，中間到底經過哪些關卡。也會談到，在人力有限的情況下，哪些事情值得自動化，哪些事情仍然需要人工判斷，以及維護者如何在貢獻者體驗與上游規範之間取得平衡。

如果你維護過開源專案、想建立翻譯流程、正在思考如何降低貢獻門檻，或只是好奇「一句中文翻譯要怎麼正式走進 Git」，這場議程會提供一個非常真實、很小但很完整的案例。

A person who had no interest in IT started using LibreOffice after it was introduced by a colleague at work. This simple change became the first step into the world of open source software (OSS).

The colleague who introduced LibreOffice was also active in OSS communities. At first, LibreOffice was just another tool for daily work. However, through using it, he learned about the community behind it. By meeting new people and having new experiences, his world gradually became larger.

In this talk, we will look back on how a person with no interest in OSS became involved in an open source community. We will also share the story from the viewpoint of the colleague who helped him take that first step.

Why did a world that once seemed unrelated become interesting? What encouraged him to get involved? What did he learn through community activities, and how did his way of thinking and acting change? We will answer these questions through real experiences.

This story includes the worries and uncertainty of joining a community for the first time, lessons learned from mistakes, the satisfaction of working together with others, and the process of finding a role within a community. We will also talk about how experiences gained through OSS activities have influenced work and daily life.

We hope this talk will be useful for people who are interested in OSS but hesitate to join, for those who want to take a first step into a new community, and for those who think OSS has nothing to do with them.

This session dives into the core mechanisms of Linux kernel tracing.
We explore dynamic instrumentation such as exception-based kprobe and code-patching ftrace, comparing internals and performance overhead.
The talk also covers low-overhead, statically defined tracepoints and counter-based sampling via perf_event. Finally, we introduce BPF as a programmable execution layer that reuses and enhances tracing sources for flexible and efficient kernel observation.

本場分享將以「無背景友善」為原則，帶領參與者理解 FIMI（Foreign Information Manipulation and Interference，外國資訊操弄與干預）的基本概念，並以無邊界集團相關公開案例作為切點，說明資訊操弄如何不只存在於政治新聞或明顯假訊息中，也可能嵌入日常生活粉專、內容農場、導流網站與平台互動機制之中。

分享將先說明為何 FIMI 的重點不只是內容真假，而是行為者、協調模式、基礎設施與操作目的。接著以無邊界集團為例，介紹如何從粉專透明度、貼文模式、留言導流、內容農場網絡與跨境管理跡象，觀察一套資訊操弄操作如何被建立、維持與變現。

最後，也會分享調查工具打造與使用經驗，包括如何記錄粉絲專頁與網站變化、保存證據、追蹤 URL 與內容農場關聯，以及如何把零散線索整理成可被討論、查證與協作的調查材料。希望讓參與者即使沒有相關背景，也能理解網路與認知韌性，並帶走一套可入門實作的觀察方法。

時至今日，為了要讓資料流程能夠更自動化與更容易的進行管理，許多的軟體系統對於資料處理面流程中，陸續導入了資料中台、資料網格與資料經緯等技術，試圖讓資料流、資料管理等議題更加地容易。

在COSCUP 2025時，講者分享了如何使用PostgreSQL搭配NiFi實現簡易自動化資料收集的良好經驗。本議程中，基於上述的議程，講者將會分享實際的應用專案案例，如何使用NiFi、PostgreSQL、Python與Groovy進行互相搭配、結合與寫程式的方式，打造出屬於自己各個項目的硬體指標收集與彙算的資料流，並分享相關資料流、架構設計與建置的經驗。

隨著 Agentic Finance 與 Autonomous Agents 的討論度快速升溫，大家開始不再只關注「AI 能不能完成任務」，而是進一步思考：當 AI Agent 可以自己溝通、協商、交易甚至彼此合作時，我們該如何為它們建立一套真正可運作的經濟系統？包含如何在區塊鏈上安全地傳遞訊息、驗證結果、完成付款，以及建立彼此之間的信任與 reputation。
Agent Commerce Protocol（ACP）正是在這樣的背景下，於 2025 年由 Virtuals Protocol 提出的開放協議。ACP 目標是打造一套面向 onchain agent commerce 的基礎設施，讓 buyer、agent 與 seller 能在去中心化環境中進行可驗證的互動與交易。透過智能合約托管、加密驗證、獨立 evaluator 機制，以及多 Agent 協作架構，降低多步驟交易中的信任成本與協作風險。ACP 因此不只是支付協議，更像是一套專為 AI Agent 經濟打造的鏈上通訊與商務協議層。
雖然 ACP 是一年前提出的概念，但其中許多設計至今依然極具前瞻性，甚至能對應目前 AI Agent、MCP、Agent-to-Agent communication 與 onchain coordination 的發展方向。本次 Workshop 將以深入淺出的方式，帶大家理解 ACP 背後的設計理念、Agent 在鏈上的協作模式，以及它如何嘗試建立未來 Agent Economy 的基礎框架。現場也會透過實際案例與 demo，展示多個 AI Agent 如何在鏈上彼此互動、協商與完成任務。

The recent release of MySQL 9.7 Long Term Support (LTS) community editions, joins MySQL 8.4 LTS as the two current LTS releases. The popular and widely used MySQL 8.0 has now reached EOL. Organizations running MySQL 8.0 should be migrating to MySQL 8.4 and evaluating the roadmap of features and capabilities of the new MySQL 9.7.

In this session, we'll take a deep dive into the new capabilities shipping in MySQL 9.7 Community Edition: full DML support for JSON Duality Views, the Hypergraph Optimizer, JavaScript stored procedures, enhanced security management, and a number of Enterprise-only components now available to all — including replication observability tools and OpenTelemetry-based telemetry integration.
This talk focuses on how to responsibly evaluate and test a major version release before production deployment. We'll walk through a practical checklist covering compatibility assessment, workload testing, staged rollout strategies, and rollback planning to help developers integrating new features into application workflows, DBAs managing the migration and monitoring behavior changes, and engineering leadership weighing the timing and scope of the upgrade.
Attendees will leave with a better understanding of MySQL 9.7's most impactful features and a strategy they can take directly back to their team to evaluate them.

Building a sovereign, open-source cloud platform for telecommunications environments is more challenging than it seems. The telco use case involves addressing the need for an evolving security architecture. Once teams commit to SBOM compliance, a long tail of previously invisible vulnerabilities suddenly becomes visible.

This talk will demonstrate how utilising an open-source toolkit can help teams establish a solid foundation for compliance and security hardening on telco cloud platforms. Tools such as Syft, Grype, DefectDojo, the OpenSSF Scorecard and GitHub for Open Source can help development and security teams establish an integrated CI/CD pipeline for DevSecOps, gain visibility into the security posture of your project, deliver a verifiable SBOM to end users and automate dependency monitoring and management.

We will walk through how component scanning and SBOM management can reduce unresolved vulnerabilities by 80%. Integrating security tooling into the CI/CD pipeline reduces time to resolution and enhances the developer experience. Ingesting the scan findings and artefacts into a centralised platform enables faster triage, prioritisation and resolution of vulnerabilities in a methodological manner. We will also demonstrate how open source tooling feeds into compliance and sovereignty for telco deployments.

Attendees will learn how to design an SBOM-native release workflow and how to triage an SBOM without stopping delivery. They will also discover why open source and digital sovereignty go hand in hand. They will also learn how to turn security compliance from a bottleneck into a competitive advantage and understand why open source is the only foundation that makes digital sovereignty possible.

傳統上，系統底層的 BIOS 韌體多由少數供應商掌控。這種封閉的「黑箱」特性不僅限制了使用者的控制權，更往往隱藏著難以察覺的資安漏洞與效能瓶頸。

本次演講將帶您深入探討韌體領域的革命性轉變——開源 BIOS。我們將剖析傳統閉源架構的痛點，並探討開源解決方案帶來的無限可能。透過開放的機制，我們得以打破硬體廠商的長期限制，實現更極致的開機速度、更高的程式碼透明度，以及可高度客製化的安全防護。

無論您是系統開發者、資安專家還是開源愛好者，本場演講都將為您揭示如何奪回伺服器與個人電腦底層的絕對掌控權，並與全球社群攜手，共同建構一個更自由、透明且安全的開放硬體生態圈。

Bringing Linux up on a new RISC-V board usually means assembling a vendor BSP and chasing toolchain mismatches by hand.

crossdev-stages is a Rust CLI (and also a library) that wraps the whole flow in one declarative pipeline.

Each board is a small set of config files in boards/<name>/ (arch, CFLAGS, kernel / OpenSBI / U-Boot / firmware repos & tags, services), with optional pre/post/override shell hooks per build step.
The tool drives Gentoo's crossdev to build a cross-toolchain, fetches pinned sources, cross-emerges the rootfs with whatever Portage packages and USE flags the board declares, and assembles a bootable image.

It runs inside hakoniwa (箱庭): an unprivileged user-namespace sandbox, so no sudo or Docker daemon.

Cross-toolchains and binary packages are keyed by (CHOST, canonical CFLAGS); CFLAGS go through sokgi first, which normalizes semantically equivalent flag strings (token order, last-wins overrides) to the same hash.

So one toolchain build per hardware profile, shared across compatible boards. Each image build also writes a build.lock.toml pinning stage3, source commits, kernel/U-Boot config sha256, and CFLAGS. crossdev-stages update diffs it against upstream HEAD when you want to refresh.

AI 正快速改變開源軟體的開發與使用方式，也帶來新的安全挑戰。面對日益複雜的開源生態，台灣的技術社群、企業、研究者與開發者可以如何攜手合作，共同補足開源安全的缺口？

本場世界咖啡館將邀請來自不同專業領域的桌長，引導各桌進行主題討論。與會者將透過輪桌交流的方式，依序參與不同主題，與桌長及其他參與者分享觀點、交流經驗，激盪更多跨領域的想法。

無論您是開發者、資安從業人員、研究者、學生，或是關心 AI 與開源安全發展的朋友，都歡迎一起加入討論，透過集體對話，探索台灣社群在 AI 時代推動開源安全的更多可能。

2026 年 3 月 23 日，Rails 一次釋出 7.2.3.1、8.0.4.1、8.1.2.1 三個版本，修補了多個 CVE，涵蓋 XSS、ReDoS、記憶體耗盡、路徑穿越、glob 注入等漏洞，是近年規模最大的一次。
本場演講不會逐一拆解 CVE，而是退一步看：這些漏洞之間是否藏著共同的設計陷阱？我會挑出最具代表性的幾個，歸納成三類：信任邊界錯置（內部狀態與外部輸入混用）、檔案系統 API 接受未過濾輸入（path traversal 與 glob injection）、以及「修一次不夠」的不完整修補。
每個陷阱會搭配實際漏洞程式碼與修補方式解說，並提供可立即套用的檢查清單。聽眾不需要資安背景，只要寫過 Rails 應用就能理解。

這一場整理現實中真正被採用的開源隱私工具，說明公民團體、獨立記者與注重隱私的個人實際採用了哪些工具、又如何運用，並分成三個場景依序介紹。公民團體與 NGO 對外以 Signal、Matrix 進行加密通訊，內部協作採用 CryptPad、Etherpad，並以 SecureDrop、GlobaLeaks、OnionShare 接受檢舉與敏感資料投遞，另以 OONI 觀測各地的網路審查。獨立記者的場景，涵蓋安全收件管道、以 mat2 與 Metadata Cleaner 清除檔案內嵌的作者與 GPS metadata，並運用 Tails、Qubes OS 隔離高風險作業。個人隱私防護則有 Tor Browser 與 Brave 抵禦網頁追蹤、GrapheneOS 與 LineageOS 取回手機的控制權、KeePassXC 與 Bitwarden 管理密碼，以及自架 DNS 過濾廣告與追蹤器。每一類都會說明各項工具由誰採用、在何種情境下使用，以及為什麼這些高風險場景特別倚賴原始碼可被公開稽核的開源工具，封閉軟體無從驗證是否遭到竄改。最後回到社群自身，說明這些國際專案社群如何參與：將介面翻譯為正體中文、在校園架設 Tor 中繼節點、回報問題並貢獻程式碼。

完整的場景與工具對照收錄於 anoni.net 文件站，聽眾亦可延伸至當天其他相關場次。

在開源社群與大型年會（如 g0v Summit）的籌備過程中，往往會面臨到「志願者能量有限」與「行政庶務繁瑣」的雙重挑戰。當我們用設計思維重新審視這些痛點時，會發現許多摩擦力來自於格式轉譯與重複勞動。

本議程將分享如何透過「服務設計」的視角，開發一系列輕量化工具：從可以驗證信箱地址的自動化折扣碼發放系統、讓編輯者能在雲端文件工具排版並一鍵轉為 HTML 郵件寄出的小工具，到將結構化資料（Opass json）自動生成為 SVG 檔的互動式網頁（g0v/opass-schedule-to-svg）。

我們將探討如何透過這些「看不見的設計」，降低參與門檻，讓志工能將珍貴的創造力留在核心任務上，實現真正「優雅」的開源協作。

實際導入 AI Agent 後，用起來常會發現：跑程式碼風格檢查、靜態分析、執行自動化流程等這些重複出現的開發任務，每次還是要靠自己下 Prompt。即便大型語言模型越來越能理解開發者的意圖，團隊的開發知識卻難以穩定、可攜帶且低成本地傳遞給 Agent。

這場分享將從開發者與 AI 協作的演進談起，說明為什麼 Agent Skill 會成為下一個值得 Kotlin 工程師投入的 Agent 協作工具鏈。Skill 可以把重複的流程、工具使用方式與團隊慣例，打包成可重複使用的能力，讓 Agent 在需要時才載入相關知識，減少 Token 浪費，也降低每次都重新教 AI 的成本。

接著，將以 Kotlin 開發者熟悉的情境，介紹 Skill 的基本架構設計、不同 Agent 與開發環境中的套用範圍和管理差異，並討論 Kotlin 開發生態中，有哪些開發知識及情境適合整理成 Skill。最後，會分享如何透過開源工具，讓 Skill 不再綁死在單一提供商、機器或專案，最大化 Skill 帶來的效益。

WirForce 是台灣每年舉辦的大型 LanParty，2024 年擁有 1200 個 BYOC 座位，是亞洲規模最大的同類活動。要讓超過千名玩家同時在線、低延遲打遊戲，網路基礎設施必須在有限的佈建時間內達到「盡可能不讓玩家抱怨」的穩定性。
2024 年，我首次加入現有網路團隊，尋找開源的方案來處理Router。本議程會誠實覆盤當時發生了什麼、走過多少地雷，以及這些教訓如何成為 2025 年的改進目標。
2025 年我們改用 VyOS 搭配 VPP（Vector Packet Processing），提供 800 個 BYOC 座位的網路使用。分享在這種大型看似單一簡單的架構中網路的困難與碰到甚麼問題，以及用了哪些方法來減輕網路負擔。
如果你正在評估 VyOS / VPP 用於高密度臨時網路，或只是想知道「千人 LanParty 的網路會出什麼事」，這場分享會給你一個來自現場的經驗分享。

This is a regular status update of what has landed and what's landing in Ubuntu Touch.

We'd like to show you what we have been working on over the last year. From upgrades to our UI toolkit to Qt6 over to the quest of bringing Mir 2 to supported devices, right next to how we land those in a storage-limited environment. And of course we have Snap updates to show.

Many pieces to pick up and you'd surely like to know why, what and what's going on.

More info: https://events.canonical.com/event/146/contributions/953/

The industry is rapidly moving from single LLM applications toward systems composed of multiple agents, tools, memory layers, and workflows. But most discussions around AI agents focus heavily on frameworks and demos, while avoiding the larger systems question:

What does agent infrastructure actually look like?

This talk takes a cloud native and systems-oriented view of AI agents. We’ll explore how ideas from distributed systems, containers, orchestration, and platform engineering are beginning to shape the next generation of AI tooling.

Topics include:

• Why AI agents resemble distributed systems more than chatbots
• The emerging role of protocols like MCP
• Declarative workflows versus imperative orchestration
• Reproducibility and portability challenges in AI systems
• Why infrastructure concepts like OCI artifacts and YAML workflows are reappearing in AI tooling

Using Docker cagent as a concrete example rather than the centerpiece, we’ll examine how modern agent runtimes are evolving toward infrastructure-style abstractions.

Intro: This BoF is a casual meetup for anyone curious about vLLM, the open-source, high-throughput inference engine for LLMs — following up from our meetup on Aug 1st (Event link: https://luma.com/drqty961) . This session is especially for those who couldn't make it that day, as well as anyone who wants a deeper exchange with the core contributors. In 30 minutes we'll do a quick lightning overview of what vLLM is and what's new, then open it up for questions, discussion, and informal chat — bring your deployment war stories, contribution questions, or just curiosity. Great for developers working on LLM inference/serving, students interested in open-source ML infra, and anyone exploring where to start contributing to a fast-moving OSS project.

本演講將以講者親身與會經驗，系統性分享 UN Open Source Week 2026 中，聯合國和全球專家學者如何看待開放原始碼對於發展人工智慧與新興技術的助益。內容預計包含開放原始碼 × 人工智慧的國際共識、跨境協作治理框架、開源硬體與基礎建設趨勢、以及開放代理（Open Agents）的透明度與問責機制。同時，該大會預計也將為「數位合作的開放性」提出的普惠創新政策路徑——可謂是開放文化在數位時代的集大成。

我和北科程式設計研究社的伙伴利用課餘（以及偶爾的上課時間）維護一款 GPLv3 授權的校園軟體 Tattoo，協助北科大學生查課表、看成績、處理校務系統。專案從 zh-TW 與 en-US 雙語起步，英文由社團成員人工翻譯；後來為了服務校內多數來自非英語系國家的外籍生，又逐步擴充到我們自己不熟的語言,採用「LLM 出初稿、再透過翻譯平臺交給該語系學生修正」的流程。半年下來繞了不少遠路，這場分享想把走過的路攤開，給做小型自由軟體本地化的開發者一份參考。

一開始談翻譯協作平臺。為了上述的多語流程，我先後試過 Weblate 和 Crowdin，最後兩個都關掉了。一方面是同步機制本身彆扭：譯者在平臺上的修改會被 bot 一筆筆推回 GitHub，被「New translations zh-tw.i18n.yaml」這類 commit 淹沒主線。另一方面是兩個平臺接 GitHub 的權限模型：為了一個專案的翻譯，卻得授權整個組織的管理權限，這個取捨很難說服自己。最後我們只能暫時關閉同步，並重新思考要怎麼讓非開發者的譯者貢獻。

我們還會介紹 Flutter 上的選擇。Flutter 生態有幾套常見的 i18n 套件，我們最後選了對譯者與審查者格式友善的 slang。框架本身不是這場的重點，只會用幾分鐘帶過技術選型的過程。

接下來我們會討論翻譯檔的儲存格式。從 ARB (JSON-based) 看到 JSON、YAML，討論為什麼落腳在 YAML：人類可讀、可註解、多行字串友善、不被尾逗號搞死。當然 YAML 並非完美方案：行尾多餘空格、長字串折行語意、保留字與特殊字元的 escaping 都會偶爾造成問題，這些經驗一併分享。

最後是漢英對譯實戰陷阱：以漢語為母語的開發者很容易忘了其他語系有單複數、時態等語法分支——當你直覺地把字串寫好後，等到 en-US 要區分 one/other 時，就得回頭重寫整個結構，整個 App 一起改。我會以「密碼將於 N 天後過期」為例，示範從第一天就該怎麼設計翻譯鍵。同場加映 CJK 與英數字之間的空格該不該寫進原始字串、教室名稱與專有名詞的雙語對應策略，以及校務系統回傳混雜中英資料時，如何用一個小小的 localized(zh, en) helper 處理。

希望這 30 分鐘能讓做 Flutter App 或其他軟體的朋友，少踩幾個我們踩過的坑。

結合 RAG × GraphRAG × Agentic Search，從檢索到自我學習，構建真正會進化的 AI 搜尋架構。

CPython 3.15 brings updates that change how we debug, start, and scale Python systems — not just syntax sugar.

In this talk, I’ll go deep on 2 high-impact topics:
- Tachyon profiling: find bottlenecks with low overhead
- FreeThreading updates vs. Go/Java/.NET, where CPython wins, where it doesn’t

Then I’ll do a fast sweep of:
- explicit lazy imports: faster startup for your app
- frozendict, and its design
- unpacking in comprehensions: your eyes love it!
- UTF-8 by default: already feeling more confident?

Presentation is here

In Asian open source communities, conferences and regional events play an important role in creating personal connections across countries and projects. However, maintaining collaboration after events is often much more difficult than starting it.

In regions using CJK languages, communities share practical challenges such as localization, typography, and translation workflows, creating strong opportunities for regional collaboration.

This presentation shares practical experiences from LibreOffice Asia Conference, Wikimedia ESEAP activities, COSCUP, and GNOME Asia Summit. Using examples primarily from LibreOffice and Wikimedia communities, the talk covers what worked and what did not in practice, including co-hosting with other communities, social events, and post-event online communication.

The talk also discusses common challenges such as language barriers, limited volunteer capacity, and sustaining collaboration after events.

This session offers practical observations on what makes cross-community events effective, and why sustaining connections afterward remains a challenge across Asian open source communities.

在嵌入式系統開發中，將成熟的 Linux Kernel 驅動或框架移植至 U-Boot 是建構硬體支援的重要環節。傳統流程需由熟悉該裝置的工程師，研讀軟硬體規格，人工分析兩者 API 差異、手動裁減中斷處理與併發機制，並重新適配核心結構，必要時還必須升級同步framework版本差異。過程耗時且易出錯。
本講題將分享如何轉變開發方式，透過AI輔助，參照Linux Code生成 U-Boot 兼容代碼。我們將分享如何透過AI工具輔助與人工驗證，加速開發週期。

民主社會仰賴公民的集體智慧，然而這份信任基礎正遭到資訊操弄的侵蝕。

「Cofacts 真的假的」自 2016 年起建立開源的群眾查核共筆平台，讓在意假訊息的民眾撰寫查核回應，直接與在 LINE 上收到謠言的群眾對話。

這十年間，假訊息的處理一直都極具挑戰性：同一則謠言常以文字、截圖、影像等形式不斷變形重現；而近年生成式 AI 的普及，更讓「純 AI 生成影像」的查核與比對難上加難。另一方面，我們在線下工作坊觀察到「群眾防禦」的困境：民眾雖對假訊息感到焦慮，但查核門檻過高，志工常因「怕自己查錯」而陷入自我懷疑與消耗。

面對不對稱的資訊戰，AI 既是挑戰也是機會。這場分享會將帶過社群查核者會遇到的痛點，以及 Cofacts 打造開源技術解方的經驗。我們也會探討如何讓 AI 扮演「輔助」而非「取代」的角色，在不失去人類的自主性（human agency）的前提下，引領公民跨越查核門檻，一同參與這場抵禦資訊操弄的運動。

How you combine a Software Engineering and cycling? Most people will now think right away Strava or Garmin. Massive ecosystems, millions of users. But what if we step back and build our own small cycling companion from scratch? What can we learn along the way — about APIs, maps, GPS data and make an integrated platform via KMP? Where will we suffer if we dip into a full of special file formats and integration points and map data. Which concepts can we utilize to have a platform we can expand to something bigger? And how we can make that about community rather than competition.
Whether you're a cyclist curious about code or a developer curious about cycling, let’s hope on and get started.

Description

Modern data is highly connected — such as supply chains, networks, and relationships.

PostgreSQL is strong for relational queries, but when we need to follow multi-step connections, queries quickly become complex. JOINs grow, and the SQL becomes harder to read, maintain, and extend.

SQL/PGQ (SQL:2023) brings graph query capabilities into SQL. It allows us to describe connections and paths more directly, without leaving PostgreSQL.

SQL/PGQ is currently under development in PostgreSQL, and early implementations are already available for experimentation.

In this talk, I show how queries evolve from simple joins to multi-step paths. We compare traditional SQL and SQL/PGQ, focusing on readability and how we think about the problem.

Using a small trade network example, I demonstrate how SQL/PGQ can simplify queries and help us better understand connected data.

Outline

• Problem: complex JOIN queries
• SQL/PGQ basics (SQL:2023)
• SQL vs SQL/PGQ examples
• Graph thinking in PostgreSQL
• Current status and how to try it

Key Takeaways

• JOINs become complex for multi-step queries
• SQL/PGQ simplifies relationship queries
• Graph thinking improves understanding of data
• SQL becomes more powerful, not replaced

Ruby has multiple implementations. CRuby (the canonical "MRI") is the reference, but JRuby (now at Ruby 4.0 on the JVM) and TruffleRuby (at 3.4, with 4.0 underway on GraalVM) are real, production-grade alternatives. They aim to run the same Ruby code, so your gems, your Rails apps, your scripts. But they're written in different languages, on different VMs, with different internal data structures. So how do they agree on what Ruby actually is?

This talk will showcase and explore the usage of Go outside the normal usage in an operating system and how you can even write bare metal firmware with it. We will show how to run VPN tools like Tailscale and Netbird directly on your hardware without an operating system. We will also learn what has changed since the last Tamago talk during OSFC last year including new platforms, upstream effort of bare metal Go directly into the official compiler and pure-go networking and filesystem work.

Building a DAW or alike across multiple platforms including mobile and the Web has been a challenging task for various reasons. But thanks to recent innovation and development in audio dev. community, it became realistic in 2026.

Through this session we will discuss how cross-platform DAW sequencer engine became realistic, based on my own dev. experience. The topics will include:

• inclusive audio plugin hosting API that covers Android and Web
• audio engine requirements, especially node graphs and real-time audio processing boundary
• GUI interaction approaches on each plugin format
• how parameter updates work, especially across states and presets, among GUI, DSP and host
• requirements on song project data models
• separation of concerns among all these

In the agentic coding era, there are many emerging audio app projects that people used to find impossible to work on. I hope this session will give some guidance and design choices to those who want to build their own DAW or similar audio engines.

隨著開源軟體成為現代企業開發的基石，軟體供應鏈安全已不再是選擇題。實際上，企業在推動開源治理時，往往面臨「標準模糊」與「開發者反彈」兩大挑戰。

本場演講將分享在企業內部推動開源治理借鏡國際社群 OpenSSF 經驗。我們將從 OpenSSF Scorecard 的自動化評分機制出發，探討如何量化開源專案的安全風險；接著引入 S2C2F (Secure Supply Chain Consumption Framework) 與 OSPO Baseline，建構一套完整的企業開源治理框架。

我透過 DE10-Nano FPGA 開發板，沒有 GPU、不呼叫任何框架，從模型量化、推論引擎到 RTL 硬體設計，在 AI 推理的每一層都讓自己做中學，將 BitNet 2B transformer 模型塞在 1GB 記憶體的 DE10-nano FPGA 上完成 token 輸出。

此演講適合那些想要摸清 LLM 從底層硬體到最終 token 輸出的人。

這場分享會聊：三元權重 LLM 為何特別適合 FPGA、T-MAC 查表的實作與資源平衡、HPS/FPGA 混合推理引擎的設計取捨、以及在資源極度受限硬體上做 LLM 部署的踩坑經驗。

Cross-Chain Bridge 是多鏈生態的重要基礎設施，但由近期多起案例都能發現，即使合約通過 audit，也不代表整體系統安全。
此次分享將從近期案例（特別是 Kelp DAO 事件）出發，介紹目前常見的 Cross-Chain Bridge 設計模式，並且從系統安全角度拆解常見安全風險來源，帶大家深入認識 bridge security。

當大家談到 RAG（Retrieval-Augmented Generation），第一個想到的儲存層往往是 Pinecone、Qdrant、Milvus，或是 PostgreSQL + pgvector。但是在絕大多數企業既有的 stack 裡，MySQL 才是那個「明明就在那裡、卻幾乎沒有人在 RAG 選型討論中提到」的角色。
MySQL 9.0 已經正式加入 VECTOR 資料型別。那麼問題來了：在不另外搬一座資料庫的前提下，到底能不能用 MySQL 把一個可運作的 RAG 系統做出來？做得起來、又能撐多久？
本場次以一個從零打造、完整開源的 demo 專案為主軸，帶聽眾一步步在 MySQL 9.x 上構建 RAG 系統：從 schema 設計、embedding 寫入、Top-K 相似度查詢，到串接 LLM 完成問答。途中會深入 VECTOR 型別的內部儲存方式、可用函式，以及目前最關鍵的限制——社群版尚未提供原生 ANN 索引。
接著，我們把同一份資料、同一組查詢搬到 PostgreSQL pgvector 上做對照組 benchmark，誠實呈現兩者在 latency、recall、開發體驗、維運成本上的差距。最後提出一個務實的選型決策框架：什麼情境下「在 MySQL 上做 RAG」是合理的工程選擇，什麼情境下應該果斷換工具。
所有 demo 程式碼、SQL schema、benchmark 腳本與投影片都會以 Apache-2.0 / CC BY-SA 授權公開於 GitHub，現場聽眾可以即時在自己的環境重現。

[ 互通性（Interoperability）是什麼？為什麼 LMS 需要互通性標準？]

• 我們將從現代數位學習環境談起：LMS 已不再只是單一平台，而是需要整合影片、測驗、AI、教材、作業與外部服務的學習入口。

• 探討互通性標準如何降低整合成本，讓不同學習工具能以一致方式與 LMS 協作。

[ 簡介 1EdTech 的互通性生態系 ]

• 介紹 IMS Global 到 1EdTech 的演進背景，以及其在教育科技領域的角色。

• 簡介主要互通性標準：LTI（Learning Tools Interoperability）、QTI （Question and Test Interoperability）、One Roster 說明這些標準如何支援身份驗證、跨平台整合。

[ 探究 LTI 1.3 的核心運作概念 ]

• LTI 1.1 到 LTI 1.3 的演進：新機制、新功能與安全性改善。

• 教學平台與擴充工具如何溝通：LTI 1.3 Launch Flow （OIDC Login、OAuth 2.0、JWT / id_token）

[ Demo：以 NTUCOOL / Canvas LMS 為例串接 LTI 1.3 學習工具 ]

• 實際展示：如何在 Canvas 建立與設定 LTI 1.3 Tool？他有什麼明顯的好處？

• 經驗分享：談 NTUCOOL 如何依照現有的技術堆疊實踐 LTI 1.3

經歷《我們與惡的距離》戲劇之後，為何我們對於善惡邊界仍如此篤定？在全面實名監控與無須許可的匿名服務之間，是否有第三條路可走？本議程希望透過打破善惡二元的價值觀框架，帶領會眾一同思考數位社會的更多可能性。

隨著大型語言模型（LLM）驅動的 Agents 逐漸走入自動化工作流，從履歷篩選、客服對話到商業決策等，Agent 的自主性在提升效率的同時，也悄然埋下了不同的偏見與歧視的風險。由於 Agent 具備推理與調用外部工具的能力，其偏見往往比單純的 LLM 更加隱蔽且具備行動力，如何有效地評估這些智慧體，成為構建可信 AI 的關鍵挑戰。

在此次將分享深入探討一套開源的 Agents 偏見檢測工具。我們將從技術角度解構 Agent 產生偏見的根源，並介紹如何透過自訂的知識庫與資料集來建立自動化基準測試，對 Agent 在特定情境下的是否有偏見的行為進行量化評估。

本次分享的核心內容包括：
- 偏見識別維度： 定義 Agent 在應用情境中的偏見樣態與基準調整。
- 評測工具架構： 介紹如何利用開源框架建構自動化測試腳本，模擬多樣化用戶輸入以誘發潛在偏見。
- 實戰案例分析： 展示該工具在實際場景（如徵才 Agent 或決策輔助 Agent）中的檢測成果。
- 緩解策略： 探討如何透過 Prompt Engineering 或約束層（Guardrails）在開發階段降低偏見風險。

我們希望透過開源工具，賦予開發者主動監測與修正 Agent 行為的能力。這不僅是一場技術分享，更是呼籲開源社群共同參與，為 AI 時代建立一道公平與透明的防火牆。

Autotest and KVM virt-test have long served as the backbone of system and virtualization testing in Linux environments. However, their tightly coupled architecture and operational complexity present growing challenges for modern development workflows, particularly in terms of modularity, scalability, and CI/CD integration.
As highlighted in Ubuntu Testing Automation, Ubuntu’s testing ecosystem has historically relied on Autotest and KVM autotest. Over time, this ecosystem has evolved, with KVM autotest and virt-test transitioning into the Avocado and Avocado-VT projects. Avocado represents a natural progression of the Autotest lineage, reflecting a broader shift toward more maintainable, extensible, and developer-friendly testing frameworks.
This talk provides a clear and technical comparison between Autotest and Avocado, focusing on their architectural differences, strengths, and trade-offs. We will explore key features of Avocado, including its Python-based test model, plugin architecture, parameterized execution, and enhanced reporting capabilities. The role of Avocado-VT as a continuation of virt-test for virtualization testing will also be examined.
Rather than advocating for a full rewrite, the session outlines a practical migration strategy for Ubuntu-based systems, demonstrating how teams can incrementally transition from Autotest to Avocado while preserving existing test investments. We will examine when to leverage Avocado-VT for compatibility and when to adopt native Avocado tests, along with approaches for integrating Avocado into modern CI/CD pipelines.
Attendees will gain a balanced understanding of both frameworks, along with actionable guidance on adopting Avocado to build more maintainable, scalable, and future-ready system testing workflows on Ubuntu.

More info: https://events.canonical.com/event/146/contributions/939/

Modern production systems often restrict SSH access, making traditional debugging on Ubuntu instances increasingly difficult. In this talk, I share real-world SRE experiences debugging live issues on Ubuntu virtual machines running on GCP, without logging into them.

Using eBPF-based tools on Ubuntu, I demonstrate how to trace system calls, analyze network behavior, and identify performance bottlenecks in real time. Through actual incident scenarios, we’ll uncover how Ubuntu’s kernel capabilities combined with eBPF enable “invisible debugging,” helping engineers resolve critical issues faster without disrupting production systems.

More info: https://events.canonical.com/event/146/contributions/929/

資料科學工具 OpenRefine，加上 Python 的台語處理套件，去半自動化處 理Wikidata 與 OpenStreetMap的地名項目的標籤。另外也嘗試用爬蟲抓維基百科上模板當中的臺灣台語羅馬字拼音方案與白話字的名稱。

在許多 Python 專案中，Release 流程仍高度依賴人工：開發者需要手動撰寫 Changelog、整理版本差異，前後端或不同服務之間的版本資訊也常缺乏一致性，導致 PM、QA、RD 之間溝通成本高，並增加部署與回溯的困難度。

本次分享將以 Python 專案開發流程 為背景，介紹如何結合 Conventional Commits、分支治理策略（GitFlow / Trunk-based）與 CI/CD 自動化流程，打造一套「不依賴人工」的版本治理機制。

我們會展示如何在 Python 專案中：

透過 commit 規範自動驅動版本號（符合 semantic versioning）
使用工具（如 semantic-release、commitizen、Python packaging 生態）自動產生 Release Note
將版本資訊整合進部署流程（如 artifact / container image）
建立可追蹤、可回溯、可快速切換的版本管理方式

本分享將以實際 Python 專案與 CI/CD pipeline 為例，展示從 commit 到 release 的完整自動化流程。

本分享強調以 Python 生態為核心，但方法可延伸至其他技術棧。透過這套實戰流程，Release 不再是手動整理的負擔，而是可持續、自動化的工程能力，進一步提升 Developer Experience（DevX）與團隊協作效率。

高精度矩陣乘法 (GEMM) 在科學與 AI 運算中是核心算子。然而，消費級 GPU (如 RTX 40 系列) 的 FP64 雙精度算力受硬體限制，成為許多開發者與量化交易的效能瓶頸。

本議程將分享開源專案 AdaptiveGEMM：探討如何利用實作 Ozaki Scheme 將高精度運算降維拆解。我們將深入底層，利用 CUDA PTX 與 mma.sync 指令極限壓榨 INT8 Tensor Core，解決 Shared Memory Bank Conflict，成功在 RTX 4060 上大幅提升效能，達到逼近 A100 等級的 FLOPS 表現。

【難易度：進階】適合尋求突破硬體極限的 HPC 與 AI 底層架構工程師。
【先備知識】建議具備基礎 C++ 能力，了解 GEMM 運作原理，並對 GPU 記憶體架構與 Tensor Core 有初步認識。
Breaking the FP64 Bottleneck: AdaptiveGEMM with INT8 Tensor Cores on Consumer GPUs

FP64 performance on consumer GPUs is... not exactly great.

In this talk, I’ll share AdaptiveGEMM, a small experimental project inspired by prior work on the Ozaki Scheme. The idea is to break high-precision matrix multiplication into lower-precision operations and make use of the much faster INT8 Tensor Cores available on consumer GPUs.

Rather than focusing on the algorithm itself, this talk is mostly about the engineering journey: turning ideas from papers into CUDA code, working with PTX and mma.sync, dealing with shared-memory bank conflicts, and figuring out why something that looks fast on paper is not always fast on the GPU.

Most of the experiments were done on an RTX 4060.

If you enjoy CUDA, GPU optimization, HPC, or simply making hardware do things it was not particularly designed to do, this talk might be fun for you.

epoll has been the foundation of modern high-performance Linux servers for years, powering event-driven systems such as Nginx, Redis, and many async runtimes. However, as workloads continue scaling, the readiness-based model of epoll introduces increasing complexity around event loops, syscall overhead, and asynchronous file I/O.

This talk introduces why Linux developed io_uring, how it differs from epoll, and what architectural changes it brings to modern async runtimes. We will briefly compare epoll and io_uring, explore how Rust async runtimes can integrate with io_uring through the Minato WebSocket server project, and discuss why io_uring matters not only for networking but also for file I/O and database systems such as PostgreSQL.

The session focuses on practical system software design, runtime architecture, and the future direction of Linux asynchronous I/O.

OCI 機制的信任度： OCI 新推出的「兩階段控制升級」與「近乎零停機維護」，在營運環境（Production）實際開刀時，大家敢不敢完全信任它的自動化？

OpenEverest is an open-source, cloud-native platform designed to simplify running, managing, and scaling diverse data workloads on Kubernetes. The project achieved CNCF Sandbox status in March 2026, marking a major milestone in its evolution from a single-vendor initiative. While initially limited to PostgreSQL, MySQL, and MongoDB, OpenEverest is currently undergoing an architectural refactoring toward a modular, provider-based design to support broader technology integration.

This transition to an extensible plugin architecture serves as the primary enabler for the community to expand OpenEverest's capabilities independently of the founding vendor's roadmap. This session examines the ongoing technical refactoring alongside the key milestones that established vendor neutrality and secured CNCF Sandbox status. Participants will gain a practical blueprint for transforming single-vendor projects into inclusive, community-driven cloud-native platforms.

At Remember (a career networking platform in Korea), our notification service had been running on a legacy Ruby-based architecture for years.

As the number of users and notification channels grew, we started facing challenges in scalability, maintainability, and operational complexity. The system had accumulated technical debt, making it increasingly difficult to introduce new features and ensure reliable delivery.

Instead of performing a risky big-bang migration, we gradually rebuilt the notification platform as Java-based microservices while continuing to serve production traffic.

In this talk, I will share:
- Why we decided to migrate from Ruby to Java
- How we decomposed the existing architecture
- Strategies for running old and new systems in parallel
- Challenges around message delivery, consistency, and monitoring
- Lessons learned from operating the migration in production

This session focuses on practical engineering decisions rather than theory, providing insights that teams can apply when modernizing long-running systems.

LLM 與相關技術為科技與人類帶來了巨大的轉變。但我們依然不知道 LLM 內部的原理與如何確保 LLM 不會有惡意行為。可解釋性技術提供了少數的切入點。與其存外部在訓練過程中控制語言模型的行為，不如直接打開模型，去直接探索甚至控制LLM的行為。

但這麼重要的技術卻鮮少被討論跟應用。這裡我們打開他的面紗，為未來控制更強大的 AI 爭取希望

Code: https://github.com/marty1885/llama.cpp/tree/rwkv-edit

台語正在經歷振興以利台語文化不至於失傳。如同其他閩南語系語言，台語大部分話者皆未以文字書寫台文，以至於書寫台文以其母語者的規模而言極為罕有。要改善這個情況的其中一部是讓軟體的使用者介面提供台文版本。作為達成使用者介面台文化的一步，我開始進行了將 KDE 軟體譯為台語的作業，並希望與自由軟體和台語振興社群分享目前為止的歷程。

What is a Factory? Can a Bridge do something else than connect 2 points? What's the difference between Command and Event? What other patterns are out there?
Design patterns are the building blocks of elegant software architecture. But when and how to apply them effectively?
Let's discover together the most essential patterns through real-world examples and practical demonstrations that will transform how you approach code design.

Drawing a spinning cube on a physical machine sounds ordinary: an application calls a graphics API, the GPU renders the scene, and the result appears on the screen. But when the same program runs inside a virtual machine, the question becomes more interesting. The guest behaves as if it owns a GPU, while the real rendering resources usually live on the host. So where is the cube actually drawn?

This talk follows one 3D rendering path inside a Linux guest, starting from Mesa. Mesa receives rendering requests from userspace applications, organizes graphics state and resources through Gallium, and passes the work into VirGL, a driver path designed for virtual GPUs. From there, the work crosses the boundary between Linux DRM and virtio-gpu 3D, becoming contexts, resources, command streams, and synchronization events that a virtual GPU can understand. Finally, the host renderer receives those commands and turns them into pixels.

Using a small but complete rendering demo as the thread, we will connect the journey from guest userspace, through the guest kernel and virtual GPU device, to the host renderer. The audience will see that 3D graphics in a VM is not just framebuffer copying. It is a collaboration across Mesa, DRM, virtio-gpu 3D, and the host GPU. Once these boundaries are opened up, “drawing pixels” inside a virtual machine becomes much more interesting than the image that finally appears on screen.

• AI Agent 相關的一些名詞
• 為什麼會想自己做一個 Agent Harness
• 我是如何開始這個專案
• 一個 Agent 有哪些 building block
• 我對外串接了什麼系統
• Demo

Yagent 是一個從實驗性質，後來自己在小量使用的 Multi-Role Agent．一開始這個專案是為了研究 AI Agent，試圖了解工作原理，然後隨著 code agent 越來越好用，我就邊把自己的這套 Agent 搭建出來，發現自己有時候也用得上．目前還不能算是真正意義上的夠好用，但是自己正在持續迭代他，將自己的工作流慢慢搬移到這個 Agent 上，目前看起來目標是可以慢慢達成．

I run “Engineer Anime,” a community where engineers share lessons they have learned from anime. In this community, we organize events where engineers give presentations about insights they gained from anime and connect them to their own experiences in software development and engineering work.

At these events, speakers present ideas inspired by anime stories, characters, or production processes, and relate them to topics such as software development, organizational design, and career growth. For example, some speakers discuss teamwork and organizational structure by examining how teams collaborate in anime. Others reflect on engineering careers and learning through the personal growth and struggles of characters. There are also talks that use the anime production process as a starting point to discuss project management and team structures.

Using anime as a shared cultural reference helps lower the barrier to discussion. Participants with different backgrounds and experience levels—from students and early-career engineers to experienced professionals—can easily join the conversation. Because many people are already familiar with anime stories, discussions often start from something relatable and naturally expand into deeper reflections about engineering practices, teamwork, and personal growth.

This approach also encourages cross-disciplinary dialogue. In addition to technical topics, discussions often explore broader themes such as craftsmanship, collaboration, leadership, and how people grow through challenges—topics that are not always emphasized in traditional technical events.

In this session, I will introduce how a community built around lessons from anime can create meaningful conversations among engineers. Through concrete examples from our events, I will share how story-driven discussions can make technical and professional topics more approachable, and how communities can create inclusive spaces where people from different backgrounds and experience levels can learn from each other.

Demoing my first coreboot port and describing the experience. How to start, how to debug, common issues and how to contribute to upstream.

How can open source strengthening democracy in practice?
This talk shares insights from CONSUL - a FOSS platform for citizen participation - in how instance implementations can make impact in supporting institutions and citizens worldwide, as well as the challenges of resource constraints, strategic prioritization and sustaining FOSS communities. We’ll also touch on how AI can enhance civic processes while remaining transparent and accountable.

Oracle is known for Oracle Database, one of the most widely used proprietary database. So why is Oracle offering a managed PostgreSQL service?

This session starts with that unexpected question and uses it as a lens to explore a broader shift in modern application architecture: enterprises increasingly want the openness, ecosystem, and developer familiarity of PostgreSQL, while also needing cloud-native operations, high availability, scalable infrastructure, and integration with AI services.

OCI Database with PostgreSQL is Oracle Cloud Infrastructure’s fully managed PostgreSQL service. Rather than positioning it as a replacement for self-managed PostgreSQL or as a proprietary database story, this talk examines the technical design choices behind running PostgreSQL as a managed service: separation of compute and storage, database-optimized shared storage, automated backup and restore, read scaling through replicas, high availability with fast failover, and operational integration with cloud monitoring and security services.

A key focus will be PostgreSQL’s extension ecosystem and why it matters for AI-era applications. We will look at extensions such as pgvector for vector search, PostGIS for geospatial workloads, pglogical for replication scenarios, and other operational extensions that make PostgreSQL more than a traditional relational database. In particular, the session will explain how PostgreSQL can act as a vector store for retrieval-augmented generation (RAG), hybrid search, and semantic search use cases, while remaining part of a familiar SQL-based application architecture.

The talk will also cover practical architecture patterns: using PostgreSQL with object storage, streaming, AI services, application containers, and search/cache services to build modern applications on open source components. The goal is not to present a product pitch, but to discuss what it means to operate an open source database as an enterprise-grade managed service, and where the trade-offs appear between openness, operational control, performance, resilience, and cloud integration.

Attendees will leave with a clearer understanding of how managed PostgreSQL services are evolving, how PostgreSQL fits into AI application architectures, and why even a company strongly associated with Oracle Database sees PostgreSQL as an important part of the modern open source data platform.

Intro: Are you a creative coder looking for others? Join us to make art out of a randomized theme chosen on the day, using p5js, Strudel, Godot, maybe C output in the terminal or whatever other tool you like. And make a few friends on the way. Hosted by CIOSAI.

跨社群合作：匿名網路社群 × ETHTaipei

今年我們與 ETHTaipei（台北以太坊社群）展開議程合作。兩個社群在匿名支付主題上各有不同切入角度，為讓投稿者的稿件能到最合適的聽眾面前。

這個時段請前往 TR-511 教室參與議程！

在生成式人工智慧時代，即使是新手用戶也能透過精心設計的提示創建簡單的應用程式。然而，儘管人工智慧工具可以產生可運行的程式碼，但它們並不會自動教導新手開發者或學生如何閱讀、審查、測試、授權、維護或圍繞這些程式碼進行協作。在這種情況下，隨著軟體開發日益自動化，一個重要的問題擺在了教育者和開源社群面前：為什麼教授軟體開發的基礎知識仍然很重要？自由開源軟體（FOSS）在塑造下一代開發者方面又能發揮怎樣的作用？

本次演講將透過中央大學國際資訊學部Iio Lab所進行的應用程式開發專案實例來探討這些問題。 Iio Lab為學生提供參與基於FOSS的開發專案的機會，讓他們不僅學習程式設計和軟體工程的基礎知識，還能體驗在人工智慧輔助編碼時代仍然至關重要的價值觀，例如開放協作、社群驅動開發、透明度和共享所有權。

本次演講將對教育工作者、FOSS社群領導者、導師以及參與開發者培訓的專業人士有所裨益。參與者將獲得關於 FOSS 如何不僅作為一種開發模式，而且作為一個強大的教育環境來培養未來能夠為開放社區做出有意義貢獻的開發者的實際見解。

生成型AIの時代において、初心者ユーザーでさえ、よくできたプロンプト入力すればシンプルなアプリケーションを作成できるようになりました。しかしながら、AIツールは動作するコードを生成できますが、初心者開発者や学生に、そのコードの読み方、レビュー方法、テスト方法、ライセンス方法、保守方法、あるいは共同作業の方法を自動的に教えるわけではありません。このような状況下で、ソフトウェア開発がますます自動化されるにつれ、教育者とオープンソースコミュニティの両方にとって重要な疑問が生じます。ソフトウェア開発の基礎を教えることがなぜ依然として重要なのか、そしてFOSS（フリー・オープンソースソフトウェア）は次世代の開発者の育成においてどのような役割を果たすことができるのか、ということです。

本発表では、中央大学国際情報学部の飯尾研で実施されたアプリケーション開発プロジェクトの実践例を通して、これらの問いを探ります。飯尾研は、学生をFOSSベースの開発プロジェクトに参加させることで、プログラミングとソフトウェアエンジニアリングの基礎を学ぶだけでなく、オープンなコラボレーション、コミュニティ主導の開発、透明性、そして共有所有権といった、AI支援コーディングの時代においてもなお不可欠な価値観を体験する機会を提供しています。

本発表は、教育者、FOSSコミュニティリーダー、メンター、そして開発者育成に携わる専門家にとって有益なものとなるでしょう。参加者は、FOSSが開発モデルとしてだけでなく、将来的にオープンコミュニティに有意義な貢献ができる開発者を育成するための強力な教育環境としても機能する方法について、実践的な視点を得ることができます。

Open source has never had more contributors, and yet, more and more projects struggle with adoption, onboarding, and retention. Ever wondered why?

The bottleneck isn't code quality. It's the experience. More specifically the Contributor experience. Bad READMEs, undocumented APIs, broken setup scripts, and hostile first-timer experiences kill more projects every year than any technical limitation ever will.

Developer experience is now the highest-leverage contribution you can make to open source. Yet it remains the most overlooked.

In this talk, we will prove it with evidence. We'll share concrete examples of what broke and what we fixed across API ecosystems and cloud-native infrastructure: onboarding flows that cut time-to-first-PR, documentation architectures that actually scaled, API design decisions that reduced support burden, and contributor ladder structures that turned drive-by visitors into long-term contributors and maintainers. If you care about scaling your open source project, this talk is for you.

Nitra 是一間專注於美國醫療產業的 Fintech 新創。我們的使命是透過金融科技與 AI，減少醫療營運成本、留住獲利，將醫生的心力與時間還給病人。
在本次的演講中，我們將分享如何在美國醫療產業環境中鬥智鬥勇，打造解決診所金流周轉巨大痛點的金融產品。從專案初期的合規踩線、被客戶詐騙，到多次砍掉重練、透過完整的 JavaScript 生態系 (Vue.js, Quasar, Node.js, and Express) 快速決策迭代，最後在兩個月內從無到有把功能推上線。我們秉持開源精神，將 Nitra 的實際經驗與金融技術分享出來，內容包含 ACH (Automated Clearing House) 的簡介、 使用 ACH 打造金融產品有哪些風險、Stripe 作為世界最大的 Card Issuing Program Manager，合作上有什麼雷點，又該如何規避。希望透過實務分享幫助大家少走冤枉路，也讓更多人認識 Nitra，認識我們的文化與團隊。

「開源」常被當成「免費」的同義詞 —— 公司想省授權費、政府想省採購成本、工程師想省學習門檻。但維護一套被全世界依賴的開源專案，從來不是免費的。

本場次以 CNCF 大使與 CNTUG 社群組織者的視角，拆解一個在台灣很少被正面談論的問題：當開源早已是雲端原生時代的產業標準，台灣為什麼始終站在「使用者」而非「主導者」的位置？講者將從人才、企業、政策三個面向切入：
* 人才：刷開源缺乏舞台、薪資沒有溢價，優秀貢獻者最後多半往國外出走；
* 企業：用賣硬體的思維做軟體、靠高度客製化的代工生存，把「開源會被別人學走」當成不開源的理由——卻忘了若 Kubernetes 當年不開源，今天就不會有整個 CNCF 生態讓大家共享；
* 政策：政府傾向「辦活動」而非資助真正在爬坡的貢獻者。對照 Python 基金會為了堅持 DEI 價值、主動撤回美國 NSF 一百五十萬美元補助，缺口最終由企業補上的案例，我們得以重新檢視「政府主導開源」的侷限。

如果台灣能解開這三方的結構性困境，它能釋放的影響力，或許會超越我們對自己的想像。

在數位身份驗證的時代，如何在不洩漏任何個人資訊的前提下，向服務提供者證明「我是台灣公民」？本議程將介紹我們如何運用零知識證明（ZKP）技術，結合自然人憑證，打造一套隱私保護的公民身份驗證系統。

自然人憑證（ROC Citizen Digital Certificate）內建 RSA 非對稱金鑰，可由晶片卡對任意訊息進行數位簽章。我們的系統以此為基礎，透過 OpenAC 電路框架設計了一套 ZKP proving scheme，能夠解析並驗證自然人憑證產生的 RSA 簽章，同時在電路層面隱藏所有可識別個人的欄位。

整套流程完全在使用者裝置上執行：應用程式請求自然人憑證對特定 challenge 進行簽章，隨即於本地端生成零知識證明，最後僅將 ZKP proof 提交至驗證服務。驗證方可確認「此證明由持有合法自然人憑證的台灣公民所產生」，卻無從得知持有人的姓名、身份證字號或任何其他個人資訊。

為降低開發門檻，我們已釋出完整的 SDK 與範例應用程式，涵蓋從憑證請求、簽章取得、本地 proof 生成到後端驗證的完整流程，讓開發者得以快速整合隱私保護的公民身份驗證功能。

本議程將涵蓋以下主題：

• ZKP 與自然人憑證的技術結合原理
• RSA 簽章電路設計與 OpenAC 框架介紹
• On-device proof 生成的效能挑戰與優化策略
• SDK 架構設計與實際整合 Demo 展示

若你對隱私強化技術（PET）、去中心化身份（DID）、或密碼學應用於公民科技感興趣，這場議程將帶給你從理論到實作的完整視角。

• Monolith 架構的問題：難以測試局部變更。
• Microservices 架構的痛點：當兩個服務需要同一段業務邏輯時，只能選：(1) 複製貼上、(2) 抽出共用 library (3) 抽出作為 service。
• 那如果有一種軟體架構，它不將「程式碼邊界」和「部署邊界」綁定呢？
• Polylith 讓你可以用接近於 Monolith 的開發體驗，同時擁有 Microservices 的部署彈性。

本議程解說各項MediaWiki概念，實際操作translatewiki及其他使用MediaWiki翻譯功能並發布譯文，期望引領各位進入各MediaWiki專案/網站的翻譯世界。
本議程涉及實際操作，建議自行攜帶筆記型電腦或平板電腦。

本議程以一條完整的真實攻擊鏈為主軸，從 AI API 的 JWT 漏洞一路打進企業內網、接管 CI/CD Pipeline，最終透過 AI Agent 供應鏈投毒完成本地提權，取得 root。

80 分鐘內涵蓋三個環環相扣的實作關卡：Lab 0 利用 JWT Kid Injection降級漏洞取得管理員權限，再透過 Prompt Injection 竊取內網 Gitea 帳密；Lab 1 以 Pwn Request 手法竄改 CI Pipeline 設定檔，從 Woodpecker Agent 偷出 SFTP 私鑰；Lab 2 用私鑰登入部署了 OpenClaw（真實 npm AI Agent 框架）的靶機，在無 shell 的 SFTP chroot 環境下替換 LLM 的 skill 指令書，讓 AI Agent 自動執行惡意程式碼，利用 CVE-2021-4034（PwnKit） 本地提權讀取 Flag。

攻擊鏈中所有漏洞均有真實世界對應案例，適合具備基本 Web / Linux 概念的資安入門到初階者參加。

We all know Rails is a very mature framework for building web applications. But can it be used to build native mobile apps as well? Remember what react native/flutter did to building mobile apps. You write your app once in those frameworks and magically your app works both in the App Store and Play Store. This significantly reduces the development effort and allow you to have a smaller team size. But what if I tell you can pretty much do the same thing using Rails. With this approach you don't maintain separate apps for your mobile and backend. You also take advantages of the power of Rails from the start. We will explore hotwire native and how it can be used to build mobile apps that are native. This way you can accelerate your mobile app development and cut down your development effort significantly. We will also explore how to use strada to build native components using web technologies. I will also share my starter template for creating a mobile app project using Rails.

作為源自在地社群、以 Engineer Cafe 為基地的 OSS 開發具體實例,我們將介紹接待系統開源專案的案例。
此專案包含用於接待導覽的「AI 虛擬人偶」,採用 TypeScript 與 LangGraph 等現代技術,並具備長期與短期記憶功能。我們將分享在地社群特有的開發過程與問題解決經驗。
本場演講將是一個了解典範案例的機會:紮根在地的 OSS 活動,如何連結並貢獻於全球生態系。
對於 COSCUP 的多元參與者而言,這不僅能為各自的在地社群活動與 OSS 開發帶來啟發,也是與福岡 OSS 社群具體交流的平台。

This talk provides an overall introduction to virtualization technology. The speaker begins with the basic concepts and a brief history of virtualization, introducing virtual machines and hypervisors. We then introduce memory virtualization and address translation, including virtual memory, paging, and the roles of the MMU and TLB.

Next, we show how virtual machine executes guest system's instructions through direct execution, enabled by hardware-assisted virtualization such as KVM and Virtualization.framework. We contrast this with emulation approaches, including interpretation and dynamic binary translation.

Finally, we discuss I/O virtualization, focusing on VirtIO. We show how emulators and hypervisors such as QEMU and ACRN efficiently virtualize devices through VirtIO.

By the end of this session, the audience will have a clear mental model of how modern VMs and hypervisors work under the hood.

Slides: https://drive.google.com/file/d/1OwC0eo8sWeRmDrPONtk9EZb1jCm9hCAa/view?usp=sharing

This presentation explains how open source software can live for a very long time, and covers the differences between proprietary and open source software life cycles. It also covers the increased adoption of open source, and many of the ways that Postgres is innovating to continue to be relevant.

市面上的 e-paper 模組大多依賴廠商提供的 SPI userspace 函式庫，且大多都是MCU的應用，無法與 Linux 標準顯示堆疊整合。更關鍵的是，這些模組的硬體設計和機構細節往往不透明，開發者只能被動接受。
open-ep 是一個「從硬體到內核全面開源」的社群。我們的 PixPaper 系列產品：

1. 硬體與機構自主設計
   - PCB layout、connector 選型、機構設計全部由社群完成，不依賴 ODM
2. DRM driver upstream
   - 已進入 mainline Linux kernel，並獲得 LWN.net 報導
   - 因為upstream審核很耗時, 我們也有在vendor kernel實做DRM driver
3. 多 OS 生態支援
   - 針對ARM Yocto BSP、Android AOSP、Ubuntu OS, freeRTOS 等不同系統特性擴充應用場景
4. 資安問題納入考慮
   - 加入BSP的應用，我們還是會考慮到SBOM的建置與CVE漏洞修補，以符合不同國家(如歐盟CRA)的軟體資安標準

軟體這不只是「把 driver 推進 kernel」，而是完整展示一個小規模社群如何：

從電路設計開始就考慮 mainline 相容性
與 kernel maintainer 溝通，讓 patch 順利進入 upstream
平衡「賣產品維持營運」與「推動開源標準化」的雙重目標
透過 COSCUP、UBUCON ASIA, OSPN Japan等技術社群建立信任

我們相信，硬體開源不只是「公開 schematic」，而是從設計階段就融入開源生態的思維。open-ep 想證明，即使是資源有限、需要自願貢獻者幫忙的社群，也能對 mainline Linux 和產業標準做出實質貢獻。

模型量化 (Model Quantization) 能在推論階段中有效降低計算量與記憶體使用量。 透過將模型權重與輸入資料轉換為低精度資料型態，不僅能加快運算速度，還能讓模型部署在嵌入式裝置。 本次演講將示範如何以 Python 實作模型量化。我們將從零開始，使用 PyTorch 對 YOLOX 物件偵測模型進行量化，帶領大家從原理到實作，將量化技術應用於開源模型，並轉化為可落地的解決方案。

身分是行使權利的基礎，而在數位系統中，程式碼的能力定義了權利與權力的邊界。當底層架構讓個人資料的跨脈絡串接唾手可得，隱私與秘密就不再受到民主法治的保護。為了保障相應權利、守護數位主權，必須從法定規格 (Statutory Spec) 出發，將民主價值轉化為系統強制力：

1. 身分驗證不是數位監控：以「控制權驗證」取代傳統的「屬性覆核」，確保使用者負責，同時保留公民「拒絕被連結」的權利。
2. 技術可行即規範義務：在身分驗證中，若技術上能做到不蒐集資料，法律上就「應該」禁止蒐集。隱私強化技術 (PETs) 必須從「最佳實踐」提升為「法定義務」。
3. 數位主權的終極防線： 「可分叉性 (Forkability)」 與 「可重建性 (Rebuildability)」 必須成為抵抗技術鎖定的核心。建立對生產環境的實質審查機制，確保國家與社群擁有獨立運作系統的能力。

This talk, targeted at beginners, explores the architecture of an open-source toolstack for the making of robotics projects. From the software building tool, to the simulation software to test your robot, we will help you discover Nix, Rust, Embassy, Gitea and its CI, KiCad, FreeCad and Webots and how to use/connect them to start working on your next side project!

AI 寫 code 很快，但每開一個新對話，它又忘了你的專案長怎樣、用什麼 pattern，於是你又重講一次。工具越來越多，反而越用越累。

我把這個痛點做成開源工具 Prospec（MIT、TypeScript CLI）：漸進式揭露讓 context 按需載入、Delta Specs 只追蹤變更、AI Knowledge 把專案知識結構化版控，不隨對話視窗消失。

但這場我不只 demo 工具。過去半年我把它真的用在 15 個專案上，從個人 side project 到公司專案。哪些設計真的省時間、哪些是我過度設計到沒人用；SDD 在既有專案和全新專案完全是兩種體感；我從 Spec-Kit、OpenSpec 抄了什麼、又刻意不抄什麼。

適合每天跟 AI 寫 code、但受夠重複解釋專案的開發者。你會帶走一套能馬上試的 SDD 流程，和一份「哪些 SDD 招式是噱頭」的誠實清單。

This session will shows how to build interactive 2D and 3D maps using open datasets and open geospatial formats. Through real-world website examples, I’ll demonstrate how users can explore weather, location, and environmental data in an interactive and intuitive way.

Also covers practical approaches to improve scalability, such as better data organization and map layer handling. While Mapbox and Google Maps Platform are used as examples, including customizing map styles with google cloud based tools the focus is on reusable ideas and patterns that work across different mapping libraries and technology stacks.

Firmware today is not just about “it boots.” We also care about whether it’s correct, testable, and even observable at runtime.
In this talk, I’ll share some of Arm’s recent work in opensource, focusing on two areas: testing and telemetry.

1. Firmware testing
   1.1 edk2-test (UEFI-SCT) and FWTS

2. Firmware telemetry
   2.1 OpenBMC bulk telemetry

Juju is operator knowledge in code. It handles provisioning, K8s deployment, and automatic service wiring in one tool. This talk is about what that looks like in production at Canonical.

More info: https://events.canonical.com/event/146/contributions/940/

• Snap 軟體包簡介
• 適合被打包為 Snap 的軟體
• 不適合被打包為 Snap 的軟體
• Snap 權限限縮模式簡介與它們各自的眉角
• Snap 打包工具簡介
• Snapcraft 專案檔簡介
• Snapcraft 打包生命週期
• Snap 軟體包名稱註冊流程
• Snap 軟體包別名申請流程
• Snap 軟體包維護

More info: https://events.canonical.com/event/146/contributions/932/

KYC sits on a paradox: regulators demand strong identity proofs, but every byte of identity data a service stores becomes a permanent breach surface. The traditional answer: collect documents, run checks, file them away, turns every KYC provider into a high-value target and every user into a permanent disclosure.

This talk walks through an alternative pipeline now running in zkKYC field, where a stack of well-chosen cryptographic primitives composes into a system that proves claims about a user: their passport is valid, they are over 18, they are the same person who registered last month, without the server ever seeing their identity data. The journey spans device-bound keys, encrypted identity storage, government-signed document chains, biometric commitments, zero-knowledge proofs, and authenticated claim delivery but the goal throughout is to show how these pieces fit together, not to dwell on any single one.

Designed for engineers and product folks alike, the talk explains each primitive at a high level (no math), focuses on system design and uses architecture diagrams throughout. By the end, you will follow how the same passport scan that validates a user's age also produces a server-blind, unlinkable proof — and why this is starting to look like the only sustainable way to do identity at scale.

Takeaways: a vocabulary for evaluating privacy-preserving identity systems, a concrete reference architecture, and an honest list of open problems (biometric revocation, post-quantum SNARKs, deduplication without linkability) this design has not yet solved.

如今，只要有一個小小的點子，任何人都能開始自己的開源專案。AI 輔助開發的興起與工程師人口的增加，讓這件事比以往任何時候都更容易。然而 GitHub 上如今有著幾乎無窮無盡的儲存庫，真正的挑戰其實是在第一次 commit 之後才開始：
你該如何讓自己的專案不被淹沒、吸引使用者、培養出一群貢獻者，並持續改進？
對年輕工程師而言，這尤其是每天都在煩惱的課題。經營一個專案所需要的，遠遠不只是寫程式——還有能見度、文件、Issue 與 PR 的處理、貢獻者的引導上手，以及維持自己的動力。這些問題很少能單靠技術能力解決，而前人辛苦累積下來的經驗，又往往很少被公開地分享出來。

這場 Birds-of-a-Feather（BoF）聚會，將把已經在維護開源專案的工程師、希望開始一個專案的人，以及想要參與貢獻的人聚在一起。這不是一場單向的演講，而是一個讓大家把各自的難題與心得帶來、一起討論的場合。作為起點，主持人會分享自己在 OpenSolaris 底下帶領一個專案、以及協助其他多個開源社群的親身經驗，這些問題很多都是當時第一線親自面對過的。接著，我們會深入探討維持、擴展與改進一個專案的困難，以及跨越國界吸引貢獻者這個特別的挑戰。為了引導討論，我們會一起探討幾個問題，例如：在數不清的專案之中，你是如何贏得最初的使用者與關注？哪些做法有助於增加貢獻者、並讓新人順利上手？面對提出批評或要求很多的參與者時，你如何應對，又如何把他們轉化為貢獻者？在語言、時區與文化的隔閡之下，你如何在全球尋找協作者？以及，你如何避免倦怠、讓專案能夠長久維持下去？本場次以年輕工程師為主要對象，但也非常歡迎經驗豐富的維護者參加——正是他們的故事，讓這場討論格外有價值。不需要任何先備知識。

參加者將能聽到專案擁有者如何撞牆、又如何走過難關的真實故事。你會發現自己的掙扎並非獨一無二，帶走一些明天就能嘗試的具體做法，也結識一群同樣懂得經營專案甘苦的夥伴。主持人同樣是以一名參與者的身分加入，期待從每個人的經驗中學習。無論你正在維護一個生氣勃勃的專案、一個安安靜靜的專案，或者腦中還只有一個構想，你都會帶著更清楚的方向離開，知道該如何面對開源中「程式碼以外」的那一面——而且不再覺得孤單。

2026/4/2 由數位發展部、勤業眾信聯合會計師事務所、中華民國軟體自由協會和財團法人開放文化基金會共同打造的《公部門開源軟體應用參考手冊》正式在數位發展部官網上線，紙本也分送到全國公立圖書館，標誌了臺灣公部門擁抱開放原始碼的重要里程碑。

這份手冊是怎麼誕生的？
預計達到什麼效益？
社群又如何看待他的出現？

因此我們特別邀請了製作手冊的數位發展部與勤業眾信聯合會計師事務所代表，以及讓手冊在社群廣為人知的夥伴 Denny Huang，一起透過主持人提問、講者交互提問和觀眾提問的方式，談談對於《公部門開源軟體應用參考手冊》的看法與期許。

「數與量」是資訊系統設計中最基礎、卻也最容易被低估的核心議題。本議題將聚焦在如何正確處理「數與量」，並探討其在真實系統中的建模方法與常見陷阱。
「數」是純數學概念，「量」則是帶有業務規則、單位、精度、範圍與文化差異的領域概念。從金融系統的四捨五入與精度累積、製造業的單位轉換與損耗計算、醫療系統的多語言文化處理，到電商訂單的複雜業務狀態，「數與量」的正確建模直接影響系統的穩定性、一致性與可維護性。
議題將深入討論：

「數」與「量」的本質差異，以及它對系統設計的根本影響
在資料庫中正確處理「量」的實務方法（自訂型別、領域事件、物化視圖、觸發器等）
常見的反模式與真實專案教訓（精度遺失、單位混亂、業務規則分散等）
如何將「數與量」的思考融入領域驅動設計（DDD），讓 DDD 不再只是抽象的高階概念，而是能真正落地的系統思維

DDD 在此僅作為輔助工具，用來幫助我們更清晰地定義與封裝「量」的業務規則，而非主導整個討論。真正的挑戰在於：如何在資料庫層與應用層之間取得平衡，讓「數與量」被正確、穩定且可維護地處理。
本演講適合對資料庫設計、系統架構、領域建模有興趣的開發者與架構師。希望透過這個議題，幫助大家在實務中更務實、也更正確地面對資訊系統中最基礎卻關鍵的「數與量」問題。

現在大家使用 Claude Code 或 Codex 等 AI 代理來寫 Code、甚至自動幫忙 Build 和上架 Android App。但你知道嗎？高達 13.4% 的第三方 AI Skill 藏有致命風險！

如果你隨便安裝來路不明的 Skill，惡意程式可能就在背景偷偷把你的 Android 簽名金鑰 (.jks) 打包傳送給駭客。

我們將展示如何防範「AI 內鬼」。你將學會 「防禦三步驟（靜態分析、AI 空跑預測、沙盒誘餌測試）」 來掃描惡意 Skill；同時，我們也會示範如何化被動為主動，利用 IntelliJ 內建的 MCP 伺服器，讓 AI 代理在寫扣時，自動幫你揪出潛在漏洞並安全地重構程式碼，建立真正的零信任開發環境！

如果 AI agent 可以查支付資料、追金流、判讀客服案件，我們要如何知道它沒有帶著不可見的模型過濾、資料權限漏洞或不可稽核 workflow 在做決定？

本講分享 OEN 將 agents 導入 production payment infrastructure 的工程經驗：先用 Taiwan Sovereignty Benchmark 審計中文模型在台灣主權問題上的回答、過濾與 system prompt bypass；再用 payment-mcp + payment-skills 把 payment data access 與 charge lookup、phone trail、Twilio/SMS、payout failure diagnosis 等流程變成 scoped、logged、可 review、可 fork 的 artifacts。最後連回台灣 AI 資料利用法制：支持善意、可稽核、非替代市場的創新，但避免授權制度成為新資料壟斷。

Visdom is an open source tool for live visualizations and lightweight dashboards in Python, PyTorch, NumPy, and AI workflows. In this session, François Cartegnie will facilitate the presentation and conversation with Mario Behling and the Visdom team which will share the story of Visdom’s modernization at FOSSASIA, including the newest release, local deployment, and an emerging online version that lets researchers and developers quickly use Visdom for their projects.

Visdom 是一套開源工具，可用於 Python、PyTorch、NumPy 和 AI 工作流程中的即時視覺化與輕量級儀表板。在本場次中，Visdom 團隊的 Mario Behling 將分享 Visdom 在 FOSSASIA 推動現代化的故事，包括最新版本、本機部署，以及正在發展中的線上版本，讓研究人員和開發者能更快速地將 Visdom 用於自己的專案。

本議程集合各臺灣原住民語言以及各臺灣本土語言，共同討論在MediaWiki及維基媒體專案下如何強化各語言的發展。

The COSCUP BoF coincides with the Taipei Wikipedia Meetup—so we're bringing the meetup to COSCUP! Join us for a one-hour Lightning Edit Hour. No need to write a whole new article: organizing categories, fixing typos, or adding a reliable source are all valuable contributions. Every small contribution makes Wikipedia better!

COSCUP與台北寫作聚撞期，那就把寫作聚搬來COSCUP的Bof吧！一小時快閃，不求寫得多。整理條目分類、改錯字、補個來源……能讓維基百科變好一點點的都是貢獻！

Android 的圖形顯示架構主要是針對 HDMI、eDP、MIPI-DSI 等高效能顯示介面所設計。然而，在許多嵌入式系統中，仍然會使用像 SPI 這類較為特殊的顯示介面，而這些介面通常並不在 Android 標準顯示管線的主要支援範圍內。

本次演講將分享一個實際案例：如何在 ARM64 平台上，將一個基於 SPI 介面的自訂顯示驅動程式整合進 Android 14 的圖形顯示架構。該驅動程式是基於 Linux DRM（Direct Rendering Manager）框架實作，用於驅動一個透過 SPI 連接的小尺寸電子紙顯示器。

演講將以 RK3588 平台為實際案例，說明 Linux DRM 子系統與 Android graphics stack 之間的整合流程。我們會解析 SurfaceFlinger、Hardware Composer（HWC3）與 DRM/KMS 之間的互動關係，以及在 Android 系統中導入非標準顯示裝置時可能遇到的各種挑戰。

This talk begins with a simple question: if students are to truly learn cloud infrastructure, what kind of environment should we give them?

At Aolda, a student cloud infrastructure group at Ajou University in South Korea, we did not want to stop at handing out server accounts. We wanted students to see how a cloud is put together, try things on their own, and learn by touching the systems behind the service. That goal led us to open source. Commercial solutions were expensive and convenient, but they also hid too much of the structure we wanted students to understand. So we built our environment around OpenStack, MicroCeph, Proxmox VE, and observability tools such as Prometheus, Grafana, and Loki.

Open source gave us many of the things we were looking for: flexibility, visibility, and room to learn by doing. At the same time, it exposed us to problems that are discussed less often. Documentation was uneven, learning paths were unclear, and some tools solved one problem while creating another. We learned that open source is not a shortcut around complexity. It changes the kind of work you have to do, and it forces you to think more carefully about what you are really trying to build.

That experience shaped not only our infrastructure, but also our student community itself. We had to decide what was realistic for students to learn, what level of complexity was worth keeping, and how to build a culture around shared study, experimentation, and responsibility.

This talk is not a tutorial or a polished success story. It is a practical account of why we chose open source, what it helped us build, where it fell short, and how those trade-offs shaped the direction of our group. We hope it will give students and small communities a more honest starting point for building with open source.

網絡行動科技服務NPO領域多年，從公司開始至今都是使用開源軟體（授權以AGPL為主）架設網站，提供服務，若客戶擁有技術人員，服務也可供技術人員自行架設應用。

但對我們的客戶來說，這件事重要嗎？本次想聊聊開源文化，如何深深影響我們的商業模式。

在公司內部，無論從軟體開發到工作決策上，有了開源（軟體、文化），會有什麼不一樣。
也想聊聊以我們的屬性來說，開源軟體在 SaaS 商業營運時，客戶在意的內容，跟開源有多大差距。
最後可以講我們近幾年的嘗試，開源對 NPO 領域，我們或有不同的切入點和想法。

In modern data science, the "Data Lakehouse" is a powerful way to manage large-scale data. However, for many teams, the "last mile" of integration—connecting Machine Learning platforms like Kubeflow to big data processing engines like Apache Spark—remains a major technical challenge. In a shared Kubernetes cluster, managing security, user permissions, and connection strings across different user profiles often leads to manual errors and security risks.

In this session, we will explore an open-source solution to this problem using Juju and Charmed Operators. We will walk through a "Multi-Integrator" architecture where each Kubeflow profile receives its own secure connection to the data platform. Instead of manual configuration, we use automated integrators to inject Spark Service Accounts, configurations, and security secrets directly into user namespaces.

By using Charmed Spark and Charmed Kubeflow, we can create a modular system where data scientists can move from a simple notebook to a distributed Spark job without worrying about the underlying YAML files or credentials. We will discuss the logic of this design, how it handles multi-tenancy, and how it simplifies the path to a production-ready data lakehouse on Ubuntu.

More info: https://events.canonical.com/event/146/contributions/951/

You probably heard that SBOMs are helpful, but did you know that an SBOM only addresses a fraction of what can go wrong in your software supply chain? The SLSA (Supply Chain Levels for Software Artifacts) specification identifies 9 distinct threat areas, spanning from source code, all the way to package distribution. Most development teams address one or two of these and call it a day, leaving gaps that real-world attacks like SolarWinds and Log4J have already exploited. We understand that it is difficult to cover all aspects when it comes to the software supply chain.

How about we make this much easier? In this talk, we will present an overview of the modern software supply chain threat model, and show how you can provide integrity throughout the whole process of your software development life cycle. We will introduce an easy-to-setup, end-to-end open source stack, built from frameworks and tools within the CNCF/OpenSSF ecosystem.

We will cover:
- gittuf - A security layer for Git repositories
- in-toto - Cryptographically verifiable attestations that capture what actually happens during your build process
- SBOMit - Generate verifiable and accurate SBOMs that embed in-toto attestations
- TUF - A framework for securing package updates

This talk aims to demystify software supply chain security beyond SBOMs, and provide a more holistic view. Our live demo will show a pragmatic way to get started, aiming to lower the entry barrier for open source maintainers and adopters alike.

A slow third-party API can take down your entire Rails app. One service starts timing out, requests pile up waiting for it, threads block, memory fills, and suddenly nothing responds - not even the parts of your app that have nothing to do with the failing service. This is a cascading failure.

Until recently, this was a problem for large engineering teams running dozens of services. But in 2026, even a small startup is calling out to LLMs, OCR engines, and other third-party APIs. Every one of those calls is a potential domino. Circuit breakers belong in any Ruby app shipping AI features.

This talk introduces the circuit breaker pattern through Stoplight, an MIT-licensed Ruby gem, I co-maintain with Tema Bolshakov. I'll start by unpacking how a single slow dependency cascades into a full outage, then walk through how Stoplight prevents it - and why its traffic-light metaphor (green/yellow/red) is more intuitive than the classical open/closed/half-open vocabulary.

The second half peels back the curtain on how we made Stoplight fast. Coordinating circuit breaker state across multiple Ruby processes means hitting Redis on every call, and a naive implementation incurs several round-trips per check. We'll look at how we collapsed those into single atomic Lua scripts - a technique that improved Stoplight's performance substantially and applies to anyone building Ruby tooling on top of Redis.

Outline (30 min):
- (5 min) Cascading failures in the AI era
- (6 min) The circuit breaker pattern and the traffic-light reframe
- (6 min) Stoplight in practice: defaults, fallbacks, Rails integration
- (8 min) Gem internals: improving performance with Lua scripts
- (5 min) Stoplight admin panel, takeaways, Q&A

Target audience: Ruby and Rails developers building apps with external or AI service dependencies. However, the concepts from this talk translate to any language.

Background: Basic Ruby and a rough idea of what Redis is. No prior exposure to the circuit breaker pattern or the concept of cascading failure is needed.

Links:
- Stoplight gem: https://github.com/bolshakov/stoplight
- Companion article: https://evilmartians.com/chronicles/circuit-breakers-and-ruby-in-2025-dont-break-your-launch

The USB protocol is everywhere: keyboards, webcams, storage devices, embedded hardware
test fixtures. Yet most developers treat it as a black box. What if you could sit
transparently between a USB host and device, observe every packet, and selectively
modify, drop, or inject traffic using nothing but open-source software running on a
Raspberry Pi?

This talk walks through the design and implementation of
usb-proxy, an open-source USB
man-in-the-middle proxy built on the Linux kernel's raw-gadget driver and libusb.

What is usb-proxy?

usb-proxy positions a Linux machine with a USB OTG port between a real USB device and
its host. The host sees a synthetic device reconstructed in real time via raw-gadget,
while the real device is accessed through libusb on the other side. All traffic flows
through the proxy, where it can be logged, modified, or dropped using JSON-based rules.

The Injection Rule Engine

injection.json defines per-endpoint rules for control, interrupt, and bulk transfers.
Each rule can modify, ignore, or stall a matched packet. Three levels of transform are
supported and can be combined within a single rule, in order of increasing flexibility:

• Pattern replacement: matches fixed hex byte sequences and substitutes them.
  Ideal for simple, fixed substitutions such as swapping mouse button bytes.
• Declarative operations: applies arithmetic transforms in order on byte offsets,
  such as negating a movement axis or scaling cursor speed, without any scripting.
• Lua scripting: for logic that cannot be expressed declaratively, a rule can point
  to a Lua script. Each script maintains its own state across packets, enabling
  conditionals, loops, and stateful transforms like dead zones or speed caps.

What Will Be Coverd

• How the Linux USB stack is layered: UDC driver, gadget framework, and userspace
• How raw-gadget and libusb work together to build a transparent C++ proxy
• The injection rule engine in action with a live demo

Talk Outline

Source: https://github.com/AristoChen/usb-proxy (Apache-2.0 license)

Eclipse Zenoh 以單一協定統一動態資料、靜態資料與運算——從微控制器到雲端基礎設施皆適用。這套開源 Rust 技術棧提供發布／訂閱、地理分散式查詢與儲存，並具備低延遲效能。

Hiroz 是一套以 Zenoh 為基礎、純 Rust 實作的 ROS 2 中介軟體——無需 C 語言相依套件，只需 cargo build。透過 rmw_zenoh 與標準 ROS 2 節點保持線路相容性，並提供 Rust／Go／Python 語言綁定、零複製支援與 Protobuf 序列化。完全開源，採用 Apache-2.0 授權：github.com/ZettaScaleLabs/hiroz。

本演講將介紹現有兩種 Rust in ROS 2 方案各自的取捨——ros2_rust 封裝 C RCL 層以保持線路相容性，但需要完整的 ROS 2 安裝且 unsafe FFI 遍佈各處；dora-rs 走純 Rust 路線，卻放棄了與現有 ROS 2 節點的線路相容性——並說明 hiroz 如何走出第三條路：純 Rust、無 C 相依套件，且與標準 ROS 2 節點開箱即用地保持線路相容。最後深入探討 hiroz 的非同步執行時設計、訊息生成流水線，以及多語言綁定策略的實作細節。

政府開放資料雖然公開，但往往分散在不同縣市、欄位格式不一致、資料完整度也不同，距離「一般使用者真的能用」還有一段距離。

本場分享將以一個實際開源專案為例，說明如何使用 Nuxt 3、Vue 3、TypeScript 將臺北市、新北市、桃園市、臺中市的公園 Open Data 整合成統一資料模型，並實作搜尋、篩選、排序、地圖標示與防災資訊查詢等功能。

分享中也會介紹如何透過 Codex 作為 pair programmer，協助理解資料欄位、建立正規化流程、拆分前端元件與加速開發迭代；以及如何使用 GitHub Actions 自動更新部分資料來源並部署到 GitHub Pages。

Open Data 的價值不只在於公開，更在於如何透過 JavaScript 生態系與開源工具，將資料轉化成可探索、可維護、可延伸的實用產品。

Embedded 與 Firmware 工程師的日常，充滿 fetch code、repo sync、build、驗證、燒錄與收集 log 等重複流程。每個 project 都要重新執行一次，等待時間很長，真正需要工程判斷的節點卻零散地分布其中。

本議程將分享如何把這些可重複、可驗證的流程封裝成 AI Agent Skills，讓 Agent 自動推進 build pipeline；遇到不可逆操作、無法客觀驗證的結果，或需要硬體背景知識的異常時，則停止執行並交還給工程師。透過明確的 verifier、stop condition 與執行紀錄，一位工程師可以同時監督多個 project，把注意力留給真正需要判斷的部分。

議程將以 AOSP 與 Pixel 開發流程為例，展示 Build ID 與 source tag 對齊、repo sync、vendor binary SHA-256 驗證、遠端編譯、燒錄前檢查、逐 partition 燒錄及開機驗證，並說明如何以 reversibility、verifiability 與 context judgment 設計人與 Agent 之間的介入邊界：哪些工作可以放心自動化，哪些步驟必須停下來問人。

South Asia's digital payment ecosystem is growing fast but the fraud infrastructure protecting it hasn't kept up. Platforms serving millions of users often lack real-time device intelligence, have no way to detect SIM swap attacks without KYC dependency, and can't share signals across providers without exposing customer data. The threat model is also genuinely different here: attackers exploit device cycling, identity reuse across platforms, and the absence of cross-institution coordination in ways that Western fraud tooling simply isn't designed for.

This talk explores how you can address these gaps using open-source infrastructure: Go, NATS, PostgreSQL, Python and why releasing client SDKs openly matters as much as the system design itself. We'll cover phone-hash-based SIM swap detection, weighted real-time fraud scoring with cold-start constraints, device fingerprinting without invasive data collection, and the architecture of a scoring pipeline designed to run at payment speed.

These are lessons learned firsthand while building a fraud detection platform targeting Nepal's payment ecosystem the technical decisions, the dead ends, and what a working open-source approach actually looks like in practice.

區塊鏈的透明性是雙面刃：任何人都能查詢一個地址的完整交易歷史與餘額。對於日常支付、薪資發放或商業往來，這種「永久公開的財務紀錄」並不符合現實世界對隱私的基本需求。

隱匿地址（Stealth Address） 是一種密碼學方案。收款方公開一組由 spending public key 與 viewing public key 組成的 stealth meta-address。每次需要新的收款地址時，會先產生一個 ephemeral key，再透過 ECDH 與收款方的 viewing public key 算出 shared secret，最後結合 spending public key 推導出一個全新的一次性 stealth EOA 作為實際收款地址。其結果是：
- 即使同一個收款人收到一百筆款項，這些款項會分別落在 一百個彼此無關的鏈上地址 中，外部觀察者無法將它們連結到同一個身份
- 只有持有對應 viewing key 的收款人，能掃描鏈上交易並識別出「哪些地址屬於我」，再用 spending key 動用資金

這段分享中，我會從 ECDH 金鑰交換出發，拆解 ERC-5564 的隱匿地址推導流程，並說明為什麼隱匿地址提供的是 「不可連結性（unlinkability）」而非「不可追溯性（untraceability）」。
這個區分很關鍵：每一筆交易在鏈上依然完整可見、金額與資金流向都可追溯、可審計；被切斷的只是「地址與收款人身份」、以及「同一收款人的不同地址之間」的關聯。這讓隱匿地址在需要選擇性揭露的場景（例如稅務申報、審計）下，比全匿名方案更具實用性 — 使用者保有對自身資料揭露的主動權。

分享時我會以 Fluidkey 為例。Fluidkey 在 ERC-5564 的基礎上做了一項關鍵設計：將 ephemeral key 改為從 viewing key node 以 BIP-32 階層式路徑 deterministic 推導而來，而非隨機產生。這個看似微小的工程選擇，帶來一個重要的安全性保證 — 使用者可以完全獨立地重放所有歷史 stealth address 並恢復資金，不需要依賴 Fluidkey 或任何中心化服務。這讓隱匿地址不只是隱私工具，而是真正符合 self-custody 精神的隱私基礎設施。

向量資料庫解決了 LLM 語義記憶檢索問題，卻無法支撑複雜場景的鏈式因果推理。傳統 Naive RAG 僅限單跳匹配、靜態 GraphRAG 易長鏈斷推理、LLM 幻覺嚴重；而借鑑海馬迴機制的 HippoRAG2，雖透過 PPR 隨機遊走強化多跳能力，卻因依賴全域靜態知識圖，存在大規模增量場景下運算瓶頸、更新成本爆炸的落地痛點。當前 AI 知識系統的核心挑戰，已從資料存儲轉為高效動態的知識關聯與事件推演。

本議程介紹基於 PostgreSQL 原生構建的 SAG（SQL-RAG）動態推論架構。SAG 捨棄靜態知識圖與向量相似度匹配機制，透過 SQL JOIN 即時生成「動態超邊」，按需構建查詢專屬子圖，穩定實現多跳推理，徹底解決傳統圖譜架構的增量災難問題。同時，架構支援資料庫事務回寫，實現知識推演閉環演化，讓模型可自我累積、驗證並迭代優化因果關聯。

身為開發工程師，我原本以為 AI 出現後，自己終於可以像 Team Lead 一樣拆任務、指派工作，讓 AI 快速完成實作。但 AI 產出的程式碼越多，我花在確認 AI 的交付、Code Review、測試與找錯的時間也越多。本次分享一個自己研發的工具來分享給大家。

大部分 AI agent 的 demo 在台上很厲害，一碰到真實任務就沒用了。這場 2 小時的迷你 hackathon 要做的正好相反：一起做一個小小的、但真的能動的東西。
我們會給一個明確的題目和一份起始素材（starter kit），讓你不用從零開始——現場跟著一起打造一個能從頭到尾完成任務的 AI agent。範圍抓小、把它做出來、現場 demo。
不需要事前準備、也不需要 agent 經驗，帶著筆電和好奇心來就好。歡迎使用開源權重模型與開源工具。可以單人做，也可以現場組隊，會有 mentor 在場協助。
流程上，我們會先說明題目與規則，大部分時間拿來動手做，最後以簡短的現場 demo 收尾。來做一個東西、認識其他開發者，看看一整個房間的人在兩小時內能生出什麼。
關於題目細節、建議工具與 starter kit，我們會在活動前另行公布。

Running databases on Kubernetes is challenging. Choosing Kubernetes to run your workloads has a lot of advantages: it gives you flexibility, and there are plenty of different solutions on the market that can be a part of your perfect technology stack. The real challenge is to build a solid, reliable foundation that will be possible to maintain without causing a headache for your platform team. With databases, it’s even more important to use proven in battle technology, as no one wants to see their data unavailable and their application down.

To reduce complexity for database workloads, operators were invented. You can handle the day two operations much more easily than setting up everything by yourself; still, there are different solutions available. To address this challenge, another idea has been born: OpenEverest is a fully open source solution recently donated to CNCF. By running literally three commands, you can set up a tool that allows you to manage different databases and database-related technologies from a unified GUI. You don’t have to worry additionally about backups, monitoring, etc., everything can be controlled from there.

During the presentation, you’ll learn how to use OpenEverest, how to reduce your daily operations, setup your own DBaaS platform, everything available as a 100% open source solution. Additionally, you can learn from case studies how different companies solve their problems with OpenEverest.

WrenAI 是一個開源的 Generative BI 工具，讓使用者用自然語言查詢資料。它從一個想法成長到 GitHub 15k star 的專案，並進入歐美大型企業的正式部署。這場分享會拆解：我們為什麼選擇開源、社群如何成長、以及公司在何時、依據什麼邏輯推出商業版本。

2000 年時，FOSDEM只是一個小型純技術聚。但伴隨著歐盟對於「數位韌性（Digital Resilience）」的重視，各種圍繞 FOSDEM 的開放原始碼政策辯論活動開始出現，並在 2019 年出現了首次由歐盟官方舉辦的政策會議 EU Open Source Policy Meeting。2020 年起，升級為 EU Open Source Policy Summit 更帶頭串連出了 EU Open Source Week。至此每年 2 月的布魯塞爾不再僅有技術宅宅，更聚集了歐洲的資訊官員與廠商。

2025年，EU Openn Source Week 的成功案例吸引了聯合國的注意，更深信開放原始碼透明、安全、去中心化的精神正是解決全球數位落差、實現永續發展目標（Sustainable Development Goals，SDGs） 的理想工具，UN Open Source Week 也應運而生。

到底這一切具體是怎麼發生的？這一切對於社群和各國政府及廠商將帶來怎麼樣的轉變，我們讓今年特別前往第一線參與的雁子、 RR 為您帶來第一手資訊！

電子紙（E-paper）憑藉著超低功耗與護眼特性，在物聯網設備與自造者專案中大受歡迎。然而，開發者往往面臨一個巨大的痛點：「驅動程式極度碎片化」。市面上常見的電子紙模組（如 Waveshare 系列），即使尺寸相同，內部控制晶片與初始化指令也可能完全不同，導致開發者經常需要重複造輪子，難以將程式碼跨型號移植。

本議程將分享如何打造一套跨型號的電子紙通用 API。透過建立完善的硬體抽象層（HAL），開發者只需撰寫一次程式碼，即可無縫適配多款不同型號的電子紙模組，大幅降低開發與維護成本。

此外，本議程的另一大技術亮點是「灰階功能的逆向與實作」。許多平價電子紙模組在官方預設下僅支援純黑白顯示，我們將深入探討電子紙的刷新原理，解析如何透過控制硬體波形（Waveform LUT）或演算法，突破硬體原廠限制，在通用 API 的架構下成功榨出平滑的灰階顯示效果。

這套解決方案目前已實作於 [ESP32 / Arduino / stm32 / Rpi / Rpi pico] 平台，並以 [ C ] 開源。無論你是深受電子紙驅動折磨的 Maker，還是對底層波形控制感興趣的開發者，都能在這場議程中獲得實用的解法與啟發。

對任何同時支援「Email + 密碼註冊」跟「Google 登入」或其他第三方登入的系統來說，會員身分可能的狀態組合會比單一登入方式來得複雜，也容易留下一些漏洞。

本場以一個會員系統(Node.js + Express + TypeScript + MongoDB)為例，拆解四個典型的攻擊手法與對應修補：

1. 擋下 Google 自動接管已有密碼的帳號
2. Google 登入會員後續該如何安全補上密碼
3. 刪帳號前先解除綁定，避免 orphan binding
4. Pre-account Hijacking：當帳號還沒建立就被卡位的攻擊路徑

希望能對近期需要整合任何第三方登入的朋友們有一些幫助。

程式編輯器是開發者每天接觸最核心的工具。過去十年間，Atom 的誕生將 Web 前端技術（DOM/JS）帶入桌面應用，催生了 Electron 框架，並奠定了 VS Code 的統治地位，但也帶來了效能與記憶體消耗的隱憂。

本議程將帶領聽眾回顧這段第二次「編輯器之戰」的歷史。我們將首先剖析 Atom 的技術架構與隕落原因，並探討 VS Code 如何透過開源與擴充套件生態贏得開發者喜愛。接著，我們將焦點轉向 Atom 核心團隊重頭打造的開源編輯器——Zed。

議程將深入解析 Zed 如何捨棄沉重的 Web 框架，運用 Rust 語言與自主研發的 GPUI 框架，將 UI 元件直接交由 GPU 渲染，實現 120 FPS 的極致效能。此外，我們也會探討在 AI 時代下，現代編輯器如何原生整合 MCP/ACP 協定，以及講者參與 Zed 開源社群的實務經驗。無論你是工具控、Rust 愛好者，還是對底層架構感興趣的工程師，都能從中獲得技術啟發。

1 個 Puma worker 開了 5 個 Puma threads,真的同時跑了 5 個嗎?
在 MRI 裡,同一瞬間真正執行 Ruby code 的,永遠只有 1 條——其他想跑 Ruby code 的,都在等 GVL。而 APM 並不能直接觀察到這個現象。
這場演講會透過實際案例,從 APM 上的異常訊號出發,建立 GVL 的正確心智模型(為什麼 I/O 釋放、CPU 不釋放,「加 threads 就變快」何時是錯的)
接著用 Vernier 取樣,找出延遲被 GVL stall 吃掉的證據
最後用 gvl-tracing 把 threads 搶 GVL 的現場直接拍成 timeline——不只看見誰在等,更揪出是哪個 controller action 在霸佔 GVL。

現代多核心系統高度仰賴高效率的同步機制，但許多開發者仍將 spinlock 視為黑盒子。
在本場演講中，我們將探討 spinlock 的設計如何演進，以因應現代硬體上的可擴展性挑戰。從經典的 test-and-set 與 ticket locks 出發，我們會檢視它們在高競爭情境下的限制，並說明以queue為基礎的方法，例如 Linux kernel 的 qspinlock，如何確保公平性並提升效能。
接著，我們將進一步探討更進階的設計，例如 Compact NUMA-aware Locks（CNA），並介紹我們自己的實驗性實作 RON，強調快取一致性與 NUMA 效應所帶來的挑戰。
我們也會分享 CNA 設計者所遭遇的挑戰，以及我們在嘗試將新的鎖設計 upstream 到 Linux kernel 過程中的經驗與教訓。
最後，我們將討論在真實系統中提升效能的策略；相較於設計鎖，開發者更常面對的是如何使用鎖。這些策略包括降低鎖的大小，以及考慮 RCU 等替代同步機制。
與會者將能獲得關於鎖可擴展性、效能瓶頸，以及如何分析現代多核心架構上同步行為。
本場次延續我們先前的演講，但會更著重於 CNA 與 RON 的設計與評估，並納入 kernel maintainers 的觀點。我們將聚焦於真實世界中的取捨與決策，提供與會者可付諸行動的觀點，協助處理因鎖競爭所造成的效能瓶頸，並評估替代同步策略。

當 AI 讓業務端也能快速做出系統時，企業或公民科技社群要怎麼定義邊界、責任與收編機制。
AI 公民開發該鼓勵創新，還是優先納管？
收編還是放生？企業如何面對 AI 自發開發潮
AI 生成系統進企業後，資訊部門是加速器還是防火牆？
公民科技社群的氛圍產物像是美麗煙火，天亮後我們的未來。

Installing Kubernetes is easy. Operating it across teams, under pressure, at scale that's where most organizations quietly struggle.

Clusters grow into a mix of manual kubectl workflows, inconsistent network policy, and operational knowledge nobody wrote down. It works until it doesn't.

The missing layer is operational lifecycle management and that's exactly what Juju was built for. Juju brings model-driven operations to Kubernetes: it manages service dependencies, handles upgrades and integrations, automates day-2 recovery, and encodes operational knowledge into reusable charms rather than fragile scripts and runbooks. Where most tools stop at deployment, Juju carries the operational story forward through the entire application lifecycle.

But a platform needs more than lifecycle automation. Delivery needs to be declarative and auditable that's where Argo CD fits in, providing GitOps-based deployment and drift control. And networking and security policy need to be enforceable at runtime that's where Cilium brings kernel-level policy enforcement and observability.

This session shows how Juju serves as the operational backbone of a Kubernetes platform, with Argo CD and Cilium filling the delivery and networking layers. Rather than presenting tools in isolation, the talk demonstrates a cohesive platform engineering model built around Juju's strengths in lifecycle automation and operational relationships.

Attendees will see how Juju's charm-based approach solves problems that GitOps alone cannot service integrations, cross-application dependencies, upgrade orchestration, and recovery workflows while Argo CD and Cilium handle what they do best.

本議程集合各漢語族語言以及各臺灣本土語言，共同討論在MediaWiki及維基媒體專案下如何強化各語言的發展。

This talk lays bare six months of intensive research, centered on OpenClaw. By benchmarking against industry counterparts like NVIDIA’s NeMo-Guardrails and Hermes-Agent, we provide insights that generalize across the entire personal AI assistant landscape.

We will conduct live demonstrations of five real-world attack vectors: Sandbox Backend Hijack, Subagent-to-Parent Injection, Group Chat History Pollution, Reply-chain Manipulation, and Supply Chain Attacks. Following the exploits, we’ll break down how to architect multi-layered defense-in-depth strategies. Finally, we will propose a unified "SecurityResult" interface: a standardized framework designed to let tools like NeMo Guardrails, LLM Guard, Presidio, Rebuff, and OpenGuardrails plug in seamlessly. Our goal is to move Personal AI Assistant security away from "reinventing the wheel" and toward a unified industry standard.

This talk will explain and showcase running Go code directly on the silicon of the AST2700 chip. This includes the troubles and blockers during porting and how I overcame them with a full hardware demo. I will briefly go over baremetal Tamago/Go, how it works and how it can be utilized on modern platforms as well has how others can port it to different chips as well.

Despite rapid advances in digital payments, financial systems remain fragmented and exclusionary. This talk explores how the Interledger Protocol (ILP) enables seamless interoperability across diverse payment networks, creating a foundation for open and inclusive finance.

We will dive into how Interledger works, real-world use cases, and how open-source contributors can help shape the future of global payments.

In this talk, I'll start by discussing apparmor, cgroup, seccomp etc and talk briefly about how these all are used to create a confinement for snapped apps. Then, I'll deep dive into the world of debugging confinement issues. I'll showcase and give a small hands-on on the snappy-debug tool and show how one can use it, in different scenarios, like in the Ubuntu Core or the classic Ubuntu distro and end the talk by showing a small example, on how one can actually extend various interfaces of snapd.

More info: https://events.canonical.com/event/146/contributions/938/

我不洗錢，為何要理解匿名支付？

許多人以為加密貨幣是匿名的，事實正好相反。只要知道一個錢包地址，就能在公開鏈上看到對方完整的金流、社會關係與行動軌跡。對於倡議組織、跨境協作的公民團體、需要保護身份的捐款人與受助者來說，這是一個被嚴重低估的風險。

過去幾年，區塊鏈社群為了讓「隱私」回到鏈上，發展出三套設計風格截然不同的解決方案。最早登場的是 Tornado Cash，技術上是經典的混幣器，但因為缺乏治理機制，最終被美國政府制裁、開發者也遭到起訴。接棒的 Privacy Pool 改採白名單路線，使用者需要取得「匿名良民證」才能進入隱私池，把合規與隱私放進同一個架構下協商。Railgun 則走另一條路，以黑名單搭配冷卻期與集體偵測，在 2025 年成功阻擋了 zkLend 駭客 950 萬美元的洗錢嘗試。最後是剛在以太坊社群冒出的錢包套件 Kohaku，目標是讓「隱私」變成所有錢包的預設值，以集體防禦取代個人選擇。

這個講座將以最白話的方式走過隱私金流的設計邏輯，並試圖討論對於開源社群與公民團體都很重要的問題，當隱私不只是技術問題，而是治理問題，誰來定義好人與壞人？

這場講座適合關心數位人權與公民安全的工作者、想了解加密貨幣合規邊界的法遵與會計人員、對隱私技術好奇但不知從何切入的開源開發者，以及任何曾經對「我又沒做壞事，為什麼要在乎隱私」這句話感到不太對勁的人。

ePaper displays are an ideal solution for always-on low power smart home interfaces, offering excellent readability and near zero energy consumption when static. In this session, we show how makers can build their own smart home displays using ESP32 based XIAO modules and the Arduino ecosystem.

Starting from the basics, you will learn how to interface a 4.2" monochrome ePaper display driven by the SSD1680 controller using the open source Seeed GFX Library. The presentation covers hardware comparison of the XIAO ePaper Display breakout boards and explains their differences and typical use cases. The session demonstrates how to render dynamic content such as sensor data, home automation status information, and custom dashboards while optimizing for low power operation. By the end, you will have a practical foundation for building your own battery powered smart home displays suitable for digital signage, room dashboards, and portable information panels.

This talk is suitable for everyone and no previous experience is required. It will be hopefully useful both for engineers and makers who are interested in using ePaper displays in their projects, whether they are just getting started or looking to expand their existing skills.

• Seeed GFX library for the Arduino Ecosystem: https://github.com/Seeed-Studio/Seeed_GFX
• YouTube video: Using ePaper Displays with XIAO: EE04 with XIAO ESP32-S3 vs ePaper Breakout Board with XIAO ESP32-C3: https://youtu.be/0TdbwdlP88w?si=xIixKl1prPLtxLON

你有沒有想過，你可以用 Kotlin「發明」一門小語言？

Kotlin DSL，簡單來說，就是利用各種語法特性，讓你在設計函式、物件、lambda 時，雖然寫的還是合法的 Kotlin，卻能讓使用者感覺像是在使用一門為特定問題量身打造的語言。

本 Workshop 將帶你從零開始，用 Kotlin 打造一個文字冒險遊戲引擎及他的腳本 DSL。

從遊戲引擎怎麼處理腳本，再到介紹Kotlin的各種語法糖，最終設計出一個可讀性極高、可直接描述劇情與選項的 Kotlin DSL。

結束後，你不只學到 DSL 怎麼做，更能看懂其他 DSL 背後共同的設計哲學——那些你每天在用的框架，其實都是同一套思路打造的。

Modern distributed systems require high performance, low latency, and reliability at scale. While gRPC provides an efficient communication layer using HTTP/2 and Protocol Buffers, running it in production introduces challenges beyond basic implementation.

In this talk, we explore how to design, deploy, and scale gRPC-based microservices on Ubuntu-powered infrastructure. Drawing from real-world experience, the session covers service discovery in Kubernetes environments, observability using tools, and advanced load balancing techniques.

We will dive into production-critical topics such as retry strategies, connection management, and backward compatibility, along with deployment strategies including canary releases and rolling updates.

By leveraging Ubuntu’s stability, long-term support (LTS), and open-source ecosystem, attendees will learn how to build reliable and scalable backend systems and avoid common pitfalls that are often not covered in documentation.

• 智新資通怎麼用開源軟體做生意?
• 為什麼選擇用開源軟體? 好處和壞處? 會特別在意是哪種 release license 嗎?
• 客戶在意是開源軟體嗎?
• 既然是 open source，客戶為什麼會花錢買?
• 用開源軟體要怎麼競爭對手有差異?

產品資安法規，正在重塑開源軟體生態的責任結構。歐盟《網路韌性法》（Cyber Resilience Act，CRA）之漏洞通報義務將於 2026 年 9 月正式生效，現有討論雖多聚焦於商業製造商的合規路徑，然開源人所面臨的系統性影響，實值等同關注。本討論以 CRA 為例切入，就資安合規框架對開源生態所觸發之議題進行梳理，期在 CRA 關鍵義務生效前，建構一份具參考意義的CRA「開源議題清單」（OSS Issue Map）。

【目標聽眾】
本演講適合關心公民科技（Civic Tech）、政府科技（GovTech）、流程自動化，以及對公私協力推動體制數位轉型感興趣的開發者與推廣者。

【痛點與背景】
公部門（特別是偏鄉單位）常面臨人力吃緊的挑戰。臺東縣消防局每年需處理密集的消防安全設備紙本申報、稽核與複查排程，繁瑣且重複的行政負擔極大地排擠了前線搜救與訓練的精力。

【解法與開源實踐】
為了解決此痛點，臺東縣消防局積極導入數位發展部「公民科技試驗場域」計畫，與公民科技團隊度合作，成功開發出「申報自動排程系統」。本專案將原本繁瑣的公務行政流轉化為智慧化自動排程演算法，落實公私協力與開源共好精神。

【議程大綱 (30分鐘)】
- [00-05m] 偏鄉消防的數位痛點：當有限人力遇上每年萬件申報案
- [05-15m] 流程智慧化：自動排程系統的架構設計、法規邏輯轉化與開源協作
- [15-25m] 落地成果與踩坑經驗：Civic Tech 團隊與公部門跨域溝通的淚與笑
- [25-30m] Q&A 與未來展望：如何複製此模式至更多公共服務場域

Running unmodified x86-64 binaries on ARM64 and RISC-V
Linux systems remains important, but general-purpose emulators such as
QEMU often impose too much overhead for demanding workloads, while
hardware-assisted translators such as Rosetta 2 depend on platform-
specific silicon. Box64 addresses this gap with a wrapping-first architec-
ture that routes calls into native host libraries through ABI translation
wrappers and reserves JIT compilation for guest code.
This paper describes three parts of the design: a native wrapping layer
spanning 278 libraries, including entry-point interception and callback
bridging; a four-pass JIT compiler with flag liveness analysis, deferred
flag computation, and native flag reuse; and system-level support for
deployment, including Steam container bypass, Wine mixed-bitness co-
ordination, and TSO emulation on weakly ordered hosts. Evaluation on
Raspberry Pi 5 (ARM64), HiFive™ Premier P550 and Andes AX45MP
(RISC-V) shows a median of 67% native CPU performance on ARM64
microbenchmarks, 63–94% native throughput for favorable wrapped
library calls, and a median 4× speedup over QEMU, reaching
40×when wrapping removes translation from the hot path.

This session is about speeding up embedded bring-up for the Jaguar EInk Display: colour e-paper on NXP i.MX93 SOC with Yocto / OpenEmbedded customisation, plus a Zephyr-based companion chip for power management—targeting 5+ years operation with the PMU approach for realistic scheduled static signage workloads.

The Linux side display and controller integration are implemented as a Rust userspace application on the Linux image—code people often call a “driver,” but here it is userspace engineering, iterated like any other critical service.

The focus is agentic AI (e.g. Cursor-class agents) and how it changes the loop when you feed it real hardware feedback. I will describe a workflow we relied on: SSH to boards (including remote lab setups), automated deploy of rebuilt artefacts, and webcam capture of what is actually on the panel—fed back into the agent loop so “what we think we programmed” is checked against what appears on hardware. That closes the gap between compile-only optimism and hardware truth.

I will cover partitioning between Linux + Rust app and Zephyr on the PMU at an architectural level (rail sequencing, sleep/wake, responsibilities). PMU application firmware remains closed source; I will not present proprietary files—only the integration surface, debug strategy, and lessons that remain useful when part of the stack is private.

The product direction includes long-life maintenance thinking aligned with UK-CE RED and EU CRA expectations around secure boot and OTA—discussed technically, not as legal advice.

Open artefacts

• meta-dynamicdevices
• eink-power-cli
• esp-eink (older open e-paper reference material)

Audience

Embedded / Linux developers; Rust curiosity helps; deep kernel internals not required.

Outline (30 minutes)

1. Goals and architecture (Linux + eink display rust app + Zephyr PMU)
2. Yocto customisation highlights using Foundries.io stack for secure boot and OTAU
3. Agentic workflow (SSH, deploy, logs)
4. Webcam-in-the-loop verification for panel outcomes
5. Failures and guardrails; Q&A (Open-EP collaboration themes)

Takeaways

• A repeatable pattern for remote hardware feedback loops with agents
• Pointers to public repos

Related

• Prior talk (agentic Yocto-era workflows): Yocto Project Summit 2025.12
• Product framing: etablone

Europe isn't just talking about digital sovereignty anymore. Governments are actually doing it. Schleswig-Holstein is moving 30,000 workstations off Microsoft. France is deploying open source productivity stacks across ministries. Denmark, the ICC, universities, hospitals — the list keeps growing. And at the center of most of these migrations sit open source tools like Libre Office, Nextcloud and more.

This talk is about what these migrations really look like in practice — the architecture decisions (why Hub over Suite matters), the deployment realities (self-hosted, air-gapped, sovereign cloud), the partner ecosystem that makes it function, and the things that go wrong that nobody puts in the press release.

But this isn't a Europe talk at a European conference. This is a Europe talk at an Asian conference, and that's the point. Taiwan, Japan, Korea, India, and more; Every country in this room is navigating some version of the same question: how dependent are we on infrastructure we don't control? Europe is five years ahead on this journey. Some of what they (and we) have learned is directly transferable. Some of it isn't. I want to bring that honest conversation to COSCUP: What works, what doesn't, and what your community can start doing now rather than waiting for policy to catch up.

本工作坊從使用者視角出發，介紹龍捲風現金（Tornado Cash）的設計哲學與隱私池（Privacy Pool）的改進。我們會利用道具與實機操作，展示兩樣工具的使用方式。重點放在實際操作與使用上的隱私眉角，而非密碼學細節。
時間允許下，我們也會介紹這些工具的沿革與在現實世界的衝擊。

(English session)
I published my first project on GitHub in 2015, more than ten years ago. Back then, I was a programmer who knew a little C. Today, I am an active member of the open-source community, a Python core developer, and an Apache Spark committer.
Looking back on my open-source journey, I have realized that my progress and achievements have never been linear. There were often long periods when I felt uncertain, lost, or stuck, followed by the sudden arrival of a new milestone. As I have grown, those difficult periods have become shorter, and the milestones have come more often.
This makes me think that some of the lessons I have learned may be worth sharing. They will not instantly make anyone an excellent open-source developer, but they may help shorten the periods of uncertainty and make the next milestone arrive a little sooner. People are motivated by positive feedback, and I hope this talk can help more people experience that feedback early in their journey. I hope it encourages them to become happy and long-term members of the open-source community.
In this talk, I will try to answer the two questions I am asked most often: Why should you work on open-source projects, and how should you do it? I believe that once you have answers to these questions, you will be ready to become an open-source developer.

• Slido Audience Q&A

Most AI pentesting systems start from the same idea: give a model a toolbox, let it choose commands, and hope the loop converges.
Our projects takes a different approach. It treats offensive security as a command-and-control problem, not a prompt-engineering problem.

Our projects is a source-available red-team command platform built around C5ISR situational awareness and the OODA loop.
Given an authorized target, it collects structured facts through recon, OSINT, vulnerability lookup, and 23 MCP tool servers covering network, AD, and cloud attack

This talk walks through the architecture and the lessons learned: fact schemas, attack graph pathfinding, tool routing, scope validation, risk gates, noise budgets, failure classification, and MCP-based execution boundaries.
We show how the project moves from reconnaissance to failed initial access, classifies the failure, pivots to an exploit-based path, and records the full chain as structured evidence, contrasting this with the open-loop pattern common in tools like PentestGPT and hackingBuddyGPT.

The key lesson is not that AI can "hack automatically." The lesson is that AI becomes useful when it is constrained by doctrine; explicit rules of engagement, typed tool outputs, human-visible decisions, deterministic safety gates, and execution engines that can be audited or stopped.

Attendees leave with a practical blueprint for building safer AI-assisted offensive tooling, and a clear model for where LLMs belong in cyber operations: not as unchecked operators, but as Orient-stage reasoning engines inside a controlled command loop.

The Flipper Zero has a reputation as a hacker’s multitool capable of cloning keycards, starting Teslas, and stealing WiFi passwords. Curious about the hype, I bought one to see what it could actually do.

In this talk, I’ll introduce the Flipper Zero and explore the wireless technologies it interacts with, including infrared, RFID, and NFC. Along the way, we’ll explore how access cards work and why many real-world systems are harder to clone than internet hype suggests.

But the most surprising part of my Flipper Zero journey wasn’t hacking, it was discovering the joy of building software for a tiny open device. I’ll share a few small projects, including my first simple knit counter app and a silly scorekeeping app using the Flipper Zero, Grafana dashboard, Google Sheets as a stack.

This talk is about curiosity, creativity, and my journey as a so-called hacker who set out to hack things, failed completely, and ended up building wholesome and unexpected projects instead.

生成式 AI 正快速改變工作內容，但我們常看到的是「哪些職業可能被取代」的宏觀預測，然而在近期的調查中把問題延伸至：「一則職缺中，究竟是哪些工作任務可由 AI 協助？」、「哪些仍受限於實體操作、人際互動、專業判斷或法律責任？」

議程將分享如何運用 n8n、Supabase、開源大型語言模型，打造一套可重現的工作任務層級之觀測流程。專案使用台灣就業通其中五項類別（行政、會計財務、客服、軟體與資料、照顧服務）的職缺為例，將非結構化職缺內容轉為保留原文證據的工作任務，再依照生成式AI的參與程度建立E0至E3四個等級的AI暴露程度（AI Exposure）分類，並分析 AI 與人類可能的分工方式，以及阻礙任務完全自動化的主要限制。

為降低模型高估與分類的不一致，資料流程額外加入自動驗證、規則警示與人工檢核機制，保留模型原始結果和人工修正紀錄。後續建立「任務」、「職缺」與「職類」三層指標，透過公開儀表板呈現各職類中較容易由 AI 協助，以及仍需人工執行的具體任務。

g0v 長期參與者 Ronny 在 2023 年成立了歐噴有限公司（OpenFun），期待將過去在 g0v 的興趣，轉變為公司的目標，讓開放政府運動能更永續的進行下去。

三年來歐噴逐漸站穩腳步，開發了 LawTrace 和 OpenBudget 等開放政府開源專案，並且持續在與政府倡議開放協作文化，歐噴是怎麼走過來的呢？

Every container you deploy carries debt you didn't write. The average base image ships with 200-400 packages your application never calls, each one a potential CVE, each one expanding the blast radius of a breach. Teams run Trivy or Grype, get a wall of 400 alerts, patch the criticals, suppress the rest, and ship. The scan-patch-suppress cycle creates an illusion of security hygiene while the actual attack surface stays enormous.

The good news: the ecosystem is finally pushing back. Google's distroless project has been around for years, Chainguard built a business on minimal images, and Docker Hardened Images went fully open source under Apache 2.0 in late 2025, putting 1,000+ minimal, SBOM-signed images one pull away from every developer. Yet most teams still default to node:latest.

This talk dissects why container supply chain debt accumulates and what a different default looks like. Through live audits comparing standard, slim, distroless, and hardened base images for the same application, we'll examine size, CVE counts, and actual runtime dependencies. You'll leave with practical patterns: multi-stage builds done right, automated base image rebuild pipelines, and policy-as-code for image provenance, so minimal becomes the default without slowing teams down.

Many embedded display systems rely on tightly coupled firmware or vendor-specific tooling, making it difficult to integrate with desktop applications or iterate quickly on UI workflows.

In this talk, I will present a practical end-to-end pipeline for streaming images from a host computer to an embedded LCD display, At its core is running open-source Zephyr RTOS. The system uses a custom USB protocol transfers, enabling efficient and flexible communication between a PC-side application (implemented in C#).

I will walk through the system architecture, including USB protocol design, framebuffer handling, and integration with Zephyr’s display API, along with practical development experiences such as debugging, transfer performance, and reliability considerations, and approaches that can also be extended to lower-power display technologies such as e-paper systems.

The talk focuses on reusable design approaches and avoids proprietary implementation details. Attendees will gain a reusable model for building similar host-to-device display pipelines in their own projects.

Closing Day 1

開場

這場演講會分享我從 Taiwan-LLM 一路做開源 LLM 的經驗，以及換了位置走進前線研究後，回頭看開源 LLM 模型的發展。

• Slido Audience Q&A

React developers have long juggled React.memo, useCallback, and useMemo to squeeze performance out of their apps. Imagine a compiler doing that work for you automatically at build time. The React Compiler promises exactly this: fine grained memoization with zero code changes.

In this talk, I will demystify the React Compiler, explain how it works, and show real before-and-after results that prove the gains are tangible. You will learn how to adopt it safely, measure its impact in your own app, and avoid common pitfalls. With live coding and side-by-side demos, I will show how a single config flag can take an app from sluggish to snappy without touching a line of component code.

Why This Talk Matters:

• The React Compiler has recently turned stable, teams are starting to adopt it in their codebases now.
• Attendees get a clear benchmarking workflow to measure impact in their apps.
• Live profiler demos reveal the compiler’s optimizations in action.

Key Takeaways:

• What the React Compiler does and how to enable it.
• How to benchmark before/after performance with tools like Lighthouse and React Profiler.
• Real-world demos showing fewer re-renders, smaller bundles, and faster UIs.
• When manual optimizations are still needed, and how to spot them.

The Fediverse is often described as a technical alternative to centralized social platforms: decentralized, interoperable, portable, and community-governed. But for the open social web to grow meaningfully in East Asia, protocol compatibility alone is not enough. Federated systems also need governance patterns that can work across different legal environments, platform cultures, languages, and community expectations.

The East Asia Technology Institute proposes a talk that examines the Fediverse and open social web from an East Asian governance perspective, with a focus on Korea, Japan, and Taiwan. Rather than treating the region as one market, it looks at how different privacy regimes, moderation expectations, localisation needs, and trust cultures can shape the way federated social systems are built and operated.

The session is not intended as legal advice. Instead, it translates governance questions into practical considerations for developers, instance operators, moderators, open-source contributors, and community oraganisers. Topics may include instance accountability, data-flow transparency, cross-border federation, moderation processes, user onboarding, localisation, and the role of open standards in avoiding vendor lock-in.

The central argument is that the Fediverse should not treat governance as an afterthought. If open social infrastructure is to become genuinely global, it must be able to adapt to regional realities while preserving interoperability, openness, and community control.

Hacking Corner 是一個能容納 10 人左右的交誼廳，供會眾自由交流！這是一個可以從快速打牌遊戲到進行長達數小時的開源馬拉松的多功能空間。無論是15分鐘的急速腦力激盪還是一場兩小時的代碼冒險，這裡都是實現你的創意與夢想的場所。

記得至此下方連結閱讀注意事項並登記。
https://docs.google.com/document/d/1ZerJ-5QYcEJ5guhxtK-SBW2BA6RMHtVJnqNIWxRCz18/edit?tab=t.0

Hacking Corner 是一個能容納 10 人左右的交誼廳，供會眾自由交流！這是一個可以從快速打牌遊戲到進行長達數小時的開源馬拉松的多功能空間。無論是15分鐘的急速腦力激盪還是一場兩小時的代碼冒險，這裡都是實現你的創意與夢想的場所。

記得至此下方連結閱讀注意事項並登記。
https://docs.google.com/document/d/1ZerJ-5QYcEJ5guhxtK-SBW2BA6RMHtVJnqNIWxRCz18/edit?tab=t.0

Hacking Corner Bulletin Board

Hacking Room 是一個能容納 10 人左右的區域，供會眾自由交流！在這裡，我時間是你的朋友。這是一個可以從快速打牌遊戲到進行長達數小時的開源馬拉松的多功能空間。無論是15分鐘的急速腦力激盪還是一場兩小時的代碼冒險，這裡都是實現你的創意與夢想的場所。

The hacking room is a free space for casual gatherings, which can hold up to 10 people. There is no time limit in the hacking room. You can play card games with friends for 15 minutes between talks or run a two-hour open-source sprint here. Also, multiple events are available at the same time. It is all up to you!

本議程將以 Laravel 實戰方式，示範如何用「圖片雜湊（image hash）比對」實作以圖搜圖功能。內容包含：在 Laravel 中處理圖片上傳與儲存、使用感知雜湊（aHash / pHash）計算圖片特徵、將 hash 值存入資料庫，以及透過漢明距離比對找出相似圖片。最後會說明這種做法的優缺點，以及如何擴展成更完整的以圖搜圖系統，適合熟悉 Laravel 的 PHP 開發者學習實務應用。

Linux v6.12 引入的 sched_ext (scx) 允許開發者藉由 eBPF，在使用者空間動態載入或抽換 CPU 排程器。
本議程預計探討以下：

• sched_ext and eBPF
• 剖析 sched_ext 在 Kernel 如何實作 ( kernel/sched/ext*)
• 回顧 BORE scheduler
• Play with scx_rustland_core
• 以 eBPF 實作 BORE scheduler [scx_BORE]

Nekko open sourced the CORE-ET AI inference accelerator design based on Esperanto Technologies' ET-SOC-1 processor. This talk goes into how open sourcing RTL enables downstream development, any what's now possible only on open source hardware and the RISC-V open ISA

Source: https://github.com/openhwgroup/core-et

大語言模型（LLM）技術日新月異，單靠閱讀論文或文件已經難以跟上發展速度，真正的理解往往建立在「親手把玩程式碼」之上。

本議程將分享 Twinkle AI 開源社群中「熬夜書坊（Late-Night Study Session）」的營運經驗與技術結晶。我們將開源專案 TwinkleAI-LLM-Book-Club 作為核心載體，帶領會眾一窺如何將重量級著作《Hands-On Large Language Models》轉化為社群共學的開源教材。

演講中將展示我們如何利用開源的互動式 Notebook 環境（如 Jupyter 甚至具備高重現性的環境），帶領參與者一步步拆解 Tokenization 的編解碼過程、解析 Embeddings 向量魔法，並實際串接 Twinkle AI 專屬的繁中在地化模型（如 gemma-3-4B-T1-it）進行推論。這不僅是一場關於 LLM 底層技術的分享，更是展示如何透過開源協作與做中學（Hands-on），降低技術門檻，凝聚台灣在地 AI 生態圈的實踐指南。

我們將會介紹來自 德國維基媒體 為了應對如今 AI 世代所提出的最新的計畫之一：維基數據嵌入專案，這個專案有著相當單純的目標，要讓 AI 讀懂維基。維基數據作為如今資訊社會最重要的基石之一，其重要性來自於其龐大且自由開放的結構化數據，為資訊自由流通做出了莫大的貢獻。如今面對來自 AI 的全新挑戰，維基媒體嵌入專案要做的就是讓維基數據的資料超越機器可讀的標準，使 AI 系統也能自由且正確的使用其中的資訊。

① Bitcoin 在量子電腦下的攻擊面
② 公鑰、私鑰、地址：鏈上看得到 hash ≠ 看得到 pubkey
③ 為什麼「9 分鐘破解」是 BTC 的生死線？
④ BIP-360, BIP 361 在做什麼？
⑤ CRQC 真的來了我們怎麼盡早知道？
⑥ 防範公鑰外洩 - HNDL（Harvest Now, Decrypt Later）
⑦ 為什麼後量子升級總是被排到最後一步？

歡迎參加我們為時3小時沉浸式的正念體驗活動，一同探索以儀式培養內在平靜與自我覺知。活動由John Ho 主持，他將分享他個人和家人正念之旅的感悟。本地的身心靈合作夥伴: Bernice 蔡碧瑜, Newfound Life《怒放生活》創辦人｜個人成長｜健康管理師; Jessie Chang 聊心茶室 (HealYou); Jeffrey Schwab
, Chief Possibility Officer of Uncertain Pathfinders-Ex CLO-APTD-Lifelong improviser-Lumina Spark Practitioner-Coach/Mentor-Writer-Process Oriented Extrovert-Banjo Player-Embracer of Trial and Error; Stephy 徐一瑄, 美國註冊藝術治療師 (ATR-BC), 紐約州創意藝術治療師 (LCAT); 也將介紹她們台灣正念領域的資源。您將透過與導師及與會者的分組互動，深度的探索最適合您的正面實踐方式。本活動將中英雙語進行。

In the opening remark, John will share the inspiration for this mindful connection session.

HealYou Team: 70 min.
Jessie 聊心茶室CEO 《系統當機中，我決定自己重啟》 HealYou 聊心茶室的創辦人 Jessie Chang（張道芳，曾是科技業裡每天解 bug、交付產品的 PM，也曾是在螢幕前獨自對抗情緒低潮的那個人。
這一場 20 分鐘的分享，帶你走進 HealYou 的起點：從「我需要幫助」開始的旅程。她沒有離開科技，而是和一群工程師、設計師、心理師，一起打造出一個，讓人可以安心說出「我撐不下去了」的地方。
不要只是聽，邀請你親自嘗試，邀請來自紐約的藝術治療師 ——Stephy，一起進入 40 分鐘的藝術表達工作創作。不需繪畫要技巧，什麼都不用準 ——我們會引導你，讓手比語言更早說出心事。
System Crash. I Chose to Reboot. Jessie Chang, founder of HealYou, was once a product manager debugging systems by day—and quietly battling depression by night.
In this 20-minute talk, she shares the story behind HealYou: a mental health platform built not out of ambition, but necessity. Instead of leaving tech, Jessie joined forces with engineers, designers, and therapists to create a space where people could finally say, “I’m not okay”—and be heard.
But this isn’t just a story to listen to. We’re inviting you to feel it, too.

Join Stephy for a 40-minute guided creative session. No drawing skills needed. No preparation required. Just your presence—and your willingness to let your hands speak what words often can’t.
Stephy will also explore the topic of "Human in the Loop: Reclaiming Agency and Human Connection in the Age of AI." AI is no longer changing only how we work, it is beginning to reshape creativity, emotional support, and even human relationships. So what role do humans still play in the loop?

Break: 5 min.

Bernice: 50 min.《Debug 自己：那些下意識的反應，從哪裡來？》
你是否曾經……
• 明明想拒絕，卻還是說了：「好，我來。」
• 遇到衝突時，總是不知道該說什麼。
• 面對壓力時，不自覺開始放空、抽離。
• 同一件事情，卻發現自己和別人的反應完全不同。
這些下意識的反應，真的只是個性嗎？
在這場互動式體驗中，我們將一起：
• 從幾個日常生活情境出發，觀察自己的第一反應。
• 透過活動與交流等方式，發現每個人的反應。
• 用簡單易懂的方式，理解這些反應背後可能代表什麼。
• 帶著新的角度重新認識自己，發現理解自己之後，人生其實可以擁有更多選擇。
本場分享不需要任何心理學背景，也不需要分享過於私密的故事。只要帶著一點好奇心，歡
迎一起來參與這場屬於自己的小小 Debug 實驗。

Jeffrey: 50 min. Spontaneous Collaboration: What Open Source Can Learn from Applied Improv

Open source depends on collaboration, but great collaboration is about more than code. It's about listening, adapting, and saying "yes and..." to each other's ideas.

Applied improvisation uses improv exercises to develop real-world communication and collaboration skills—this is not about acting or comedy. In this interactive 45-minute workshop, participants will experience simple activities that strengthen active listening, psychological safety, adaptability, and creative teamwork.

Through hands-on exercises and brief reflections, we'll connect these skills to contributor onboarding, community discussions, and everyday open source collaboration. No improv experience required—just curiosity and a willingness to participate and experiment together!
標題： 即興協作：開源社群可以從應用即興（Applied Improv）學到什麼？
開源的核心是協作，而真正優秀的協作不只是寫程式，更在於傾聽、適應，以及對彼此的想法說一句「Yes, and…（是的，而且……）」。
應用即興（Applied Improvisation）透過即興練習培養真實世界中的溝通與協作能力，重點不是表演或喜劇，而是學習如何在沒有劇本的情況下與他人共同創造。在這場 45 分鐘的互動式工作坊中，參與者將透過簡單有趣的活動，體驗如何提升積極傾聽、心理安全感、適應力與創意團隊合作。
透過實作與簡短的反思，我們將一起探討這些能力如何應用於新貢獻者加入、社群討論，以及日常的開源協作。無需任何即興經驗，只要帶著好奇心，願意一起參與、嘗試與實驗！

在導入 LLM Coding Agent 到日常開發後，很多團隊會遇到問題：品質不穩、風險難估、模型升級缺少客觀依據。本分享會從實務流程出發，介紹如何觀測 Agent 行為、把評估流程自動化，並建立可持續迭代的 decision system。

1. 為什麼 LLM Coding Agent 需要 O11y 與 Evaluation
2. 從 trace 開始：觀測 agent 任務、工具調用與失敗模式
3. Observability != Decision System：看得到不代表能決策
4. LLM-as-a-judge 在 coding 任務中的價值與限制
5. 從 daily coding logs 抽取 dataset
6. 建立 regression evaluation pipeline 與 quality gate
7. 用量化結果比較不同模型與 agent framework
8. 把模型升級與框架切換變成可驗證工程流程

AI 工具正讓工程師比以往更容易快速生成程式碼、探索想法並發起 Pull Request (PR)。然而，更快的產出並不總是帶來更好的 PR。在實際應用中，AI 生成的變更往往伴隨著常見的問題：更龐大的 diff（程式碼差異）、薄弱的脈絡、模糊的意圖，以及更高的審查負擔（Review Overhead）。

在這場演講中，我將從實用的角度分享 AI 在日常開發中究竟能在哪裡提供真正的幫助、在何處開始製造問題，以及為什麼我仍然選擇手動構建大多數的 PR。本次分享並非要反對 AI，而是專注於一個對工程師和開源貢獻者更實用的問題：我們該如何將 AI 視為工具，同時又不放棄程式碼的所有權、清晰度以及對審查者（Reviewer）的同理心？

我也將簡要結合自身在開源社群的貢獻經驗（包括與 Zed 相關的工作）作為範例，來說明為什麼一個易於審查、結構良好的變更，往往比一個快速生成的變更更具價值。

本場演講旨在提供實用建議，探討如何以健康的方式構建合適的 PR 來貢獻開源專案，並理解為什麼親自保持對脈絡（Context）的理解至關重要。

Slide: https://speakerdeck.com/tommyhonym/when-agent-helps-and-why-i-still-write-the-pr-myself

軟體定義車輛（Software‑Defined Vehicles, SDVs）正引領汽車產業的重大轉型，車輛架構逐漸從以硬體為核心，轉向由軟體所定義與差異化。過去汽車系統多圍繞固定硬體元件設計，而現代車輛則越來越依賴可更新、具彈性且高度軟體化的平台。
為了加速此一轉型，多個開放原始碼聯盟──如 AGL、ELISA、SOAFEE、Eclipse、COVESA、AUTOSAR 等──正跨越 SDV 生態系的不同層面展開協作。本場演講將概述這些組織的角色與方向，並說明其如何共同推動下一世代汽車平台的發展。
本次分享旨在促進汽車開源社群與 COSCUP 參與者之間的交流與合作，並將以英語及中文進行。

Modern Ubuntu systems offer powerful tools like systemd, LXD, and various CLI utilities, but these often remain fragmented and require significant command-line expertise to operate efficiently. In this talk, we will present a system that enables natural language control of Ubuntu using a fully local AI Model, our system contains:
- A local LLM for intent interpretation
- A lightweight orchestration layer
- Tool adapters connected to Ubuntu components (systemd, LXD, logs)

Instead of relying on cloud services, this system uses a local LLM combined with a structured tool interface to safely and predictably interact with system components. This allows users to monitor performance, manage services, control LXD containers, and summarize logs using conversational commands.

More info: https://events.canonical.com/event/146/contributions/954/

在雲端開發盛行的時代，為每位開發者配置獨立 VM 既昂貴又浪費資源。Containarium 是一個基於 Go 語言與 LXC 技術的開源專案，旨在解決這個痛點。它能在單一 VM 上快速佈署數百個具備完整 OS 體驗、支援 SSH 存取、且能執行 Docker 的隔離開發環境。

本場次將分享我們如何利用 LXC 系統容器取代傳統 VM，並透過 SSH Jump Host 與雲端原生自動化技術，在不犧牲安全性的前提下，將基礎設施成本降低 90% 以上。我們也將介紹 Containarium 如何在 Spot Instance（競價實例）上實現自動恢復，打造穩定的開發環境。

I want to talk about how good gaming on Linux is, as compared to Windows. With the constant improvements in proton and other FOSS libraries and tools, this might just be the year of the Linux desktop.

There's been a >50% year on year growth in the number of people gaming on Linux, and this is only going to grow. The major boost came when Valve introduced the Steam Deck which basically revolutionized gaming on Linux. With the upcoming Steam Machine, we might just make up the majority of the market, overtaking Windows for good.

I want to talk a bout the basic technical aspects of the entire gaming pipeline on Linux, and introduce people to some of the most important FOSS tools and libraries which help us play games on Linux. Few of these are proton, dxvk, vk3d, vk3d-proton, and I'll also be talking about how Nvidia went partially open source for Linux and why it helps the community. Might also briefly touch on the work going on with NVK and Nova.

I'll also talk about the basics of how to setup an Ubuntu desktop for gaming. I'll go through the required software and tools needed to game comfortably on Ubuntu and how an end user can do this without getting into a web of complex configurations.

More info: https://events.canonical.com/event/146/contributions/934/

Since the launch of the Japanese Wikipedia in 2001, the Wikimedia movement in Japan has evolved into a highly unique and deeply collaborative ecosystem. Initially driven by isolated online contributors, the movement has steadily transitioned into dynamic offline community-building and strategic outreach initiatives. This 30-minute session explores the historical trajectory, distinct methodologies, and future prospects of the Japanese Wikimedia community, offering valuable insights into how open knowledge can thrive in a non-Western cultural context.

A cornerstone of Japan's outreach strategy is its extensive collaboration with local institutions and cultural heritage sectors, known as GLAM (Galleries, Libraries, Archives, and Museums). The session will highlight the success of "Wikipedia Towns"—innovative, hyper-local edit-a-thons organized across Japan. In these events, local citizens, librarians, and government officials collaborate to digitize and document regional history, tourism, and cultural assets on Wikipedia and Wikimedia Commons. By bridging grassroots participation with institutional archiving, the Japanese movement has successfully democratized knowledge production and fostered strong local open-data ecosystems.

Furthermore, the presentation will address how Japanese Wikimedians are tackling global knowledge equity challenges. Through localized adaptations of international campaigns such as "WikiGap" and "Art+Feminism," the community is actively working to bridge the gender gap and improve the representation of marginalized histories in the Japanese-language digital space. These initiatives demonstrate how global open-source movements can be effectively contextualized to address local systemic biases.

Crucially, the session will confront the pressing challenges and opportunities brought about by the rapid evolution of Artificial Intelligence (AI) and Large Language Models (LLMs). As AI tools increasingly rely on Wikipedia for training data, the role of human editors is undergoing a paradigm shift. The speaker, a seasoned administrator of the Japanese Wikipedia since 2007, will analyze what is currently happening within the Japanese Wikimedia infrastructure. The discussion will delve into how the community maintains data quality, counters misinformation, and redefines the value of human-curated open knowledge in an AI-dominated information landscape.

Attendees—including open-source developers, data advocates, and community managers—will gain a comprehensive understanding of the operational mechanics of one of Wikipedia's largest non-English language editions. By attending this lecture, participants will discover actionable strategies for community engagement, cross-sector partnerships, and sustainable open-knowledge governance in the age of AI.

Postgres has the unique ability to act as a powerful data aggregator in many data centers. This talk shows how Postgres's extensibility, access to foreign data sources, and ability to handle NoSQL-like and data warehousing workloads gives it unmatched capabilities to function in this role.

"The Internet is a big network of computers all over the world connected to each other" - most of us have probably come across an explanation such as this when trying to learn how it all works. However, this does not explain anything at a technical level – what is really happening when you type “google.com” in your browser and hit enter?

Why does “google.com” work, but some, ahem, other websites get blocked? How? Can the person sitting next to you in a coffee shop really steal all your data unless you use “CompanyVPN”? (Don’t forget to use code TOR_OR_BUST for 1337% off!)

There is a lot that goes into making the internet work, and there are a lot of (mostly legitimate) parties between you and the website you’re visiting. Understanding how it all works is key to understanding how this system is (ab)used to perform surveillance, block access, and steal data.

This talk aims to first explain some basic concepts of how two parties can communicate over the internet via “packets”, analogous to postcards (ever sent those?!). Through this analogy, we’ll learn exactly who sits in the middle, what can they see and can they change. You'll come to appreciate how brittle parts of Internet infrastructure can be, the number of parties that need to cooperate across the world, and maybe end up surprised that any of it works at all.

We’ll also explore how bad actors can tamper with the “Postcards” - explaining how censors work, or how information is leaked, even in 2026 with all the decades of improvements since the 80s.
By the end, you’ll either be surprised to learn how private the internet is by default, or end up annoyed at how some stuff still gets out! And of course, you will start judging the predatory VPN advertising more harshly.

近年大型語言模型（LLM）快速發展，但「怎麼公平、快速、可重現地評估模型能力」仍是實務上的痛點。尤其對繁體中文場景而言，現有 benchmark 工具往往偏向英文生態，缺乏對本地資料集、模型部署方式，以及實際評測流程的友善支援。

這場分享將介紹我們打造的開源評測工具 Twinkle Eval，一套專為 LLM benchmark 設計的自動化評測框架，聚焦繁體中文模型評估需求。Twinkle Eval 支援多種資料格式、OpenAI API 與自架模型介接，提供平行批次評測、題目選項隨機化、多次重複測試穩定性分析，以及完整結果追蹤，讓模型評測不再只是「跑一次分數」，而是能更可靠地理解模型真實能力。

我們會分享設計這套工具的背景與工程取捨，包含為什麼現有工具不夠用、如何處理 benchmark contamination 與選擇題 positional bias、如何提升大規模評測效率，以及在繁體中文 benchmark（如 TMMLU+、法律資料集）上的實際使用經驗。

如果你正在訓練模型、比較不同 checkpoint、做模型選型，或只是想建立更可信的 LLM evaluation workflow，這場分享會帶你快速理解現代 LLM benchmark 的實務方法，以及我們在開源工具開發中的經驗與踩坑。

The Wikidata Model Context Protocol (MCP) was launched in 2025. It enables LLM users to access Wikidata's data via natural language prompts. This session introduces the Wikidata Embedding Project, Wikidata MCP, and a brief showcase of the Wikidata MCP in action. Join me to learn how to access the world's largest free and open knowledge graph via LLM.

Google 推出 Gemma 4 的時候附了 model card 和 safety benchmark，但那些數字是 Google 自己測的。如果你用 OWASP LLM Top 10 的標準，從攻擊者視角重新掃一遍，結果會一樣嗎？
這場議程分享我們在 NVIDIA DGX Spark GB10 和 Mac mini M4（MLX）上對 Gemma 4 26B 進行紅隊掃描的完整過程與結果。我們用 OpenClaw 攻擊鏈逐項測試 OWASP LLM Top 10 的風險項目，包括 Prompt Injection（LLM01：7 項測試通過 5 項）、Visual Prompt Injection（3 項測試確認 2 項弱點），以及其他類別的實測數據。
你會看到的不是理論分析，而是一份有具體 pass/fail 的成績單。我們會拆解每一項測試的攻擊手法、Gemma 4 的實際反應、以及哪些弱點可以用 NemoClaw Guardrail 補強。
這場的目標不是說 Gemma 4 不安全，而是讓每一個用開源模型的開發者知道：model card 上沒寫的風險，你要自己測。我們會開源測試腳本，讓你對任何開源 LLM 跑同樣的弱掃流程。

雖然網際網路乘載了目前生活中從電子郵件、社群媒體到人工智慧系統的各種服務，但許多網際網路的使用者對於支持整個網際網路系統的基礎建設，也就是域名（domain name）系統的瞭解並不深入，逞論理解域名系統中的各種自由與開源軟體的存在。這些仰賴社群參與與投入來維護的自由與開源軟體，也在網路基礎建設中扮演重要的角色，不過由於其重要性經常被忽略，以至於政府與國際組織在思考網路基礎建設的相關政策時，往往無法制定適當的政策來協助社群發展。

在 2025 年 10 月，網際網路名稱與數位位址分配機構（ICANN）下的網路安全與穩定諮詢委員會（SSAC）發布了 SAC 132 號報告，報告主題是《在自由與開源軟體上運行的網路域名系統》（The Domain Name System Runs on Free and Open Source Software (FOSS)）。本議程希望從這份報告出發，帶領參與者瞭解域名系統以及與域名系統相關的自由與開源軟體服務；並且更進一步探討若要制定政策支持這些開源社群與貢獻者，有哪些考量應該在政策設計的過程中被納入。並且盤點台灣目前的政策是否符合本報告提出的建議。

本議程也將一併介紹 ICANN 組織、會議與台灣的相關參與機會，包含由台灣網路資訊中心支持的 TWNIC Academy 活動，以及相關的參與經驗分享。

農業開放資料社群【COODFA】

(發音請唸「酷法」，Community of Open Data for Agriculture)

從2020年開始，我們舉辦了第一屆農業開放資料論壇，活動邀請農委會、農科院、農試所以及農業科技意見領袖分享農業、開放資料與數位轉型的推動理念。爾後每年舉辦一次分享會活動，邀請志同道合的朋友們，希望以社群的力量，推動台灣數位農業、資料科技、地方創生的的應用與實踐。

來來認識我們，當天憑活動通報名成功畫面，可兌換農業特色小禮物1份！

|傳送門| https://www.accupass.com/event/2607160232041416377213

社群聯絡窗口：阿柴、徐郁涵 | 社群聯絡信箱：[email protected]

2025 年 10 月，一隻名為 GlassWorm 的惡意蠕蟲病毒悄悄出現在數個 VS Code 的擴充套件市集，截至今日，該攻擊早已不斷演進並擴散至不同環境，累計入侵數百個套件與 repo ——攻擊對象不是伺服器，是各位開發者！

本議程將帶各位聽眾拆解 GlassWorm 的實際樣本與公開分析攻擊手段與手法，逐一解析它每一個工程決策背後的邏輯——不僅從一個開發者也看得懂，更是從開發者的角度來解剖這隻蠕蟲！

要考期中考？AI 沒過也會有這天。開發 Agent Workflow 時要怎麼分辨。表現變好是 Model 的功勞，還是好的 Workflow 帶來的功勞？這時就需要一套好的驗證方法：期中考！但是道高一尺，魔高一丈。你想得到的，AI 也想得到。上網作弊、偷看答案，只有你想不到，沒有 AI 做不到。本節的故事背景，是我們在開發開源 Agent Workflow 時，設計內部 benchmark 所碰到的各種大小事。

How do you evaluate the performance of an agent workflow? When things get better, is it the model doing the work, or the workflow itself? A good benchmark is like a midterm exam. It tells you who actually studied.
But AI is smarter than you expect. It will cheat by searching the web, peek at other answers, and find every loophole you forgot to close. AI always finds a way to surprise you.
In this session, we'll share the story behind building a benchmark for an open-source agent workflow. Every twist, every workaround, and every time the AI quietly outsmarted our test design.

前端工程師每天都在寫 JavaScript、串 API、操作 Canvas、處理 WebSocket，但這些能力真的只能用來做網站嗎？

如果有一天，你的程式不只是在瀏覽器裡執行，而是能控制即時影像、投影、攝影機，甚至打造互動展演體驗，會是什麼樣子？

這場分享將從前端工程師熟悉的 JavaScript 生態系出發，介紹如何結合 Canvas、p5.js、three.js、HTTP API、WebSocket 與 TouchDesigner，打造即時互動視覺與創意作品。我們不會深入 TouchDesigner 的每個節點，而是透過實際案例與 Live Demo，分享前端工程師如何利用既有的技能，快速踏入互動藝術與即時媒體創作的世界。

Ever dreamed of creating your own programming language? This talk walks through the real journey — from building a Mermaid-to-ASCII compiler as a warm-up, to designing Homun, a language that transpiles to Rust. You'll learn the compiler pipeline (tokenizer → parser → AST → codegen), why transpiling beats writing a full compiler, and the hard design lessons: auto-detection traps, syntax iteration pain, and why hemi-self-hosting keeps things sane. Practical takeaways for anyone curious about language design in the AI era.

The open-source chip design movement has long been limited by fragmented EDA tools and a lack of access to mainstream process nodes. In this talk, we present ECOS Studio, an integrated RTL-to-chip solution that combines an open-source EDA toolchain (ECC), an open IP library, and the newly released ICsprout 55nm open PDK. This end-to-end flow automates supply‑chain complexities so that users can focus on RTL design and receive functional silicon. We will share recent tape-out experiences, including the successful fabrication of a RISC‑V SoC (RetroSoC) on the 55nm process at 100 MHz, as well as a Multi-Project Chip aggregation scheme that shares the SoC environment across designs to lower per-design cost. We will also discuss how ECOS Studio is being deployed in the “One Student One Chip” education initiative, providing a zero‑configuration EDA environment to students. The talk demonstrates how the convergence of open EDA, open IP, and open PDK is bringing us closer to a future where silicon design is as ubiquitous as software.

Repo links for ECOS Studio: https://github.com/openecos-projects/ecos-studio
ECC: https://github.com/openecos-projects/ecc
ICS55 PDK: https://github.com/openecos-projects/icsprout55-pdk
retroSoC: https://github.com/retroSoC/retroSoC

scx_lavd is a sched_ext scheduler implemented in BPF — dynamically loadable at runtime without a kernel rebuild. It started in 2024 as a Linux gaming experiment for Valve's Steam Deck, and has since matured into a serious contender for server workloads. At Linux Plumbers Conference 2025, Meta engineers presented LAVD as a candidate default scheduler for their server fleet. This session would reveal its core design ideas and how recent development benefits cloud and server workloads — such as the cpu.max cgroup controller, IRQ-aware task steering, latency criticality propagation, and the task-size-aware load balancer. Beyond cloud, the same design supports power-aware mobile/edge deployments and hybrid CPU architectures — making LAVD relevant across cloud, automotive, and mobile vendors.

SITCON 2026 我們在 Ruby Taiwan 攤位放了一個現場用 Ruby 寫一行程式的小遊戲：Jekyll 靜態站 + ruby.wasm，在瀏覽器裡跑 Ruby 4.0。設計上很單純，工程上完全不是。

上線第一天我們發現：iOS Safari 整個卡住、Android Chrome 靜默 hang 在載入畫面、學生切到別的 app 回來題目就消失。最後這個跑了一千人的攤位，背後其實是三個讓我們改寫一半程式碼的手機瀏覽器地雷。

這場 talk 會帶你進到這個專案的引擎室：我們怎麼把 EXPECTED_MAP 整段砍掉、改用 rubyVM.eval + StringIO + srand(seed) 讓答案在前端即時算；中、英、日三語的 i18n 怎麼從 Liquid 一路注入到 JavaScript；7 題標準 Ruby 加 3 題 JS／Python／PHP 對照題的跨語言流程怎麼設計；以及那三個手機 bug 真正的 root cause 與修法。

適合對 ruby.wasm、前端 Ruby、或「怎麼把 Ruby 推到 Rails 以外」有興趣的所有人。

At SITCON 2026, the Ruby Taiwan booth ran a live coding game: a Jekyll static site + ruby.wasm 4.0, with students writing one-line Ruby in the browser. Simple in concept, brutal in practice.

Day one, we found out: iOS Safari froze, Android Chrome silently hung at load, students who switched apps lost their progress. The booth that served 1000 students was held together by fixes for three mobile-browser landmines.

This talk takes you into the engine room: how we replaced a giant EXPECTED_MAP with rubyVM.eval + StringIO + srand(seed) to compute answers in the browser; how zh/en/ja i18n flows from Liquid into JavaScript; how the 7 Ruby + 3 cross-language (JS/Python/PHP) format works; and the real root cause behind each mobile bug.

For anyone curious about ruby.wasm, Ruby in the browser, or pushing Ruby beyond Rails.

自從 ML-DSA 在 2024 年 8 月定案後，經過一陣子議題發酵與發展，我們陸續見到幾條區塊鏈開始進入製作 POC 與效能評估的階段。這場演講將分享近期後量子交易簽章（PQTS）的社群討論，檢視各區塊鏈如何在簽名大小、狀態膨脹、驗證成本及遷移路徑之間取得平衡，並以簡顯易懂的方式介紹數個較知名的解決方案。

農業數位與淨零轉型的現在進行式，由農業開放資料社群負責人阿柴現身說法，以上市櫃公司永續管理師的角度分享：企業如何規劃永續議題、跨域結合農業的機會、實務推動永續專案的心得。歡迎永續小白、尋求ＥＳＧ合作的農業人、以及單純想知道永續話題的聽眾入場交流。

open-slide 是一個專為 AI Agent 設計的開源簡報框架，讓 coding agent 用 React 寫簡報，而非被模板限制。

為什麼開發 open-slide？

現有 AI 簡報工具（Gamma、Canva、NotebookLM 等）多走「模板＋填字」或直接生成圖像路線，AI 生成文字塞進固定版型，好看但千篇一律，設計自由度低。open-slide 換了一個思路：簡報本質是視覺化的程式碼，Agent 擅長寫程式碼，所以 open-slide 提供的是 slide 的 runtime，讓 Agent 在簡報限制的範圍內，完全自由地生成視覺與資訊內容。

這個專案教我的四件事

1. 記下每一個靈感：隨手記錄的念頭，就是未來作品的種子
2. 先做再想：動手本身就是最好的解法
3. 主動讓作品被看見：Threads 經營本地能見度，X 接觸國際社群
4. 勇敢用英文交流：一則開源貢獻可能成為最重要的連結

如果你也有一個放在心裡很久的靈感，希望這場分享能成為你按下「新增專案」的推力！

Automotive Grade Linux (AGL) is a collaborative open source project hosted by the Linux Foundation, building a common Linux-based software platform for automotive systems. This session introduces AGL through its recent evolution. After a brief overview of the project and its community, the talk highlights key updates from the past year to show how AGL is expanding beyond its original scope.

Two initiatives illustrate this direction. SoDeV (Software Defined Vehicle reference platform) explores software-first development through virtualization and hardware abstraction, improving portability and enabling experimentation across environments by leveraging promising open source projects such as Xen, Zephyr, and VirtIO. AGL Assessment Automation (AAA) applies modern open source security and supply-chain practices—originating in the cloud-native ecosystem—to large and complex automotive supply chains, addressing challenges common across embedded systems industries worldwide.

Rather than focusing on industry-specific use cases, the session emphasizes the technical ideas and open source practices behind these efforts, and concludes with a look at where AGL is heading and how developers can get involved.

In terms of protecting sensitive data during execution across diverse cloud environments, typical container isolation mechanisms frequently fall short. While traditional security secures data at rest and in transit, the "data-in-use" gap remains leaving memory and running processes vulnerable to a compromised host, hypervisor, or rogue administrator. Without requiring changes to application code, Confidential Containers (CoCo) is a potent open-source technology that makes it possible to isolate workloads safely and effectively using hardware-based Trusted Execution Environments (TEEs). This session examines how memory encryption, remote attestation, and hardware-level isolation offered by CoCo might improve zero-trust security on Ubuntu systems. Measures like standard Linux namespaces and cgroups are less efficient against contemporary infrastructure-level attacks as a result of the sophistication of modern cloud-native threats. By offering a cryptographic method of isolating system memory without compromising cloud flexibility, CoCo tackles these issues. And CoCo is a crucial tool for contemporary data privacy and compliance since it can protect proprietary code, AI models, and sensitive payloads by executing them inside hardware-attested utility VMs on the Linux kernel.

The talk will focus on the integration of Confidential Containers with Ubuntu, highlighting Canonical’s and the broader open-source community's ecosystem support for TEE-backed virtualization such as Intel TDX and AMD SEV-SNP. Will also include practical demonstrations of CoCo deployments on Ubuntu, showcasing how to use the open-source CoCo Operator for running encrypted pods, managing remote attestation, and preventing unauthorized host-level access to container memory. We will walk through real-world examples of deploying hardware-isolated workloads using CNCF tools such as Kata Containers and the Confidential Containers project alongside Ubuntu's MicroK8s, demonstrating how they enforce a true zero-trust architecture in modern cloud infrastructures.

Participants will have a thorough grasp of how to use Confidential Containers to improve data-in-use security in Ubuntu environments by the end of this session. They will acquire hands-on experience in deploying CoCo for memory encryption, hardware-based workload isolation, and cryptographic attestation, allowing them to leverage this potent technology in their own infrastructure strategies and actively champion advanced cloud security within the Ubuntu ecosystem.

Wikidata 收錄了超過 1.2 億個條目，其中最大宗的資料竟然是學術文章，比例高達百分之二十而筆立第二高內容：人，僅占百分之六。

在 Wikidata 中收錄的學術文章內容，臺灣的佔比相當稀少，早在李梅樹紀念館、新樂園藝術空間以及客家開放資料等合作專案中，建立相對應主題的文獻編目收錄在 Wikidata 中也是其中一個工作目標之一，這也促進了許多 Wikidata 中臺灣主題資料同時也有對應的文獻內容可以相互連結，提高不同領域資料「偶遇性」，進一步提高文獻資料的可用性與可檢索性。

本次分享將以 Lightbox 攝影圖書室 Wikidata 合作案、故宮博物院期刊文章 Wikidata 合作為案例，分享文獻編目的實務操作以及文獻資料轉進 Wikidata 的實體效益與應用可能。

Bare-metal provisioning tools speak a language that virtual machines simply don't understand: IPMI and Redfish, the protocols of physical Baseboard Management Controllers (BMCs). Yet in today's cloud-native landscape, there's a very real need to run those same provisioning workflows against virtualized infrastructure: for development, testing, CI pipelines, and beyond.

In this talk, we'll introduce KubeVirtBMC, an open-source, cloud-native project that gives KubeVirt VMs virtual BMCs, exposing IPMI and Redfish endpoints so that existing bare-metal provisioning stacks, whether cloud-native or not (Metal3, Tinkerbell, Foreman, and others), can interact with virtual infrastructure without any modification. Think of it as the Kubernetes-native counterpart to VirtualBMC, but built from the ground up around the Kubernetes controller pattern.

We'll walk through the architecture, demonstrate a live integration with Metal3/Tinkerbell, and discuss project governance, including lessons learned from navigating the migration into the KubeVirt organization.

Tridactyl 是能全鍵盤操作瀏覽器的 Firefox 擴充元件，類似於 Vimium，但他的能力遠不只於此。

Tridactyl 有任意執行 js 、呼叫 WebExtensions API 的能力，核心的 vim 風格操作介面、 ex 指令列，搭配上極為開放的 API，讓 Tridactyl 幾乎可以取代大多數的擴充元件、油猴腳本、 bookmarklet。

Tridactyl 更是一款讓 js 開發者能完全掌握瀏覽器的擴充元件，有了他，不再需要在開發者工具裡貼貼剪剪程式碼片段，原本只是臨時寫就的程式碼，可以直接記憶到 vim 風格的快捷鍵組合，或是單純儲存為 ex 命令。tridactyl 讓 js 開發者能將自己對程式語言的理解，實際融入瀏覽器的日常使用當中；此時正是 JS 開發者賦權的時刻！

Supporting right-to-left (RTL) languages such as Arabic and Hebrew remains an often overlooked challenge in web application internationalization. Unlike English and Chinese, which are written left to right (LTR), RTL languages require layouts and visual alignment throughout the user interface to be mirrored.

Redmine, a 20-year-old open source project management application, has supported RTL languages since 2010. Its RTL support was originally implemented using a separate RTL-specific stylesheet that overrode the main LTR styles, which was a common approach at the time. As the user interface evolved, maintaining two parallel stylesheets became increasingly difficult, and the RTL layout gradually became broken in many places.

In this talk, I will explain how I rebuilt Redmine's RTL support using CSS logical properties. By replacing physical properties such as margin-left and padding-right with logical properties, a single stylesheet can automatically adapt to both LTR and RTL layouts. I will discuss the migration process, practical implementation techniques, and lessons learned while modernizing an existing codebase.

Attendees will learn how existing LTR-only web applications can gain RTL support with a relatively small set of CSS changes. Through practical examples from Redmine, they will learn concrete techniques for implementing maintainable RTL support using CSS logical properties. Although the examples come from Redmine, the approach is applicable to many web applications looking to add maintainable RTL support.

為何你的臉書帳號會無故被封鎖？為何會被降觸及？詐騙留言、詐騙貼文為何層出不窮，政府、平台難道不管管嗎？這些都是平台治理的核心問題。但是在這之前，使用者（或消費者）對於平台審查演算法可說是一無所知。另一方面，平台並不會主動揭露自己的排序或審查演算法，因為這將會讓惡意帳戶攻克平台築起來的防詐城牆。因此開源與封閉排序與審查演算法，可說是都有理由。

本次討論將揭露華文抗審查文章平台 Matters 的審查演算法，我們同時將演算法開源，且進一步開放違規內容的資料庫，同時進行平台治理的社群實驗。目的在於讓有興趣參與台灣平台治理的開源貢獻者，能提早一步理解平台營運者怎麼思考這些問題，讓未來平台治理的倡議可以更加落地。

ZeroTree 是一個結合心理學與遊戲化技能樹的目標管理專案，最初是我為了解決自身拖延症與思緒過載而打造。本議程將分享我如何以極限的「兩週挑戰」為起點，從零開始將 Twinkle AI 專為台灣語境打造的 4B 模型（gemma-3-4B-T1-it）落地整合到 ZeroTree 中，以「心情日記」為核心，打造出具有開源社群與鄉民幽默感的「星光型小零」AI 陪伴原型，【並歷經數月持續打磨迭代】。這是一場本地小模型（SLM）【從原型到落地】的實戰紀錄。我將深入分享在本地端整合時遇到的四大挑戰與解法：包含如何解決小模型容易照抄 JSON 範例的格式問題、如何優化 System Prompt 避免動態資訊導致 CPU 推理延遲（提高 KV Cache 命中率）、如何在無獨顯的筆電上利用量化與 UX 設計彌補等待感，以及不綁定帳號的樹洞型專案該如何設計匿名隱私防護機制。

flutter_gemma started as a thin wrapper over MediaPipe for running Google Gemma on Android and iOS. Today it's a full-fledged platform for on-device AI: 6 platforms (Android, iOS, Web, macOS, Windows, Linux), 2 inference engines, multimodal support, function calling for local agents, and on-device RAG with vector search. The plugin has been featured by Google AI for Developers.
In this talk, we'll walk through the evolution via key engineering decisions. How adding Web platform forced us to rethink file handling and led to sealed classes instead of string URLs. Why we had to spin up a gRPC server in Kotlin with a bundled JVM for desktop — and how to automate the build through Xcode build phases. How the Strategy pattern allowed us to add a second inference engine (LiteRT-LM) without rewriting existing code, and how the Adapter pattern helped reuse the MediaPipe implementation. Why we needed chunk buffering for engines with fundamentally different APIs.
We'll dive deep into on-device RAG: how to build a SQLite VectorStore that works identically on mobile and in the browser via WASM. I'll show real bugs and their fixes — from Web hot restart crashes to iOS Simulator limitations with vision models.
The latest addition is genkit_flutter_gemma — a bridge to Google's Genkit for Dart that enables hybrid AI pipelines. Now you can seamlessly combine on-device inference with cloud-based models in a single Genkit flow: run lightweight tasks locally for speed and privacy, and escalate complex reasoning to the cloud — all orchestrated through one unified pipeline.
Every architectural decision in flutter_gemma is an answer to a specific problem. Minimum theory, maximum code, diagrams, and stories of "how it broke and why it looks like this now".

Covering indexes, partial indexes, access methods, operator classes, Index-only scans... Indexes in PostgreSQL are extensible and have a lot of features, so it's not always easy to know how to best use them or when not to use them.

In this talk we will cover multiple areas of indexing, giving example scenario example and best practice to highlight their use cases, and general improvements around indexes in the recent releases.

We will also cover some extensions around indexing, including hypopg that allows you to create hypothetical indexes to help you decide whether an index should be created or not, and other external tools to detect various problems around indexes.

Everyone talks about prompts, models, and RAG. This talk is about what I call the other 80 percent: the integration work required to turn a convincing model response into a dependable product. Production systems must authenticate a real user, reach the correct account, route events from different channels, run on schedule, and explain what happened afterward.

Drawing on lessons from Alfred, a multi-agent orchestration platform, this talk presents the integration layer as a set of operational contracts. A live public demo sends the same task to the same OpenRouter model on two plain pages. One has no inbox or tools. The other uses three constrained tools over a synthetic inbox and records a verified draft. We use that controlled difference to examine OAuth token lifecycles, multi-user credential ownership, declarative Slack, Telegram, and web routing, schedules as normal agent runs, and observability for cost, tool calls, subagents, and delegation failures.

The demo is intentionally not Alfred and contains no production integrations. Attendees leave with a framework-agnostic checklist for deciding what to own, constrain, verify, and record before an agent touches the real world.

Microsoft Agent Framework 是 Microsoft 在 Semantic Kernel 與 AutoGen 之後推出的開源 AI Agent Framework，結合 Agent、Tool Calling、Handoff Orchestration 與 Graph-based Workflow Runtime 等設計。本次演講將以 Microsoft Agent Framework 為主角，深入剖析其原始碼，觀察 Agent 如何包裝 instructions、tools 與 model client，Handoff 如何轉移控制權，以及 WorkflowBuilder、Executor、Edge、Runner、Checkpointing 如何支撐多步驟與多 Agent 協作。OpenAI Agents SDK 與 LangGraph 將作為參照，用來比較 model-driven agent abstraction 與 graph workflow runtime 的設計差異，進一步討論 Microsoft Agent Framework 是否可被視為 "LangGraph for Enterprise"，以及它在開源 AI Agent Framework 生態中的設計定位。

Folding schemes 是在 zk 證明系統中會用到的技術，能把很多可驗證的計算合併成一個，這樣證明時只需要對一個 instance 做證明即可。原本的 folding schemes（Nova、HyperNova）是基於橢圓曲線（離散對數問題），因此未來容易受到量子電腦攻擊。Lattice-based folding scheme 主流是基於 Ajtai 承諾（SIS，Short Integer Solution 問題），目前沒有已知的量子演算法能有效破解。

Ajtai 承諾需要秘密值（witness）是 low-norm 才能保持 binding，以確保承諾真的是對應到該秘密值而不是另一個值。但是，在做 folding 時秘密值的 norm 會不斷增長，我們必須確保 1) 一開始承諾的秘密值就是 low-norm、2) folding 後的秘密值必須保持 low-norm。我們分別用 norm check 解決 (1)、decomposition（進制分解）解決 (2)。

講者會分享他在一個讀書會中學到的 lattice-based folding （ github.com/coset-io/baby-lattice-folding ）相關的知識，希望能讓觀眾理解這些技術的一些背景及直覺。

隨著開源軟體成為現代軟體開發的重要基礎，供應鏈攻擊也逐漸從惡意套件、開發工具、套件管理平台，到企業內部的開發流程，形成多層次的安全挑戰。面對持續演進的攻擊手法，企業與開發團隊應如何降低風險，並建立更完善的防護機制？

本場 Panel 將由主持人引導討論，邀請多位來自不同領域的專家，從研究、實務經驗及企業治理等不同角度，分享對開源供應鏈安全的觀察與見解。透過與談交流，深入探討最新攻擊趨勢、實務案例，以及企業在風險管理、開發流程與安全治理上的因應策略，並與現場觀眾一同交流，共同思考開源供應鏈安全的未來方向。

Consumer IoT devices, such as digital photo frames, often rely on heavy operating systems (like Android) and touchscreens just to handle basic setups like Wi-Fi and API configurations. This approach not only complicates the hardware design but also limits the device's lifespan—once OS updates stop, the device often becomes obsolete or a security risk.

"Tac Photo" is an open-source digital photo frame project that takes a different approach. By using an ESP32-S3 running FreeRTOS instead of a heavy OS, the device remains lightweight and functional over the long term without requiring frequent software updates.

To configure the device without a screen, we separated the setup process from the hardware itself. Users configure their settings (Wi-Fi credentials, cloud sync) on a smartphone app, which encrypts and writes this data to a standard passive NFC card. Tapping this physical card to the frame updates its state instantly.

In this session, I will share the architecture and practical lessons learned from building this system. Participants will explore:

1. Hardware-Software Integration: Using standard NFC to shift complex UI tasks to a smartphone, leaving the hardware simple, single-purposed, and easy to maintain.

2. Headless Cloud Connections: How to securely transfer encrypted OAuth refresh tokens via NFC to connect to cloud services (like Google Photos) without a device-side browser.

3. Longevity & Right to Repair: How choosing an RTOS over a full OS, combined with a minimalist, open hardware design, aligns with the Right to Repair movement, empowering users to customize and fix their own digital appliances.

This talk provides a practical framework for developers looking to build simple, repairable, and long-lasting IoT devices using FOSS tools.

AI coding agents are the new "high-speed interns" of the Ruby world. They can be eager and fast, but leave them unconstrained and you risk wrecking your system. Tie them up too tight and they'll end up hallucinating instead of producing results.

The answer isn't more documentation or prompt engineering; it’s a better contract.

In this talk, we’ll explore how Nix - the functional, deterministic package manager - serves as a bridge between human developers and AI agents. We will move beyond the "it works on my machine" era into the "it works in the contract" era.

We'll discuss how a Nix Flake acts as a shared mental model: a declarative, cryptographic receipt of every dependency, compiler, and system library your project requires.

We will dive into:

• The Bundler Analogy: Translating Nix concepts into a language Rubyists already speak (Gemfile → Flake, Lockfile → Lock).
• Effectiveness through Shared Context: How to use Nix to ensure your AI agent has the exact tools it needs (like ruby-lsp or specific C-extensions)
• Security as an Enabler: Using Nix in tandem with Docker to create "principled sandboxes." We’ll look at real-world patterns from my opensource AI sandboxing tool.
• The "Double Gemfile" Pattern: A practical tip for managing dev-only gems and agent-specific tools within a Nix-based workflow.

By the end of this session, you’ll see that Nix is a powerful tool for the modern Rubyist to build secure, reproducible, and highly effective environments where humans and AI can collaborate without the chaos.

「為什麼遊戲又突然卡了一下？」的答案往往並非 CPU 不夠快，而是 CPU 排程器把運算資源分給那些遊戲玩家根本不在意的背景任務。

Linux 的 EEVDF 排程器以 fairness 為主要目標，並透過 EWMA 估計負載。然而，fairness 不等於流暢體感、EWMA 只能反映短期變化，因此延遲敏感的工作負載常出現不穩定的表現。scx_teddy 是一款針對遊戲場景、建構在機器學習之上的 CPU 排程器，利用 Linux v6.12+ 引入的 sched_ext (SCX)，其目標不是要求使用者手動指定重要任務，而是讓系統自行辨識哪些是影響遊戲流暢度的關鍵操作、哪些只是可退讓的背景任務，進而依據遊戲期望調整。

本系統會在 Linux 核心內部長期觀測任務行為特徵，如 runtime、sleep、iowait 等，再於使用者層級藉由 K-means 進行非監督式分群。完成分類後，scx_teddy 便可依據針對遊戲情境設計的 cluster policy，動態調整優先級、time slice，以及是否獨佔處理器。

本議程將介紹 scx_teddy 的設計與實作，包括：
* 為何選擇 ML，而非規則式分類
* 特徵工程與行為指標的取捨
* eBPF 與 user space 的資料管線設計
* 與既有 SCX 排程器（如 scx_cake）的差異與實驗結果

目標不是追求更高的 benchmark 分數，而是讓系統真正理解：哪些工作會影響玩家體感，哪些則不值得搶佔遊戲的執行時間。

NotebookLM 是非常有用的 AI 學習與內容轉換工具，但在語言、流程控制、輸入格式、在地化需求與可客製化程度上，仍有不少限制。與其等待平台功能逐步完善，不如嘗試用開源方式打造一個更符合特定場景的替代工具。makeslide 是一個語音簡報生成與播放系統，目標是讓使用者可以從 PDF 或簡報大綱出發，自動產生可播放的語音簡報。系統目前可接受 PDF，將頁面轉為圖片並抽取文字；也可以接受以 ## Slide XX 分隔的簡報大綱，進一步產生投影片圖片、逐字稿與語音內容。目前專案以繁體中文為主要支援語言，後端採 Fastify 與 TypeScript，前端使用 React、Vite 與 Tailwind，並提供上傳、處理、查詢與播放所需的 API 與處理管線。

本議程將分享 makeslide 的設計動機、系統架構、PDF 到語音簡報的處理流程，以及開發過程中對 NotebookLM-like 工具「可自建、可修改、可在地化」的實作經驗。

本議程將介紹 OpenWRT ，一套開源的路由器作業系統。我將跳過基本的網路設定，介紹一般家用路由器不提供，但可以利用一點 OpenWRT 設定就做到的各種方便、安全、隱私功能。

• 挑選支援 OpenWRT 的硬體
• VLAN 、訪客網路及危險設備隔離
• 多個 WAN （白話：如何把電信商給你的多個 IP 用好用滿）
• 策略路由、site-to-site VPN
• 危險 IP 及域名阻擋
• 特殊上游網路：VPN 供應商、TOR

Oeee Cafe is an oekaki service for the 2020s.

Naru is like Neocities, but for Koreans.

I launched these two projects without any social networking functions, but they now ship with a Fediverse experience.

I'll be outlining how I started these web services, and how it gained Fediverse capabilities.

Interested in running your own Local Ubuntu community (which is called Ubuntu Circles)? Or would like to connect with folks who run Ubuntu Circles in their city? Join this BoF to learn what is it and how to start your own and practices from other Ubuntu Circles leaders.

More info: https://events.canonical.com/event/146/contributions/930/

少數而且有經驗的開放街圖圖客會用功能強大的 JOSM 來編輯，但 JOSM 的一些套件也許沒有經常更新或是說明文件並不足夠，特別是 Scripting 插件。而藉由時下流行的大語言模型，如 ChatGPT，講者能夠找出能夠運作的 Python 在 Java 下的 Jython 腳本程式碼，並且能夠當上驗證是否能運作。先從能夠輸出除錯訊息，弄出取代原先不會輸出訊息的 print 指令的函式開始，再來是撰寫出能夠直接處理 OSM 標籤的尋找與取代功能，模仿類似的編輯工具 Level0。這一場次將會分享目前講者的經驗，使用 JOSM Scripting 所遇到的困難與挑戰，如何讓 JOSM Scripting 再次可以運作。

三小文創股份有限公司是「小人物、小土地、小滿足」的意思，我們從雲林出發，持續建立值得消費者信賴的品牌，成立十二年來，以市集、實體店面、電商、自媒體等之形式拓展客群，並開發自有品牌商品、發行雲林食通信雜誌、推出企業CSR好田計畫等，成為一個在地食農交流平台，讓生產與消費關係更正向地互動，目標讓生產者專心耕種、轉型友善栽培方式並獲得合理收入，讓在地農業與土地得以永續經營。

你以為「乾淨」的微調資料就是安全的嗎？最新研究指出，僅僅 100 筆來自 Dolly、Alpaca 這類良性資料集的樣本——表面無害、卻帶有有害梯度方向的 Benign Outliers——就足以讓一個對齊過的 LLM 安全防線全面崩潰，而且完全不需要外部惡意資料當錨點。
本場分享將以 Twinkle AI 開源的 gemma-3-4B-T1-it 為實驗對象，帶大家走過一次真實的攻擊與防禦：如何用 Self-Inf-N 從繁中良性資料中挖出這些「隱形地雷」、它們在連續學習場景下有多難消除，以及 SafeGrad、AsFT 這類梯度約束防禦方法到底擋不擋得住。
適合對 LLM 安全、微調、開源模型治理有興趣的開發者與研究者。

In the southern state of Kerala in India, every government school runs a distribution named KITE (previously IT@School), based on ubuntu, in IT labs. Thanks to this, we grew up being familiar with linux and ubuntu, although we were not aware of the importance of all this as students. This will be an introduction to IT@School, and the importance of free software education from a young age.

More info: https://events.canonical.com/event/146/contributions/955/

This is a continuation from my talk that I gave at UbuCon Asia 2025: https://events.canonical.com/event/127/abstracts/838/

This time, I want to host a workshop where I'll walk people through the steps on how to setup Ubuntu server from scratch for self-hosting. I'll start with setting up an LXD VM with Ubuntu server. I'll walk through securing the server using firewall, fail2ban and other things. I'll then cover setting up a reverse-proxy like nginx and then host a simple web application on it. If time permits, I can also cover setting up podman for containers. I can also go a bit deep into the concepts and cover the basics of routing and tunneling as well.

Requirements from attendees:

• Laptop.

• It would be great if they could setup LXD on their device (I'll walk people through this if most of them aren't familiar with LXD.)

• It would be great if they could pre-download the Ubuntu server ISO (https://ubuntu.com/download/server).

More info: https://events.canonical.com/event/146/contributions/945/

Large language models are good at generating text, but can't easily report discrete, dynamic, and always-accurate results. They also can't take external actions. The model context protocol (MCP) has become the standard way for generative AI models to access external data and take external actions. This talk explains the purpose of MCPs, how they are used, and shows examples of database and non-database MCP servers.

In this talk Flo will introduce the Eclipse Foundation which has started a Software Defined Vehicle Working Group. Members like Mercedes, Cariad, Bosch, Continental, and many others are already working together on a fully open source and commercially usable SDV Software layer, enabling faster innovation and reusability of base blocks. We will introduce the Eclipse SDV initiative and why this open source approach will help the worldwide car industry to enable the Software Defined Vehicle. We will highlight the achievements of this young initiative as well as critically asking why open source may not be enough to make this worldwide collaboration happen.

實作伺服器端推播，直覺第一個想到的通常是 WebSocket，但自行維護 WebSocket 並不簡單：你需要處理 ping/pong 心跳、連線管理、斷線重連，在微服務架構下還要決定由哪個服務負責維護這些狀態

我們在生產環境中使用 Centrifugo 將近一年，用來處理檔案上傳後的即時進度通知。這場分享會介紹我們如何導入這套開源工具，讓後端只需呼叫一支 RESTful API 就能推播訊息給對應的客戶端，不再需要自己管理 WebSocket 連線

內容涵蓋：
- Centrifugo 的基本概念與 channel 機制
- Server 端設定與啟動
- 後端整合方式（以 RESTful API 推播）
- 前端 SDK 連線與訂閱
- 實際導入的心得與注意事項

GPUs are expensive. Kubernetes doesn't share them well yet, DRA is still work in progress.

HAMi: Heterogeneous GPU sharing for Kubernetes.

What I'll Tell You:

How it hijacks CUDA calls without touching your app code
Why memory isolation matters
Some real production use cases
Real Results: Teams cut GPU costs 40-60%

Who Should Show Up: K8s operators, platform engineers, anyone watching GPUs sit idle

github.com/Project-HAMi/HAMi

WebXR is a collection of APIs to interface with mixed reality consisted with Core API and feature specific modules, and enables you to provide 3D experience by managing the process of rendering 3D context, handing inputs from mixed reality hardware, and providing domain specific feature such as anchor or layers for projecting scenes.
Since 2018, set of specifications are developed under the Immersive Web groups of the W3C, having a Candidate Recommendation status, and implemented in Chrome and various 3D headset devices.

WebXR APIs has been evolving to enable new hardware and sensing features, and to introduce new software features for both making widely used concepts into core specification and reducing pain points to use APIs in real space.

In this talk, following brief introduction and recent updates of WebXR specifications including bringing specifications to the W3C Recommendation, I will pick three emerging topics in WebXR field in detail.

First is 3D rendering processing, initially WebXR was built over WebGL to generate stream of 3D view, but direct use of GPU is desired and now under implementation.
Second is spatial context, which enables you to connect physical space with virtual space, such as placing and handling virtual objects in physical space as if handling as physical objects over multiple mixed reality hardware, or shaing physical positions among devies.
Thrid is model element to bring 3D assets as core media in the Web.

Firmware underpins system security but remains challenging to verify due to hardware dependency, specialized coding idioms, and limited open-source examples. Manual verification approaches, while common in industry, are labor-intensive and difficult to scale. This paper presents a detailed case study on applying automatic formal methods for software to a security-critical firmware component in Intel Trust Domain Extensions (TDX), known as TDX Module. In this study, we employ six state-of-the-art C-program analyzers on the production TDX Module firmware, leveraging techniques ranging from bounded model checking and symbolic execution to abstract interpretation. Our empirical evaluation identifies obstacles unique to firmware, highlights harness-design decisions essential for verifying industry-scale code bases, and demonstrates opportunities in advanced slicing for more scalable verification. Although the case study focuses on TDX Module, the findings are broadly applicable to large-scale, low-level programs and have already influenced the software-verification community, such as standardizing nondeterministic object initialization. All verification tasks and proof harnesses are publicly released to foster reproducible research and future tool development.

AI模型的文化盲區─探討AI測試標準的開源現況觀察與難題

目前的 AI 模型雖具備高度的技術流暢性， 但長期局限於西方觀點的現狀，缺乏對全球語言多樣性的理解，導致模型在面對非西方語境時容易產生判斷失誤，看似無害的文字與影像結合卻可能觸犯特定文化禁忌，為了彌補這一文化盲點，一個名為 AI Luminate 的計畫產生。由開放式 AI 工程聯盟MLCommons 主導，涵蓋印度、新加坡、韓國、日本、孟加拉、台灣等不同團隊，透過團隊開發「多模態安全測試套件」AIRR Multimodal ，來提升模型對多語系環境中社交與商業細微差異的應變能力。透過這種跨國界的合作評估來確保 AI 能在多元的現實世界中，具備文化智力與全球適用性的安全基準，成為對數十億使用者均安全且有效的知識介面。

但實際上人工智慧在處理多元文化語境與安全性評估時，往往在理解非英語使用地區的社交禁忌與文化細微差別上表現不佳，在面對非西方背景的情境容易產生判斷失誤，存在極高的漏報率。要如何使AI 的能真正理解多元文化語系背後的文化意涵與潛在衝突，打造具備文化智商的全球化 AI，是目前所面臨的嚴峻挑戰。

Feder is a Rust framework for building ActivityPub applications from a portable protocol core and platform-specific runtimes. The project grew out of my work in the Fedify ecosystem and from a question that kept coming back: what would it take for a Fediverse server to become smaller, cheaper, and more portable than the usual VPS-based web application?

One motivating image was a single-user ActivityPub server as a physical device — something you could plug into power and Ethernet. Pushing that idea further led to a more difficult question: could parts of a Fediverse server run on embedded hardware such as ESP32-class boards, closer to sensor-network devices than conventional servers? Feder does not assume that a full Mastodon-like server can simply be moved onto a microcontroller. Instead, it asks how ActivityPub software should be decomposed when different machines have very different resources.

Feder separates ActivityPub protocol logic from platform execution. The core is responsible for federation behavior such as inbox/outbox state and delivery decisions, while runtimes take responsibility for networking, storage, clocks, and execution. The same core should work with different runtimes depending on the target environment: a Linux runtime for development and testing, and eventually more constrained runtimes for embedded devices.

This separation changes how "lightweight" is understood. It is not just about removing features, but about drawing clear boundaries between protocol behavior, storage, networking, scheduling, and hardware-specific execution. The first step is a Linux proof of concept: a small single-user ActivityPub server used to validate the framework before moving toward constrained runtimes.

The goal is not to present a finished server, but to share what it means to design ActivityPub as a portable engine rather than a monolithic application. Feder is still early-stage, but its direction is clear: one ActivityPub core, many runtimes — and the question of what kinds of Fediverse software become possible when federation logic can be separated from the machine it runs on.

在這個議程中你將遇到...
🎭 可愛又迷人的反派角色 Accept-Language
✉️ 叫 mobile dev 傳 locale，卻收到謎之怪值...
🧑 反派大魔王 UGC

UXN is a stack-based virtual machine designed by the Hundred Rabbits. It's small enough to fit in a single C source file, and simple enough to be ported across a wide range of platforms, including GBA, Nintendo DS, DOS, PlayStation Vita, Raspberry Pi, and many more.

UXN is minimal but not limited. Paired with the Varvara devices, it can support games, drawing tools, editors, and even a graphical operating system.

UXN is simple and hackable, which makes it a useful way to learn the fundamentals of virtual machine design. This session will walk through the specification, including opcodes, memory layout, and device I/O, and then examine the reference implementation, uxn2.

This isn’t your typical technical talk. We’ll take you on a step-by-step adventure, starting from a humble single database in a container and adding components one by one, just like we did. You’ll witness firsthand how we tackled real-world challenges, from storage and scaling to monitoring and UI design, to create OpenEverest - CNCF Sandbox project.

You’ll walk away with a deep understanding of how Kubernetes can be used to orchestrate complex and stateful applications (like databases clusters).

Join us and discover how you can break free from vendor lock-in, save costs, and build a database that’s truly yours. This is your chance to learn from our triumphs and tribulations, and be inspired to create your own open source success story.

零知識證明（Zero-Knowledge Proofs, ZK）讓我們可以「證明一件事是真的」，但不需要公開背後的敏感資料。它正在成為隱私保護、區塊鏈擴容、數位身分與可驗證運算的重要基礎技術，而且許多關鍵工具與協定都在開源社群中發展。

這場分享會用非技術背景也能理解的方式，介紹 ZK 的核心直覺與入門技術概念：什麼是 proof、prover、verifier、witness、public input，ZK 如何把一個問題轉成 circuit 與 constraints，以及 completeness、soundness、zero knowledge 這些基本性質代表什麼。

我們會用簡單例子，例如證明自己超過 18 歲、Where's Waldo 與 Sudoku，說明「證明知道答案」和「不公開答案」如何同時成立。接著會看 ZK 在今天的實際應用，包括私密交易、匿名投票、ZK rollups、身分證明、選擇性揭露與可驗證運算。

本分享不需要密碼學或數學背景。聽眾離開時，應該能用簡單語言解釋 ZK，理解基本技術組成，判斷哪些問題適合用 ZK 解決，並知道如何透過開源文章、工具、專案與社群開始學習、實驗或貢獻。

當前主流編譯器，真的適合 xPU 嗎？

以 Google TPU、Meta MTIA、Tesla Dojo 等為代表的新一代 AI 加速器，多採用 RISC-V + Tensor Core 的混合架構，試圖在靈活性與性能之間取得平衡。表面上，這讓開發者可以沿用 LLVM 等成熟工具鏈，避免從零打造編譯器。

但實務上，問題剛好相反。

xPU 的效能關鍵，往往來自對硬體細節的極致掌控：memory layout、DMA、pipeline、register usage——這些都難以透過通用編譯器自動最佳化。開發者最終仍回到大量 inline assembly，與工具鏈「對抗」，而非協作。

這場分享將從這個落差出發，重新思考編譯器的角色：如果最佳化邏輯本質上是 hardware-specific，是否應該被重新定義？

在被 LLVM 折磨兩年之後，我做了一個選擇——既然大型語言模型已經能生成編譯器，那為什麼不從零開始，打造一個真正理解 xPU 的 C++ 編譯器？

世界各地因為區塊鏈洗錢的問題頻繁導致各國政府開始參考並引入區塊鏈防洗錢法案避免國際犯罪，他們的共同特色就是定位使用者本身。 而台灣稱為虛擬資產服務法已在 2026 年 4 月 2 日通過，台灣人的身份被如何定位也將逐漸會成為台灣虛擬資產持有者關注的議題。

本次議題將會分享現代大家都用了哪些開放的標準去實現身份定位，以及討論密碼學術界對區塊鏈產業帶來的正面技術影響。

年齡驗證與網路自由一定會兩極對立嗎？線上年齡驗證為國際法規發展趨勢，唯其議題複雜性高，倉促強制推行或未評估技術方案可行性，皆可能造成無效的政策或無益於新興密碼學技術發展。本議程將分析關於數位身分驗證的技術方案，尤其是歐盟正開源發展之年齡驗證 App，以利政策制定者、倡議者或反對者，共同釐清年齡驗證與網路自由的邊界。

用Antigravity 2.0 /IDE 打造你的 Telegram 智慧小助手 (Telegram Assistant Bot) - 5 Labs Series
English Summary below

本專案是一個循序漸進的 Telegram 機器人（智慧小助手）開發教學與範例專案。專案共劃分為 5 個獨立可執行的 Lab 目錄，展示如何從零建置一個整合 Google Gemini 3.5 Flash 與 Imagen 3 的智慧助理。

📂 專案目錄結構 (Lab 規劃)
本專案採用功能遞增的方式，每個 Lab 都是一個完整且可獨立執行的專案：

📂 Lab 1: 基礎 Bot 框架
建置 Telegram Bot 連線、基本指令（/start 與 /help）與 Echo 訊息回覆。
📂 Lab 2: AI 簡報生成器
串接 Gemini 3.5 Flash 生成結構化大綱，並使用 python-pptx 自動繪製簡報（支援 Light/Dark 主題設定）。
📂 Lab 3: AI 圖片生成器
串接 Gemini Imagen 3 圖片生成模型，提供 /draw [比例] <描述> 指令，支援 1:1、16:9、9:16、4:3、3:4 等多種長寬比。
📂 Lab 4: AI 圖像修改器
上傳圖片至機器人，機器人會進入等待指令狀態，呼叫 Gemini 多模態與 Imagen 3 協同為您修改原圖並回傳。
📂 Lab 5: 個人隨手筆記本 (最終版)
引入本機 SQLite 資料庫儲存個人筆記，並實作 /addnote 與 /notes。清單底部提供內聯按鈕（Inline Keyboard）非同步、無縫刪除個別筆記。此 Lab 為功能最完整的終極版本。

This is an advancement on a presentation I had previously delivered with regards to atomic Linux distributions found here.

Over the past couple of years, immutable & atomic Linux distributions have made significant strides in day-to-day usability and practicality; yet, there remains comparatively little in the way of low-level explanations with regards to how these mechanisms are implemented under-the-hood, in spite of the extent to which such attributes are desired on other, existing distributions.

The intention of this presentation, then, is to demonstrate one such implementation of atomicity within a desktop Linux distribution I maintain - blendOS - and explore how we went about implementing support for varying distribution bases (among them Ubuntu), alongside how one may develop such an implementation for their own distributions, in an attempt to ease existing systems into such a paradigm.

介紹如何以 GPU 和 NPU 在地端跑 LLM 模型推論運算的運作機制，以及介紹如何用幾種開源/非開源的框架(Ollama/vLLM/LM Studio/Lemonade/oBeaver)在地端不同種 GPU/NPU 的機器上執行 Twinkle AI 開源模型。

Most applications treat AI as a cloud-only feature — send a request, wait for a response, pay per token. Open models like Gemma, Llama, DeepSeek, and Phi freed developers from proprietary APIs, but not from costs: you still need to host them somewhere — GPU servers, infrastructure, per-request pricing. You can run models directly on the user's device — zero inference costs, offline access, full data privacy. But there's a trade-off: models small enough to run on a phone or in a browser can't handle every task.
Hybrid AI is the answer to this dilemma. Combine cloud and on-device models in a single application: simple and privacy-sensitive tasks run on-device, complex reasoning and multimodal workloads go to the cloud. The problem is that you end up maintaining two completely different inference stacks: different runtimes (TFLite, LiteRT-LM, llama.cpp), different model formats (TFLite flatbuffers vs GGUF), different quantization strategies, and different streaming APIs — all within one app.
In this talk, I'll show how to solve this problem with Genkit — an open-source AI framework from Google with an open plugin system. Each plugin adapts a specific runtime or model format to a unified pipeline: genkit_flutter_gemma for TFLite/LiteRT models, genkit_llamadart for GGUF. Engine-specific details are hidden behind a single API for flows, structured output, tool calling, and agentic workflows. Need a new runtime? Write a plugin. New model format? Same story. On-device inference runs across Android, iOS, macOS, Windows, Linux, and Web — switching between cloud and local execution is a one-line model reference change.
We'll explore hybrid patterns in practice: how to route between on-device and cloud based on model capabilities, connectivity, and task complexity. We'll cover the real trade-offs — quantization impact on output quality, memory constraints across platforms, cold start latency, and when hybrid actually makes sense versus pure cloud or pure edge.
Open-source models made on-device AI possible. Open-source tooling makes hybrid AI extensible.

js13kGames 是一個 JavaScript 遊戲開發挑戰，參賽作品必須在 zip 後 13KB 以內完成。這個限制讓遊戲開發變得很不一樣：一張圖片可能就超過限制，因此玩法設計、素材表現、程式架構、build pipeline 與壓縮策略，都必須一起思考。

本議程將分享參與 js13kGames 的實務經驗，說明如何在極小容量中完成可玩的 Web 遊戲。內容會從遊戲發想、範圍控制、技術選型、素材處理、壓縮流程與體驗調整等面向，整理在 13KB 限制下常見的設計與工程取捨。

除了壓縮技巧，本分享也會討論容量限制如何反過來影響遊戲設計：哪些機制值得留下、哪些功能必須刪除、如何讓操作更直覺、如何在有限空間中保留足夠的回饋、變化與 polish。

First published by the W3C in January of 2018, ActivityPub has been the protocol that binds the Fediverse together. The hard-won experience of hundreds of developers, who have taken the words of the spec and turned it into a living network, is spread across forums, blog posts, chat rooms and toots. The W3C has authorized a new release of the specification, with updated text, examples, and clarifications. This talk will cover what's coming with ActivityPub 1.1 and what you need to know to get ready for it.

只要有心人人都是產品人，title 並不重要？總之，也許可以來聊聊，彼此認識認識。

歡迎有心來到開源人年會 COSCUP，但整個上午還很勉強地有聽沒懂的人來緩解一下「我在那裡我是誰」的情緒，當然也歡迎老手分享在如何運用開源招數化解產品發展難題。

在一輪自我介紹後我們會用 Lean Coffee 的方式討論議題，所以帶著問題來討論是最好了 :) 如果人數在 3 人以下就純吃飯閒聊（餐點自備）；有興趣的先登記一下 Telegram 方便聯系吧 t.me/cosupproductfolks

隨著 AI、雲端服務與大型應用持續推升記憶體需求，記憶體使用已不只是容量問題，也直接影響系統成本與執行效能。從個人電腦與行動裝置，到瀏覽器與 Electron 應用等日常軟體，「程式佔用大量記憶體」已成為使用者與開發者經常面對的問題。

然而，當我們在 Linux 上分析程式的記憶體使用時，通常會先觀察 RSS 或 PSS 等指標。這些指標可以描述程式目前駐留於實體記憶體的容量，卻難以回答「哪些資料仍屬於程式實際需要的 working set？」同時，在 Linux 核心中，page hotness 並沒有單一且通用的定義，而是核心根據 page access、aging、reclaim 與 refault 等訊號所做出的近似判斷。

因此本議程將透過可重現的實驗與核心追蹤，回到 Linux 的 Idle Page Tracking 和 mm/workingset.c 及其 MGLRU refault 路徑的關鍵實作，剖析核心如何觀察頁面存取、辨識頁面回收後的 refault，並將這些訊號轉化為 working set 推論與 reclaim 回饋。

受到香山處理器、BOOM、CVA6 等開源處理器專案啟發，我們從零開始建立一套 RISC-V 全系統模擬平台，目標是支援處理器設計、軟體部署、RTL 驗證與效能探索。本平台包含可開啟 Linux 與 FreeRTOS 的 RISC-V 指令集模擬器，並已成功整合兩顆自研 RTL RISC-V 核心：一顆可開啟 Linux 的 6 級順序處理器，以及一顆可開啟 FreeRTOS 的 11 級亂序處理器。

在系統層級上，我們使用 Verilator 將 RTL Core 編譯為 C++ 模型，並透過 SystemC 建立 Bus 與週邊設備，使 RTL 能在 C++ 層級進行全系統模擬，並可在一小時內完成開機。為了加速處理器開發，我們也建立 Co-simulation 機制，在 Core 提交指令時即時與指令集模擬器比對架構狀態，使錯誤能在發生當下停止模擬並輸出除錯資訊。

本演講將分享這個平台的架構設計、Linux/FreeRTOS 開機經驗、RTL co-simulation debug 流程，以及如何用 C++ 實作可調整大小、路數、hit latency、replacement policy 與 prefetcher 的高效能非阻塞快取模型。我們也會展示如何透過 Konata 觀察核心與快取管線化狀態，並整合 DRAMSys 進行更接近真實系統的效能評估。

PostgreSQL is often thought of as "The Database for DBAs", but what more and more developers are finding out is that what makes Postgres "The Worlds Most Advanced Open Source Database" is its wide array of features, many of which are really geared towards users who want to build applications on top of Postgres.

In this talk, we'll look at some of the features in Postgres you may not have seen in other database systems, and talk about how you can make use of those features in your applications. Queries, indexing, data types, and more will all be up for discussion as we show you examples of just what Postgres can do.

Overview

This session shares our technical journey of building a white-label Mastodon based mobile platform without forking Mastodon and without manually rebuilding apps for each client. We cover both the backend customisation layer and the mobile deployment pipeline, including the tradeoffs and lessons learned along the way. The talk is for developers working with ActivityPub, Mastodon, or mobile platforms who face the challenge to maintain custom features while keeping up with upstream changes.

Backend Challenges

Forking Mastodon and modifying the code directly works at first but becomes very painful as new versions come out. Keeping a fork up to date while preserving custom changes is time consuming, error prone, and does not scale across multiple clients.

Solution

Instead of forking, we inject customisations through a purpose built Ruby Gem, keeping all modified code completely separate from the Mastodon repository. When a new version comes out, we update the gem instead of re-merging a fork.

• Host a dedicated Mastodon instance for each client
• Add or modify features through the Ruby Gem without touching core Mastodon code
• Maintain separate gem versions for each Mastodon release

We also built a web based Dashboard so instance operators can control features without any code changes. Features shipped this way include Bluesky bridging, local only posts, long form post support, custom community feeds, and moderation tools.

Mobile Challenges

We manage multiple clients who all need the same core functionality, a Mastodon social feed with CMS news integration, but with different branding and feature variations. Manually updating icons, colours, and splash screens for every client did not scale. We needed to fully separate the core application from client configuration.

Solution

We built our architecture around three parts.

Control Center: A web based platform where clients upload icons, choose colours, provide instance and CMS URLs, and configure features with no developer involvement needed.

Core App: A React Native application with a scan to configure model. Scanning a QR code fetches a JSON configuration file and immediately rebrands the app at runtime without recompilation.

Build Service: For changes that cannot be handled at runtime such as bundle IDs, app names, and push notification certificates, an automation pipeline manages custom builds and store deployment while keeping the no-code experience intact for the client.

Results

This architecture powers the Newsmast Foundation Apps for Change programme at newsmastfoundation.org, enabling rapid rollout of native apps across news outlets, content creators, professional networks, and local communities, growing the Fediverse through new and diverse audiences.

Key Takeaways

• How combining Ruby Gems with a Dashboard lets you customise and ship features across multiple Mastodon instances without the burden of forking
• How runtime configuration through QR code and JSON removes most manual work in multi-client mobile development
• How better technical architecture can directly support an ambitious growth programme expanding the Fediverse globally

Open-source projects often succeed on innovation but fail on operability: installation, upgrades, permissions, observability, and support. In this talk, we’ll walk through what it takes to turn an open-source AI infrastructure project into a system real users can run safely on their own hardware.

Using the open source AI OS Olares as the case study, we’ll cover packaging, app lifecycle, GPU support, private data access, and remote access for a local sovereign cloud. We’ll also discuss what breaks when a project moves from developer excitement to actual everyday usage, and how to design the system so contributors and users can both succeed.

Attendees will leave with a clearer mental model for how to package open-source infrastructure in a way that is both technically sound and community-friendly.

shecc 是個精簡的 C 語言最佳化編譯器，以約一萬行 C 程式實作出完整編譯流程，涵蓋語法解析、中間表示 (IR)、SSA (static single assignment form)、經典最佳化，及程式碼產生。在不依賴外部工具的前提下，可直接產生 Arm 與 RISC-V 架構的執行檔，並具備自我編譯 (self-hosting) 能力。

最初 shecc 僅支援靜態連結輸出，自 2025 年起，逐步導入動態連結機制，使產生的執行檔可於執行時期連結 glibc，進而使用更完整的 C 標準函式庫。本議程將以 shecc 為例，說明如何將僅支援靜態連結的編譯器演進為支援動態連結的系統，並探討以下關鍵議題：

• 為 ELF 執行檔產生 dynamic sections，使其成為可動態連結的格式
• 解析函式呼叫於執行時期如何透過 PLT/GOT 與動態連結器完成重定位，並正確導向 glibc 實作
• 改進 Application Binary Interface (ABI)，尤其針對 Arm 架構，使函式呼叫符合規範並正確運作

政府資訊服務導入開源，一方面有助於降低廠商鎖定風險，減少機關長期採購與維護成本；另一方面，也能進一步讓維護者、其他機關與外部協作者更容易理解、延續並改善既有服務。不過這兩項優勢，必須分階段看待，前者比後者務實且急迫。

然而，開源仍未成為政府資訊採購的主流實務。從需求規格、招標文件、驗收標準到後續維運，行政流程中仍有許多尚待調整的環節。本場對談將從台灣與美國地方政府的開源採購經驗出發，討論開源在政府資訊服務中的實際應用、已經取得進展的制度條件，以及未來或可重新設計的採購與行政流程。

ActivityPub servers can communicate with each other through the ActivityPub protocol, but their application APIs are not uniform. A client, bot, or integration that works with one server implementation often needs separate adapters, authentication handling, data mapping, and error handling to support another.

This talk introduces ActivityPlug, a library and proxy API server that wraps different ActivityPub server APIs behind one consistent interface. The project is designed for developers who want to build tools for the Fediverse without binding their code to a single server implementation.

ActivityPlug can be used in two modes. As a proxy API server, it exposes GraphQL and HTTP APIs that applications can call from any runtime environment. In the JavaScript ecosystem, it can also be used directly as a library, without running a separate server. This makes it suitable for web clients, mobile clients built with technologies such as React Native, bots, automation tools, and connected services that operate across ActivityPub servers.

The presentation will cover the design problem, the current architecture, and examples of how ActivityPlug normalises server-specific APIs into one unified interface. It will also show how a shared API layer can reduce the cost of building tools for the Fediverse: a client or service can target ActivityPlug once, then support multiple ActivityPub server implementations through adapters.

The goal is not to replace existing ActivityPub servers or define a new social protocol. ActivityPlug is a practical compatibility layer for application developers. By making server APIs easier to work with, it aims to help more people build clients, bots, bridges, moderation tools, analytics tools, and other services on top of the Fediverse.

The tech industry is currently witnessing a linguistic land grab. As AI floods the ecosystem, the definition of "Open Source" is being stretched to its breaking point. While traditional Open Source Software relies on deterministic code and transparent licenses, the non-linear, opaque nature of Large Language Models challenges these old paradigms. Without a rigorous redefinition of openness, we risk a future of black-box innovation.

To bridge this gap, we will start by establishing a baseline understanding of AI mechanics. With this core understanding established, we will deconstruct the AI stack to understand why traditional software licenses fail. We’ll move beyond the surface level to explore:
- The Pull Request Paradox: Why modifying a model’s behavior is fundamentally different from a standard pull request and what that means for community contribution.
- Sovereignty vs. Access: A deep dive into the "Openness Spectrum", comparing different Open Source AI standards, including the Open Source AI Definition by the Open Source Initiative.
- The Anatomy of Openwashing: How providers use the "Open" label to gain community trust while gatekeeping the curation of training data and the compute recipes essential for true Open Source AI.

Attendees will walk away with a comprehensive framework for evaluating AI "openness", a technical understanding of why "open weights" does not equal "open source", and the vocabulary needed to advocate for true digital sovereignty in their communities or organizations.

People who try to learn English as a second language usually quit their flashcard app within two weeks. The hard part isn't memorising definitions. It's that a new word only sticks after a dozen real-world encounters, and a flashcard never gives you that. We introduce the concept "Ambient Learning" — learning from natural conversation.

COCA MCP is an useful tool to suggest the vocabularies chat to an LLM. The server sits behind the Corpus of Contemporary American English — 60,000 words ranked by frequency — and exposes a small set of MCP tools. When a client like Claude is talking to a learner, it asks the server which words are due, and gets back a short list scheduled by FSRS-4.5. The model uses those words in its reply. It then tells the server which ones it actually used; the server records the exposure and reschedules.

The session walks through a modern English learning methodology on the running site at coca.gavinguo.cc — how to use MCP technology to improve the English ability.

1. 區塊鏈不是萬能答案，到底適合解決什麼問題？
2. 區塊鏈這十年，到底證明了什麼？又證偽了什麼？
3. 如果今天重新開始學 Ethereum，新手該怎麼做？又有哪些社群可以加入？

這場演講不會把 Ethereum 包裝成萬能答案，而是會從新手角度出發，重新整理區塊鏈這些年真正被證明有價值的地方，以及哪些應用只是曾經的想像。前半段將用容易理解的方式說明 Ethereum 的核心概念與限制，幫助聽眾建立正確的基礎知識；後半段則會聚焦在「如何開始學習」，整理台灣在地的 Ethereum 相關社群與學習資源，並結合社群前輩的經驗，分享實際可行的入門路徑與未來值得關注的方向。

如果你曾經對 Ethereum 好奇，卻不知道它現在還值不值得學、該從哪裡開始、或有哪些人與社群可以一起前進，這場演講希望成為你走進 Ethereum 生態的第一個入口。

You already use Word and Excel every day. Turns out, those familiar tools share more with programming than you'd expect.This workshop starts exactly where you are — no coding background needed. We'll walk through how spreadsheet thinking connects to JavaScript, how document layout connects to HTML and CSS, and how a simple interactive button opens the door to modern web frameworks.Everything runs live in the browser. You'll see it, click it, and change it yourself.

The open mapping community has its own conference culture — and this summer, two big events happen right after COSCUP, just across the sea.

In this session, Hiroshi Miura — representative director of OpenStreetMap Foundation Japan and editor of weeklyOSM — will introduce these events and invite you to join.

FOSS4G Hiroshima (September 1–3, conference + September 4–5, sprint): The global conference for open-source geospatial technology. This year it comes to Hiroshima, Japan. Thousands of GIS developers, researchers, and map lovers gather together. Stay for the sprint and hack with the community!

State of the Map Asia 2026 (September 6–7, Osaka): The regional OSM community gathering for Asia. Contributors from across the continent share their work and meet each other in person.
Come to COSCUP in Taipei, then head to Hiroshima for FOSS4G, and finish in Osaka for SotM Asia. An open-source summer trip across the region!

And after the events — write about your experience! weeklyOSM is a global OSM media, run by volunteers, that collects and shares community news from around the world every week. Your blog post or trip report can reach the whole OSM community worldwide.

No special knowledge needed. If you have ever edited a map, used open geodata, or just wondered how the map on your phone gets made — this session is for you.

The SoDeV is an open-source reference Software Defined Vehicle (SDV) platform. It's developed by the Automotive Grade Linux (AGL) SoDev project. It aims to de-fact standard for the SDV platform.
The SoDeV platform is built on a hypervisor-based host environment and hardware decoupled guest VMs with Virt IO infrastructures. The example of those guest VMs are AOSP, AGL In Vehicle Infotainment(IVI), Instrument Cluster (IC), gateway, real-time Linux-based runtime environment and RTOS-based runtime environment.
From our point of view, "reproducible" is a high-priority topic. From the SoDeV developer's point of view, we need a method for the same environment creation to share the common development environment. From the SoDeV user point of view, we need to reproduce the SoDeV platform in our own environment to evaluate, modify and more.
The AGL has a common reproducible integration tool called Yocto. It already has a host and guest co-build method called multiconfig. On the other hand, that requires complex configuration. It's a big barrier for the SoDeV developer and user.
In this session, I'm talking about an idea for how to fix this issue. This talk includes my investigation, trial and consideration. It's common knowledge outside the automotive field. Because the same issue exists in IoT, Industrial and other fields.

Slide

Over the past 7 years, I contributed to the Global PostgreSQL Open-Source community through patches, patch reviews, technical blogs, conferences, and community participation. What started as small contributions gradually became deeper involvement in PostgreSQL core development and the open-source community.

In 2025, my patch featuring Parallel TID Range Scan was accepted into the upcoming PostgreSQL 19 that makes me recognized as a PostgreSQL Significant Contributor in the global community. This talk shares the lessons, challenges, and experiences from that journey, along with tips and insights for Taiwanese PostgreSQL developers or users interested in contributing to Global PostgreSQL Open Source community.

“Tweet” AI to the Edge: 從本地化語言模型到環境智能的下一步

這裡的 Tweet 不是社群平台上的短文，而是中文語感裡的「推」：推送、推進、佈署。當 Twinkle AI 這樣的開源社群開始打造本地化語言模型之後，下一個問題是：如何把模型真正推到使用者身邊，讓它跑在手機、桌面、瀏覽器與各種 edge 裝置上？

Little Star 的起點是 Mobile LLM 工具：從「能不能在手機上真跑 LLM」開始，經過 iOS / Android MVP 驗證，逐步轉向 configs、benchmark 與真機量測。這個過程讓我們意識到，edge AI 的挑戰不只是 inference，而是模型格式、runtime、量化、記憶體、延遲、耗電、熱與使用者體驗之間的整體設計。

本分享將以 Little Star 的探索經驗為基礎，討論如何把本地化語言模型推向 edge：從模型封裝、GGUF 與 llama.cpp 生態系、裝置端 benchmark，到 context-aware UX 與 Ambient Intelligence 的產品想像。我們也會討論為什麼本地模型的價值不只是離線，而是「靠近」：靠近使用者、靠近資料、靠近語境，也更靠近開源社群能掌握的未來 AI 基礎建設。

Yuino is an OSS Kana-Kanji conversion system that integrates LLMs with a dictionary-based approach.

The LLM-based Kana-Kanji conversion systems have been an actively developing topic in the OSS community in recent years. That representative example is azooKey. It achieves high-quality conversion accelerated by an LLM. On the other hand, it has a clearly weak point.
This weak point is 'How to handle new words from context'. The existing method doesn’t do not use dictionaries tied to the LLM. They use a tokenizer before LLM inference, and their behavior is entirely dependent on the training data. One of the example of new words is "Reiwa". "Reiwa" is an era name in Japan. It was created in 2018.
The tokenizer splits dictionary words into multiple tokens. It loses the original meaning and part-of-speech (POS) information. As a result, these cases negatively impact the inference process for Kana-Kanji conversion.

To solve this issue, I propose an LLM extension method. This method bypasses the tokenizer and modified the LLM to accept inputs while preserving both the word's form and its POS information. After this modification, we can input feeding word data with attached POS tags directly into the LLM. When we use the new words in input, the system can derive conversion results that accurately reflect the intended usage. Yuino is the world first implementation of my proposed method.
Attendees will learn about my proposed method deeply. The implementation of Yuino is a Japanese-specific implementation. On the other hand, the method is possible to reuse other languages in an ideogram user. Because my proposed method is common sense.

Everyone is saying "AI" right now. Fewer people are saying whether it actually made their work better. I build this stuff for a living — an on-device AI appliance around a Raspberry Pi 5 + AI HAT+, and mobile apps running speech and language models locally: sherpa-onnx, whisper.cpp, llama.cpp, Gemma, Style-Bert-VITS2. Not in the cloud, on the device, for people whose data shouldn't leave it. Mostly what I've learned is how it breaks. Small models forget what you just told them. Latency you can feel. Demos that impress someone once and never get opened again. So this is not a talk with answers. It's a room for people actually shipping this stuff to compare notes and be honest:
Where has local AI genuinely made something better — and where did we just bolt a chatbot onto a thing that was fine?

What's still missing? Models, tooling, hardware, UX patterns. What would you build if someone else built the piece you keep rewriting?

Real constraints: what did you give up to run on-device, and what turned out not to matter?
We'll run it Lean Coffee style — everyone writes down the question they came with, we vote, and we work down the list. No conclusions required. "It'd be nice if this existed" is a perfectly good outcome. A Raspberry Pi 5 will be running fully offline on the table the whole hour, so when the conversation drifts too abstract we can go poke at something real. Anyone welcome: edge AI, on-device LLM / ASR / TTS, low-resource languages, hardware — or you just have a strong opinion about whether any of this is working yet. Newcomers especially welcome. The questions are the point.

大家都在講 AI，但很少人講它到底有沒有讓工作變好。
我平常做的是端上的 AI： Raspberry Pi 5 + AI HAT+ 的裝置，以及把語音與語言模型跑在手機本機的 app （sherpa-onnx、whisper.cpp、llama.cpp、Gemma、Style-Bert-VITS2）。做下來學到最多的 其實是它怎麼壞——小模型記不住剛講過的話、延遲感覺得出來、demo 驚艷一次之後再也 沒人打開。 這場不是有結論的演講，而是想找同樣在做的人誠實聊聊：哪些地方地端 AI 真的讓事情 變好了？哪些只是硬加了一個 chatbot？還缺什麼模型、工具、硬體或 UX pattern？我們 用 Lean Coffee 的方式進行，各自把帶來的問題寫下來、投票、依序討論。不需要結論， 「有這個就好了」也是很好的收穫。桌上會一直放一台完全離線運作的 Raspberry Pi 5， 聊到太抽象的時候可以回來戳戳實體。歡迎做邊緣 AI、端上 LLM/ASR/TTS、低資源語言、 硬體的朋友，或單純對「這些到底有沒有用」有意見的人。新手非常歡迎。 Language: English (Mandarin / Japanese also fine)

更新：
由於講者還在國外做計劃，因此本場議程講者將以視訊方式參與。
會議連結：https://meet.google.com/uth-phgb-vfe
slido：https://app.sli.do/event/8KT86eTQndzLqfb1av6AKV

學術網路因其頻寬穩定且 IP 聲譽良好，一直是全球 Tor 網路中最重要的支柱之一。然而，在校園環境中部署 Tor 節點常面臨技術配置與校內政策的雙重挑戰。

本演講將分享講者在國立臺灣師範大學（NTNU）建立學術 Tor 節點的完整歷程，包含：

• 計畫緣起：介紹 EFF 發起的 Tor University Challenge 及其對全球匿名網路的意義。
• 技術實踐：基於 Linux 環境的節點配置、防火牆規則設定...。
• 行政協調：如何與學校資訊單位溝通，以及如何應用 EFF 提供的法律指南。
• 社群影響：建立節點後的觀察、流量分析與對後續校園推廣的建議。

希望能藉此經驗，鼓勵更多臺灣學研單位參與全球隱私基礎設施的建設。

一個關於橘子會吃醋的小故事：善待環境＋善待果樹＝美好果實。土地不會說話，來自橘子會吃醋的柑橘，沒有亮麗外表，但顆顆飽滿多汁，這就是土地回饋友善的人們的心意。由於橘子會吃醋的張老闆從鬼門關前走一遭，了解健康的重要。因此放下空調業，返鄉務農，堅持善待的栽種柑橘，以醋浸泡蚵殼粉及天然礦物，取代化學催熟劑及生長激素，找回果實原有風味。關心消費者的健康， 從「心」開始。

小時候是不是也曾幻想過寫程式控制火箭升空？現在，你的 code 真的能主宰火箭的飛行軌跡！隨著臺灣入軌火箭計畫的推進，我們正徵招「導航、制導與控制（GNC）」的跨領域軟體人才，參加國家太空中心（TASA）與陽明交通大學前瞻火箭研究中心（ARRC）共同推動的「火箭導控軟體競賽（Balloon Popping Challenge）」。

這是個結合 Gymnasium 訓練環境與 ActiveRocketPy 模擬系統(基於開源專案 RocketPy) 的火箭導控競賽。活動中會手把手帶領與會者嘗試控制火箭的推力向量控制（TVC）系統，並進一步探討如何應對陣風、感測器雜訊等複雜的真實情境。

「Be a User -> Be a Contributor」是這場工作坊的核心精神！我們非常鼓勵大家參與開源貢獻：無論你想發揮 Computer Science 背景幫忙打造飛行軌跡的資料視覺化工具，還是對物理學有熱忱，想發 PR 改善火箭 Python 模組的模擬特性，這裡都有你大展身手的舞台。

本工作坊無需事先報名，敬請攜帶筆電，歡迎隨時中途參與。期待大家在 COSCUP 期間直接過來現場跟我們研究火箭，一起成為太空開源專案的貢獻者！如果玩出了興趣，還可以順便組隊報名參加 8 月 31 日截止的火箭導控軟體競賽挑戰看看！

Open Forms is a Linux application designed to provide a native, accessible, and offline-first form experience on Linux systems.

Across Ubuntu communities, LoCos, and open-source events, form-based workflows still rely heavily on proprietary web platforms. These solutions often fall short in areas critical to our ecosystem - offline usability, data ownership, accessibility in low-connectivity environments, and seamless integration with the Linux desktop.

Open Forms emerged from real-world needs within the Ubuntu community. It aims to provide a simple, reliable alternative that aligns with open-source values and Ubuntu’s vision of accessibility for everyone. And did I mention? It is available in a Snap!

Open Forms:

• Enables offline-first data collection for booths, registrations, and surveys.
• Integrates naturally with the Ubuntu desktop experience
• Supports LoCos, community events, and grassroots initiatives
• Runs efficiently on Linux mobile devices without requiring constant connectivity

In this talk, we will cover:

• Why GTK4 + libadwaita were chosen for building a modern Ubuntu-native experience Key challenges and lessons learned while developing Open
• Forms Real-world usage in Ubuntu booths and community events
• How tools like Open Forms can strengthen Ubuntu communities across regions

More info: https://events.canonical.com/event/146/contributions/936/

這是一場帶著電腦動手做的 Workshop，目標是讓每位參與者在 50 分鐘內，在自己的 Ubuntu 機器上用 Juju + LXD 跑起 OpenClaw，並透過 Telegram 機器人收到第一個 AI 回覆。本 Workshop 以 Google AI Studio（ai.dev）提供的免費 API key 作為 AI 來源，參與者只需要一個 Google 帳號，無需任何付費訂閱即可完整體驗。課程分為四個段落：
（1）環境準備——確認 Ubuntu 24.04、安裝 LXD snap 與 Juju，初始化 local cloud；
（2）部署 OpenClaw Charm——juju add-model、juju deploy openclaw、填入從 Google AI Studio 取得的免費 API key；
（3）整合 Telegram——在 BotFather 建立 bot 取得 token 後填入 juju config telegram-bot-token，接著傳訊息給 bot 並取得 AI 回覆；
（4）進階調整與觀察——使用 openclaw tui 直接在終端機與 AI 助理互動，即時觀察對話狀態與回應。

所有步驟皆有事先準備好的指令清單，講師與助教（如果有找到人的話）在現場協助排錯。先決條件：原生 Ubuntu 24.04 的筆電或實體/虛擬機器（WSL2 不支援作為 LXD host，建議使用原生 Ubuntu 或 Ubuntu VM）、網路存取、Google 帳號、Telegram 帳號。

More info: https://events.canonical.com/event/146/contributions/931/

本議程以一名高中 CTF 玩家的視角出發，深入剖析從研究自動化解題策略與攻擊框架，到開發解題工具並建立測試驗證流程的完整歷程。

在議程中將介紹如何從自單一 Claude Code 對話出發，有策略地派遣 agent、將對話轉為協調者的角色，以及多 worker 並行下的資源競爭、context window 膨脹與分配處理。派遣依題目難度分波進行，而當 worker 卡關，又該如何從已驗證的線索做決策，以及如何讓 agent 面對題目內容時只當作資料而非指令。接續解析框架的自我優化過程，包含分類專屬 prompt template 的設計取捨、模型將自主判斷回寫為規則的演化機制，以及解題紀錄與賽後檢討如何回饋為技術知識庫的長期累積。最後將框架移植至其他專題，並改以原生開源模型測試，藉此驗證其可移植性與實際成效。

議程後段由指導老師以教學現場的視角切入，討論學習者如何在 agent 輔助與實質理解之間取得平衡，以及此類工具導入課程時的實務考量。

Since October 2025, we have been publicly releasing the Tokai Rika 1 µm CMOS technology as an open-source PDK via the OpenSUSI repository. In this talk, I will first present the latest status of the open-source PDK development, including the key technical issues that have emerged and our ongoing efforts to refine and improve the overall methodology. I will then introduce the “First Tapeout” proposal in 2026 as a talent identification and development program. This initiative represents Japan’s first attempt to provide hands-on experience covering the full RTL-to-GDSII-to-chip flow in collaboration with industrial partners. Finally, I will outline the OpenSUSI MPW shuttle program released for 2026, which aims to engage Japanese academia and further strengthen practical semiconductor design and fabrication experience.

Description

Underwater cultural heritage is fragile and often invisible — not only beneath the sea, but buried in PDFs, scattered archives, and disconnected databases. While LLMs can generate summaries, they do not preserve structured, verifiable knowledge over time. Relational tables store records, but struggle to capture complex relationships such as trade routes, ocean currents, artifacts, and cross-border exchange.

This talk proposes modeling underwater heritage as an open knowledge graph — not as a product, but as shared, open infrastructure for cultural memory.

These ideas align with open knowledge ecosystems such as Wikidata and OpenStreetMap, where structured, linked data enables global collaboration across communities and domains.

Rather than focusing on specific tools, the session introduces open modeling principles and linked data concepts that make knowledge interoperable, extensible, and community-driven. We will also briefly demonstrate a minimal example using Neo4j as one practical implementation.

Taiwan, like Japan, is shaped by maritime history. What if we could structure this shared heritage as an open, cross-border knowledge graph — collaboratively maintained and globally connected?

At its core, this talk asks:

If knowledge must outlive tools, models, and vendors — where should it live?

This session is for beginners and anyone interested in open data, linked data, and meaningful knowledge design. All examples use open data and open tools, so you can explore and extend the approach yourself.

Outline (30 minutes)

1. Fragmented cultural data
2. Limits of PDFs, tables, and AI-generated summaries
3. Open knowledge graph and linked data principles
4. Minimal example (Neo4j as one implementation)
5. Cross-border and community-driven knowledge

Key Takeaways

Participants will:

• Understand why current approaches fail to capture complex relationships
• Learn how to model heritage as interconnected, structured data
• See a simple, practical graph-based example
• Understand the role of open, linked knowledge in global and cross-border collaboration

你花了一個週末串好 RAG、接上 MCP、部署了一個會自動回 Issue 的 LLM Agent——然後你就直接上線了。沒有 input validation、沒有權限控制、System Prompt 裸奔。別擔心，大家都這樣，而且不需要資安背景也能跟上。今天我們直接開 terminal，打給你看。
這場議程會告訴你上線前該做好的三件事：一、管好你的 System Prompt——我們會現場用 Prompt Injection 把它整段偷出來，然後示範怎麼用 NemoClaw Guardrail 擋住。二、清洗你的 RAG 資料來源——我們會在知識庫文件裡埋 Indirect Prompt Injection，讓你的 Agent 做出它不該做的事，然後示範 content sanitization 怎麼實作。三、限制你的 Agent 權限——我們會讓一個有過多權限的 Agent 自己刪掉自己的資料，然後用 least privilege 原則加上 tool call 權限控制修好它。
每一件事都是「現場用 OpenClaw 打給你看，再用 NemoClaw 修給你看」，全部開源，git clone 就能跑。你會帶走一份可以直接丟進 repo 的安全 checklist。

在現代系統環境中，單一 Linux 主機常同時執行資料庫、VM、Container 與 Batch Job 等多種 Workload。然而，Kernel 在進行 Page Reclaim 時缺乏應用層語意，僅能依賴 Accessed bit、Refault 與 Page Type 等低階訊號推測資料冷熱，導致難以針對特定 Workload 做出最佳化決策。

本議程將從 Linux reclaim path 與原始碼演進出發，探討 Active/Inactive LRU 與 Multi-Gen LRU（MGLRU）如何透過啟發式演算法推測 Page Hotness，以及這類設計在現代 Workload 下的限制。接著，將整理 madvise、posix_fadvise 與 userfaultfd 等機制，說明 Linux 如何讓 User-space 從單純提供 Hint，逐步走向參與記憶體決策路徑。

最後將介紹近期 Linux 社群如何透過 eBPF 與 BPF-based memory policy patchset，嘗試將部分 Memory Management Decision 外部化，使記憶體管理從固定啟發式演算法，逐步走向可程式化決策框架，讓 Workload 語意能實際影響 Kernel 記憶體決策。

本議程將從 Linux 虛擬記憶體 (VM) 子系統的演化脈絡出發，分三個部分介紹：

1. RMAP 發展史: 從 Linux v2.5 的 pte_chain（per-page reverse mapping）出發，探討其 scalability 問題；接著介紹 Andrea Arcangeli 在 2004 年導入 anon_vma 的設計背景，以及如何回應 VM scalability、分析 anon_vma_chain 如何改善大量 fork workload 的擴展性問題；最後介紹以 interval tree 改善大型 address space 下的 VMA lookup 與 RMAP walk scalability
2. RMAP 在現代頁面置換中的作用: 介紹 Multi-Gen LRU（MGLRU）如何透過 generation-based aging，減少 reclaim 過程中對 page table 與 reverse mapping 的重複掃描，並說明其在現代資料中心 workload 下的重要性。
3. 實驗量化 RMAP Overhead: 使用 bpftrace 掛載 rmap 走訪路徑，量測 Transparent HugePage (THP) 啟用與停用時的 latency 分布差異，並分析 huge page split、folio reclaim 與 deferred split queue 等路徑如何影響 reverse mapping 成本。

「每次提起升版就被已讀。」

Ruby 3.2 導入了重要的 Regexp 更新，而隨著 Ruby 4 發佈，Ruby 3.2 也正式進入 EOL。近年的 Ruby Regexp 改善，也讓 ReDoS 的防禦逐漸從「怎麼寫 Regex」延伸到「底層如何幫開發者收斂風險」。

然而， 2026 年初 GitLab 的 CVE-2026-1388，以及 Active Support 的 CVE-2026-33169，也再次提醒我們：在複雜的 Web 應用實作中，Regexp 仍然可能成為效能與安全問題的入口。

這場演講會延續 RubyJam 3 月 Meetup 中對 Ruby Feature #17837 與 #19104 的設計權衡討論，並加入 2026 年最新的技術動態：

1. 案例拆解：分析 ReDoS CVE 案例，看看在現有防護機制下，哪些模式依然可能帶來風險。
2. Rails 實踐：說明如何在 Rails 應用程式中整合 Regexp Timeout。
3. 從 ReDoS 延伸到 Timing Attack：回應 RubyJam Meetup 的現場提問，聊聊演算法複雜度攻擊的另一面，以及 Ruby 生態系中如何實作 Constant Time Comparison。
4. Ruby Regexp 的最新方向：分享來自 RubyKaigi 2026 的第一手資訊，看看 Regexp 導入 JIT 的進展，以及對安全性議題的可能影響。

In practical artificial intelligence development, while model design is important, project success often depends more on data annotation workflows, toolchain integration, and engineering deployment. This talk draws on my real-world contributions to the open-source annotation tool Labelme, showing how practical user needs led to multilingual localization and feature improvements, as well as the technical trade-offs involved in collaborating with upstream maintainers and the community. Building on this experience, the session explores how open-source tools help bridge AI research and real-world applications, highlighting challenges such as data quality and privacy in medical image segmentation and data distribution shifts and real-time requirements in multi-site industrial vision deployment. Through cross-domain case studies, it emphasizes the critical role of open-source tooling in modern AI workflows and demonstrates how addressing real problems through community collaboration can effectively support engineering practice in medical and industrial AI systems.

現代網頁瀏覽器提供許多看似不屬於網頁該有的 API （功能）：WebGL 讓網頁可以使用圖形加速程式語言、WebAudio 讓網頁可以直接執行複雜的音訊合成指令、WebAssembly 則是允許網頁直接執行低階指令碼。

這些 API 讓瀏覽器可以做的事情變多了，以往僅能由原生應用程式提供的功能在當今許多都可以由網頁提供。不過這些與硬體緊密結合的 API 讓網頁得以收集更多使用者資料，進而更精準地跟蹤和識別使用者。

不幸的是，追蹤使用者正是大多網頁使用這些 API 的方式，而非使用這些 API 提供的獨特硬體整合功能。這些 API 被整合進瀏覽器裡面，網頁要求時自動啟用——從來沒問過使用者的意見。

本議程內我將分享我對瀏覽器指紋 （browser fingerprint)、反追蹤的簡單研究，會提到 Tor Browser, Brave, VPN 等軟體和技術。並探討反追蹤的動機和策略，介紹一些潛在解決方案，並分享我的使用心得。

Developers build DeFi protocols, DAOs, and countless other applications on Ethereum every day using smart contract languages like Solidity and Vyper. Yet beneath all of them sits the Ethereum Virtual Machine (EVM) — the execution engine that powers the entire ecosystem, and still remains a black box to most developers building on it.

This talk opens that box from two perspectives.

From the smart contract developer's angle, we'll walk through the EVM's architecture and core components — the stack, memory, transient storage, and more — and show why understanding what happens beneath your Solidity code leads to better gas optimization, safer contracts, and sharper debugging instincts. It's also key to understanding how many smart contract hacks actually work.

From the protocol developer's angle, we'll go behind the scenes of how the EVM itself evolves: how a new feature is proposed, how EIP specs are written, how the implementation comes together, and how multi-client testing keeps consensus intact. We'll give special attention to how gas costs are defined, and the rationale behind the repricing EIPs landing in Ethereum's next hard fork, Glamsterdam.

Mobile UI development has already moved toward a declarative paradigm, but haptic feedback is still often handled through imperative, platform-specific APIs. On Android, developers need to work with timing and amplitude arrays, while iOS requires a different approach through Core Haptics. As a result, expressing even a simple vibration pattern can quickly become difficult to read, maintain, and reuse across platforms.
In this session, I'll introduce Jindong(진동, Vibration), a declarative haptic feedback library for Compose Multiplatform. Jindong lets developers describe haptic patterns using a Compose-like DSL with concepts such as Haptic, Delay, and Sequence, while the library handles platform-specific execution details for Android and iOS.
We will look at the motivation behind declarative haptics, how Jindong integrates with Compose state and lifecycle, and how this approach can make haptic feedback more expressive, reusable, and aligned with modern Compose development.

Open source educational materials often come with their own “dialects” of Markdown. For example, The Carpentries Workbench extends Markdown with special directives, metadata blocks, and conventions that are essential for building lessons. These are not just formatting details—they are part of the executable structure of the content.

Today, AI tools make it easy to translate documentation quickly. You can generate a full draft in seconds. But if you’ve tried this on structured teaching materials, you may have seen what happens next: broken builds, modified syntax, or translations that ignore the intent of the lesson design. AI is powerful, but it doesn’t automatically understand which parts of a document must never be touched.

In this talk, I’ll share a practical approach to solving this problem using “agent skills” designed specifically for translating structured technical content. These skills act as guardrails: they protect non-translatable syntax while allowing AI to focus on natural language parts. The goal is not just speed, but safe and maintainable translation workflows.

I’ll present a real-world example from the Bioconductor community, where we applied this approach to translate Carpentries-style training materials. With these agent skills, we were able to significantly accelerate translation while keeping lessons fully buildable and consistent.

More importantly, this is not just a tooling story—it’s a community story. These translated materials are now being used in workshops across different regions, enabling participants to learn in their own languages. Translation becomes more than a task; it becomes an entry point for contributing to open source. You don’t need to start with code—you can start by helping your local community access knowledge.

At COSCUP, where community and openness are at the center, this talk aims to share both practical techniques and a perspective: AI can amplify community efforts, but only if we design workflows that respect how open source projects actually work.

If you care about documentation, localization, or making open source more inclusive, this talk is for you.

當你的 Go 服務開始出現 latency Spike，第一個懷疑對象往往是 channel。
Channel 內部的 mutex、GC 壓力、false sharing，這些問題在高吞吐場景下會被放大。
LMAX Disruptor 是金融交易系統中解決這類問題的經典方案，但它真的適合 Go 嗎？
本議題帶你從源碼出發，一起讀懂 smarty/go-disruptor 的設計，理解 Disruptor 為什麼快，以及在 Go 的生態下它的邊界在哪裡。

1. Channel 的成本從哪裡來？
   用 benchmark 展示 channel 在多核環境下的瓶頸，從 CPU cache line、false sharing 與 mutex contention 建立直覺，讓後續的源碼解析有具體的問題背景。

2. 讀源碼：Ring Buffer 的核心設計
   逐段解析 smarty/go-disruptor 的關鍵檔案， sequence.go 的 cache line padding 如何消滅 false sharing、sequencer.go 的 atomic 操作如何取代 mutex、producer/consumer gating 機制如何在不加鎖的情況下保證順序。

3. Go Memory Model 的關鍵轉折
   Go 1.19 正式明確了 atomic 操作的 happens-before 語義，這讓 smarty/go-disruptor 從 pre-release 進入穩定狀態。我們會從源碼理解這個語義保證在實作上意味著什麼，以及為什麼在這之前 lock-free 的 Go 程式碼其實站在不穩固的地基上。

4. 邊界在哪裡：什麼時候 Channel 就夠了
   以 exchange matching engine 的設計評估為例，說明在真實系統中如何判斷是否需要 Disruptor:吞吐量需求、團隊維護成本、系統複雜度的三角取捨。

5. 從 Disruptor 借回 Go 的設計概念
   即使不用 Disruptor，它的設計思想仍然可以改善你的 Go 系統：預分配 slice 減少 GC 壓力、struct padding 避免 false sharing、ring buffer 作為固定大小的 event queue。

• 目標受眾： 對 Go 並發有基礎認識、對系統效能調優或底層設計感興趣的工程師。不需要有 Disruptor 或金融系統背景。
• 帶走什麼： 讀源碼的方法、對 Go memory model atomic 語義的具體理解、一個判斷是否需要 Disruptor 的決策框架。
  所有參考內容皆為公開開源專案，技術方法不依賴任何特定雲端平台或商業工具。

為什麼要開這個議題？

• 資料，乃訓練之基礎— 為了讓模型更懂臺灣，我們需要你一起貢獻更多更多的臺灣知識！
• PDF 資料比你想像的有價值— 有許多重要知識都被封印在 PDF 文件或是圖片之中，這樣的資料無法作為模型訓練內容。
• 告別「工人智慧」輕輕鬆鬆完成貢獻— 我們設計了一套半自動化的 PDF 文件處理系統，將在本議程介紹如何快速貢獻並取得 Credit！
• 血淚史大公開— 分享 PDF 處理中的辛酸血淚，讓你快速就能掌握各種撇步！

誰適合來聽這個議程？

• 知識囤積狂與文獻愛好者— 手邊一堆珍貴的 PDF 檔案，卻不知如何讓它們發揮最大價值的你。
• 文字潔癖與細節控— 看到錯字跟排版亂掉就渾身不對勁？我們超需要你來幫忙把關最後一哩路（人工審閱 XDDDD）！
• 開源狂熱份子— 想了解如何用自動化工具與OCR Model 對抗排版地獄的你。

這個議題期望帶來什麼樣的影響力？

• 我們是 TwinkleAI— 一個致力於建立「臺灣在地資料集與模型」的社群，目前已公開多筆資料集以及數顆繁體中文模型。
• 擴張開源宇宙的版圖— 繼目前進行中的「Twinkle Voice 語音資料集」、「Twinkle Vision 視覺資料集」專案後，我們將在本次議程正式啟動「Twinkle FinePDFs-zhtw」！
• 人人都能成為開源貢獻者— 透過我們準備好的工具，不管是工程師還是麻瓜，都能輕鬆參與這個大型開源運動。來聽這場議程，一起在臺灣 AI 發展的歷史上留下你的 GitHub ID 與名字吧！

Software-Defined Vehicle (SDV) requires multiple domains—such as infotainment, instrument clusters, real-time ADAS functions, and AI features —to coexist safely on a single hardware platform. Achieving this requires strong isolation, making virtualization essential. A traditional software coupled with hardware loses software portability. Hardware decoupling is a crucial aspect in the SDV era.　While multiple approaches exist, this talk focuses on hypervisors, with Xen emerging as a key technology for isolation and hardware decoupling.
However, automotive hypervisors have traditionally relied on commercial solutions, and applying an open-source hypervisor like Xen introduces challenges—especially on ARM platforms. These include BSP dependencies, complex boot flows, Device Tree configuration, memory constraints, and virtio-based device design.
In this talk, we present a real-world hardware implementation combining Xen, Automotive Grade Linux (AGL), and Zephyr RTOS on ARM. We share practical integration issues and solutions, and demonstrate how virtio enables device abstraction and hardware decoupling.

PostgreSQL 是全球最成功的开源数据库项目之一，但建设一个健康的本地社区并不只是技术问题，也需要翻译、教育、线下活动、会议、用户案例，以及连接本地用户与全球上游社区的桥梁。

本演讲将分享在中国建设和支持 PostgreSQL 相关开源社区的实践经验，包括本地 Meetup、双语社区内容、PostgreSQL 教育、大学合作，以及 IvorySQL、SynchDB 等下游开源项目。

演讲还将讨论如何收集并匿名化真实生产环境中的问题，将其转化为可复现的技术案例；如何通过社区活动连接用户、开发者和贡献者；以及区域社区如何更积极地参与全球 PostgreSQL 生态。

本演讲适合开源社区组织者、PostgreSQL 用户、开发者、教育工作者，以及所有对跨语言、跨地区开源社区建设感兴趣的人。

Language barriers remain a significant challenge in international conferences. Not all speakers are fluent in English, and even when they are, their speech may not always be easy for diverse audiences to understand. While some events provide professional captioning or simultaneous interpretation, such services are not always available for every session.

In this talk, I will present a self-contained approach that enables speakers to generate real-time subtitles directly from their own laptop. By combining Moonshine Voice, a lightweight and efficient speech-to-text (STT) system that can run even on devices like Raspberry Pi, with Pympress, a PDF-based presentation tool, we can build a fully local, automatic subtitle system on Ubuntu.

This approach allows speakers to make their talks more accessible without relying on external infrastructure or services, making it easier to participate in international events regardless of location or available resources.

More info: https://events.canonical.com/event/146/contributions/935/

為了讓團隊可以同步知道彼此在做什麼，我們選擇用 GitHub issue 讓 agent 記錄自己的動作。該寫的都寫了，狀態也不在誰的腦袋裡。
我以為我準備好了，結果我直接變成 Router 熱當。

後來我修了三次：找個幕僚幫我分流、把幕僚的定位寫死、最後變成一顆全隊都能從聊天室叫的 agent。每一次都解掉了上一次的問題，然後長出新的問題。
本場會聊這三次決定各自踩到什麼坑、現在做起來感覺怎麼樣，還有最後一段：什麼時候不要這樣做。
答案沒有標準解，只講付了什麼代價。

預期收穫：
• 知道自己一次扛得住幾條，而且有辦法量，不是靠感覺累不累
• 知道「找個代理幫你分流」什麼時候真的有效、什麼時候只是把十條慢線換成一條慢線
• 知道一顆多人共用的 agent 會冒出哪三個新問題，以及為什麼躲不掉
• 知道自己到底該不該做這一套，還有做了要付什麼

近年有兩個在開源社群引發熱潮的投資分析實作，讓「用 LLM 分析股票」從概念變成人人都能研究與延伸的工程問題。然而，這類系統多半以英文資料、美國市場與美股分析習慣為主要設計背景；當我們把它們帶進台灣市場，資料來源、投資語境與決策流程都必須重新思考。

本議程以 AlphaCouncil 為例，分享如何運用 Google ADK（Agent Development Kit）的 SequentialAgent、ParallelAgent 與 LoopAgent 三種原生編排原語，打造一套以台灣股市為第一公民的在地化多代理人分析系統。系統將不同專業分析角色並行蒐集資料，再交由投資大師角色提出觀點，接續進行看多與看空研究辯論，由研究管理人裁決後交給交易員形成執行方案，最後透過多方風險辯論，由投資組合管理人做出最終決策。

在地化首先發生在資料層。AlphaCouncil 依市場切換資料來源：台股部分以 TWSE、TPEX、MOPS、TAIFEX 等免費公開資料為基礎，整合法人與籌碼資訊、月營收、估值指標、選擇權與市場心理訊號，並搭配台灣財經新聞，讓分析不只是把股票代號換成台灣公司，而是能真正理解台股的市場脈絡。這樣的選擇也代表一項工程取捨：承擔分散資料源的清洗與格式整合成本，換來不需要 API 金鑰、沒有訂閱門檻的使用體驗。

在模型層，系統支援透過 Ollama 在本機執行開源模型。模型可以依照硬體條件、繁體中文能力、工具呼叫支援與部署需求替換，讓資料不必離開本機，也讓開發者能在金融場景中更彈性地處理隱私與成本問題；若需求不同，也可以替換為商業模型。

本議程聚焦三項工程實作：Google ADK 原生編排如何控制多代理人流程、免費台股資料如何接入並轉換為可供 Agent 使用的結構化資訊，以及如何讓可替換的開源模型以繁體中文產出具備台股語境的人格分析報告。分享也會透過實際 DEMO 與回測結果，討論當 Agent 忠實執行某種投資哲學、卻在特定市場環境中落後基準時，工程師應該如何理解與評估這個結果。

無論你想用開源模型打造垂直領域 Agent，或想把熱門英文語境的 Agent 系統在地化為繁體中文版本，本議程將提供一個可拆解、可替換、可延伸的參考實作。

AlphaCouncil 僅供教育與研究用途，不構成任何投資建議。

Koreans used to mix hanja (漢字; Chinese characters) into Korean prose, much as Japanese still mixes kanji and kana. The style is called Korean mixed script (國漢文混用體). Almost nobody writes this way anymore. I do.

When I wanted to post this way on the fediverse, I ran into a small but stubborn problem: <ruby> annotations, the HTML feature that puts pronunciation guides above or beside characters, were stripped by the major servers I tried. I filed an issue against Mastodon. It sat there for a long time. At some point, “maybe I should run my own server” somehow became “maybe I should implement ActivityPub myself.”

ActivityPub is not simple. JSON-LD alone has several ways to say the same thing. Then come HTTP Signatures, WebFinger, NodeInfo, inbox forwarding, and the small incompatibilities that only become obvious when Mastodon and Misskey disagree. Before building the server I wanted, I built Fedify: a TypeScript framework that keeps most of that protocol plumbing out of application code.

Hollo came next, because I still wanted the original thing: a single-user ActivityPub server where Markdown and <ruby> annotations survived the trip. Hackers' Pub followed from the same framework, aimed at developers who want short posts and longer articles to federate.

This talk is about how a small typographic itch turned into upstream patches, a framework, and two fediverse servers. I still just wanted ruby annotations.

你知道你現在用的 Chrome 或 Firefox 開發者工具裡面的程式碼編輯器是同一個套件嗎？Marijn Haverbeke 從大約 2019 年開始著手重寫新一代的文字編輯器框架 CodeMirror 6，如今已演變為模組化且功能齊全的編輯器函式庫，並擁有健全的開源生態圈。在這個微軟 VS Code 橫掃市場的時代，我們可以花點時間來欣賞 Marijn 如何從單純的網頁文字輸入框開始，設計出跨瀏覽器、高效能且極具擴充潛力的文字編輯器？

本聚會不使用 (consume) 基因改造大豆或大型語言模型 (LLM)。

是什麼讓農業小老闆們願意花錢購買MantaGO的對話式商務平台?
深耕小微企業七年多的女性創業者 Janice，如何看公司下一個七年的發展?

以力科技成立於2018年，致力於為中小型企業提供簡單易上手的AI solution，透過技術解決資訊不對稱的問題。旗下品牌MantaGO對話式商務平台，以多渠道底層架構為基礎，整合5大社群平台如LINE、Messenger、Instagram、Google Business Chat及官網客服系統，提供市場完整的一站式商務服務。2025年以力科技在日本成立分公司，2026年更進一步推廣至泰國、越南等東南亞國家，協助更多海外品牌架構專屬AI聊天機器人，協助企業進行使用者管理優化，同時提升終端消費者體驗。

更多講者資訊：https://www.ctee.com.tw/news/20240814701332-431202

把 360 相機架到車頂上（或者頭頂上），然後一起來走遍大街小巷吧！
我的 360 街景遊記——怎麼拍、如何處理、上傳到哪裡、資料怎麼 Open。
一起來扮演野生街景車，記錄下你的國內外遊蹤。

世界各地都有針對政府機關開源的倡議，比如公共資金、公共程式。但是在實務上，資訊職系的公務員在做資訊採購案時，必須因應來自督導長官、執行廠商、以及平行單位的壓力，因此符合在地脈絡的政策路徑便非常重要。開放、公開、透明、協作的智慧政府服務該怎麼達成？在有標準答案之前，我們先來聽聽公務員怎麼說。

This session provides an {overview, in-depth} architectural breakdown of running Linux Kernel within Apple Silicon’s Virtualization Infrastructure. We will explore it from the ground up, examining what the Hypervisor.framework is.

The talk will specifically cover:
- An Introduction to Apple Silicon's Virtualization Stacks
- Hardware-Assisted CPU virtualization
- VirtIO: Para-virtualization I/O
- User-Space Tools for Virtualization

為什麼要開這個議題？
* 資料分類是模型進化的階梯— 延續先前的 FinePDFs，如何讓這些碎片化的文字變成可被 LLM 吸收的「領域專長」，關鍵就在於高品質的分類與標納。
* 訓練 LLM 的重要步驟— 訓練或微調模型前，你需要一個精準的分類器來過濾雜訊與分類資料！
* 運用高效率的 Few-Shot 方法打造分類器— 分類器的訓練方法百百種，本議程預計使用 SetFit ，可以在極少量的標註樣本下，快速打造出強大的分類器。
* 評估與分析— 不只談訓練，更需要進行評估與分析，科學地驗證模型究竟是真的還是瞎猜。

誰適合來聽這個議程？
* 開源狂熱份子— 想了解開源 LLM 的技術細節。
* LLM 領域的初學者— 想知道在「Prompt Engineering」之外，如何透過微調技術（Fine-tuning）改善資料流程的開發者。

這個議題期望帶來什麼樣的影響力？
* 我們是 TwinkleAI— 一個致力於建立「臺灣在地資料集與模型」的社群，也藉由讀書會等活動，推廣 LLM 相關知識的普及，目前已公開多筆資料集以及數顆繁體中文模型。
* 人人都能學會的 LLM— 透過大量公開的資料，人人都能入門 LLM 的相關知識；並且理解 LLM 的運作脈絡，你可以更有效率的馴服 AI！！

Can a community design a robust open source RISC-V Core? Maybe even a whole MCU? Open Source, Verified so you can make a commercial Chip? That is what the OpenHW Foundation based in Europe is doing with it's members spanning the whole globe. Let us give you an update how our fully open source MCU got radiation hardened in a research project and who international companies use and contribute to our Cores like the famous CVA6 and what makes the Model work. Finally a quick overview about the different IP (including AI Accelerators) the OpenHW is hosting under an Apache 2.0 license.

打開大型開源專案，面對一整個陌生的 repository、龐雜的程式碼與交錯複雜的 dependency，熱情往往瞬間冷掉。

這場演講中，我會帶著 Coding Agent 走進 Zed Editor 的 codebase，從零開始理解問題、追查 bug、梳理脈絡、提出修改，並在台上一路推進到送出 Pull Request。整個過程不只呈現成功片段，而是盡可能還原真實開發現場：如何探索陌生專案、如何與 AI 一起釐清線索、如何判斷它的推論是否可靠，以及當它失誤時，如何把方向重新拉回來。

如果你曾想貢獻開源卻不知道從哪裡開始，或你也好奇 AI Coding 工具在真實、混亂、不可預期的工程情境中究竟能幫上多少忙，這場演講會給你一個沒有濾鏡的答案，以及一套可以立刻帶回去實踐的方法。

在 AI 時代中，過去軟體開發的方式有了很多改變，也帶來非常多不同的契機。你是否想過能在 Ruby 或者 Rails 的環境中，透過 AI 動態地實作新功能？

Kobako 原本是為了在 Ruby 中實現 Cloudflare 提出的 Code Mode 機制，讓 AI 直接撰寫腳本替代大量的 MCP 工具，所設計的 WebAssembly 沙盒（Sandbox）

然而，受到 druby 的啟發，Kobako 能夠利用 Ruby 的語言特性，動態與宿主（Host）環境的任意物件進行無縫互動，反而讓 AI 能夠以完全不同的形式來協助軟體開發。

沙盒技術正是今年被大量討論的「駕馭工程（Harness Engineering）」其中一項重要支線。這場演講將圍繞著「如何安全運行程式碼」的核心，分享 Kobako 的開發與探索過程，展現一個善用 Ruby 語言特性而生的安全沙盒。

Most AI solutions in e-commerce today are still rule-based chatbots. The next step — intelligent assistants powered by RAG and function calling, capable of working with product catalogs and guiding buyers through purchases in a conversation — is gaining traction but remains far from mainstream adoption. And on the horizon, a third model is already taking shape: fully agentic commerce, where a buyer's AI agent independently discovers, compares, and purchases products without ever visiting a store's website.
What makes this shift possible is open source. The entire infrastructure for agentic commerce is being built on open standards and protocols licensed under Apache 2.0. First came universal protocols — Anthropic's MCP for agent-to-service interaction and Google's A2A for agent-to-agent communication. Then, specialized commerce protocols emerged on top of them: Google's UCP backed by Shopify, Stripe, Visa, and 20+ partners, and OpenAI's ACP co-developed with Stripe. All open source. All community-governed.
In this talk, we'll explore where the industry currently stands on this evolutionary ladder, how the approaches of key players differ, why they chose open source as the foundation for commercial infrastructure, which early experiments have already failed — and what sellers and developers should be doing today to prepare for a world where the storefront is a context window.

近年 AI coding assistant 快速發展，但對許多開發者來說，真正困難的問題仍然是：

不知道該從哪開始
文件太多看不完
webhook/debug 很難排查
sample code 不知道如何修改

在這場分享中，我們將以「LINE Bot 開發學習流程」為案例，探討 AI 如何改善 Developer Experience。

我們結合：

Gemini
MCP Server
Antigravity CLI
LINE 官方文件

打造一個能協助開發者學習與開發 LINE Bot 的 Developer Assistant。

除了介紹技術架構外，我們也會分享：

AI 如何改變開發者 onboarding
Developer Relations 在 AI 時代的新挑戰
怎麼讓 AI 不只是產生 code，而是真正幫助開發者理解與學習

最後也會現場 demo：
從零開始透過 AI 建立一個 LINE Bot workflow。

Many of us know SPY×FAMILY — a “family” where each member has a hidden identity. At first, it looks like a simple family story, but behind it is a network of hidden relationships.

What if we could visualize such hidden relationships in knowledge?

In the open-source world, we have access to a huge amount of unstructured data: Wikipedia, documents, and web pages. These sources are easy to read, but difficult to reuse, connect, and track as their content changes over time. Relationships may be hidden in text, but their importance, context, and changes over time are even harder to see.

The core of this session is a step-by-step demonstration of how to turn a Wikipedia page into a knowledge graph using Neo4j and the Neo4j LLM Knowledge Graph Builder. The demonstration uses LLMs to extract entities and relationships from the Wikipedia page, and stores the extracted knowledge as a graph that can be explored, compared, and reused.

Then we will pick two versions of the same Wikipedia page — past and present — and compare them as graphs. This allows us to see how knowledge evolves: what was added, what changed, and how relationships grow over time.

This session is for developers, data engineers, and open-source contributors who want to build their own knowledge graph environment. By following the steps, participants will learn how to start from open data, build a graph, compare versions, and apply the same approach to their own documents or web content.

This talk is not only about building graphs. It is about exploring knowledge, comparing it, and understanding how it grows.

Everything in this session is based on open data and open tools. No special dataset is required — just use the data already around you.

「Token」既可以翻譯成硬幣，也可以翻譯成憑證。過去幾年，區塊鏈社群反覆嘗試把人的聲譽、影響力與信任關係代幣化，但早期專案大多沒有成功：個人代幣常被炒作成網紅迷因幣；去中心化聲譽平臺則難以和既有社群網站競爭，因產品過重、缺乏 traction 而沒落。

我們會從過去的失敗案例出發，討論近期幾個新的技術與產品方向，包括：零知識證明的身份，將不同來源的信任「加總」在一起使用、從應用中抽離出來的社交圖譜、讓聲譽能像貨幣一樣傳導的網路設計，以及 EIP-8004 所描繪的 Agent 之間鏈上支付並評價的情境。當未來的交易、評價與身份訊號逐漸可被鏈上觀察，我們也可能用類似反洗錢的 heuristic，辨識協同洗評價的帳號集群，在去中心化網路建立關於聲譽的新概念。

隨著 Kubernetes 環境邁向超大規模與多雲複雜化，傳統的 SRE 自動化腳本與預定義規則已難以應對「未知之未知」的系統風險。2026 年的維運思維正在發生移轉——我們不再僅是追求「自動化 (Automation)」，而是致力於實現「自主化 (Autonomy)」。

本議程將分享如何運用 kagent——CNCF Sandbox 的 Kubernetes 原生 Agentic AI 框架，搭配 A2A (Agent-to-Agent) 協議，讓不同專長的 Agent 能像人類專家一樣相互協商、委派任務並達成共識，在 K8s 上打造一組真正會協作的 SRE Agent。我們會從三個面向切入：

1. 自主協作架構：A2A 協議如何定義 Agent 間的發現機制、通訊邊界與衝突仲裁，讓異質框架的代理也能無縫協作
2. 從觀測到行動的閉環：kagent 如何讓 Agent 不只「看見」異常，更能協助工程師推理、決策，並在 Kubernetes 與雲端服務上執行修復，與人類團隊共同完成從感知到行動的完整閉環
3. 從意圖到安全執行：將使用者的目標 (Intent) 轉化為可稽核的 Kubernetes 操作，並透過 Human-in-the-Loop 機制守住自動化的邊界

In Software-Defined Vehicle (SDV) architectures, virtualization is an important technique for isolating software functions. SoDeV, an SDV platform being developed by Automotive Grade Linux, uses Xen for virtualization. In Xen, a Driver Domain (DomD) owns physical devices and provides para-virtualized interfaces to other domains. Zephyr is a good fit for this role because it combines broad device support with a small footprint, enabling compact and well-isolated driver domains.

In this session, we will present our work on running Zephyr as a Xen driver domain, including current upstream progress. We will explain why smaller Zephyr-based driver domains are attractive, and discuss practical challenges that appear in real systems, such as partitioning hardware cleanly across domains, handling shared resources like clock control, and dealing with the associated challenges on the Xen side.
We will also demonstrate Zephyr’s DomD support live—expected to be upstream by the time of the session—on the Renesas/Retronik Sparrow-Hawk V4H Board and Raspberry Pi 5.

Through this demonstration and discussion, attendees will see what is already working today, what benefits this approach can bring, and how the ideas may be applied in their own projects. We also hope to share the remaining open challenges with the community and encourage discussion on how Zephyr-based driver domains can grow into a practical open-source building block for future SDV systems.

https://pretalx.coscup.org/media/coscup-2026/submissions/3GQQBH/resources/Using_Zephyr_to_Build_Smaller_Drive_MDuOCms.pdf

The Mongolian script is mainly used for Mongolian. The script is in daily use in the Inner Mongolia Autonomous Region of the People's Republic of China. The script mainly used in Mongolia is the Cyrillic script, but the Mongolian script is being reintroduced in Mongolia.

The Mongolian script should be displayed vertically, but vertical writing for the script is not well supported in most software. In particular, most global social media do not support vertical writing for the script. Therefore, Mongolian script users write sideways and post images containing Mongolian script text.

Therefore, I proposed and implemented partial support for the Mongolian script on Mastodon. I made it possible to display Mongolian script text vertically without changing the UI layout. This approach attracted attention and influenced other fediverse software. New users joined Mastodon because Mastodon supports vertical writing for the Mongolian script.

This talk is about the Mongolian script, issues that occurred in this approach, and the influence of this approach. This approach for internationalization demonstrates advantages of the Fediverse over proprietary global social media.

醫療隱私，你在意嗎？本場將會簡介如何申請停止利用權、目前的限制，還有台灣現存具有大量實名個資的政府資料庫。

台灣的就醫資料多年來，未經病人同意，分享給產業與學界使用。自台灣人權促進會、台灣女人連線、健保監督聯盟三個民間團體發動退出權訴訟以來，健保資料庫目的外利用陸續停止販售光碟、限縮至僅供研究使用。直到2022年憲法訴訟最終確認政府必須讓人民實踐停止利用權，也就是不同意將個資提供其他目的使用。去年，台灣終於完成修法，開始讓民眾可以行使停止利用權，但在立法過程中卻增加不少例外，大幅縮小停止利用權的範圍。

除此之外，台灣還有不少法律規範不明、對個資當事人權利保障尚不清楚的資料庫，需要公民社會一起監督。

This session shares the real journey of how the GNOME Nepal community successfully revived Ubuntu Nepal after more than a decade of inactivity. It will walk through the challenges of restarting a dormant open-source community, including rebuilding trust, finding contributors, and creating momentum from zero.

The talk will break down the exact strategies used, community outreach, event-driven growth, collaboration between GNOME and Ubuntu ecosystems, and leadership structure. It will also highlight mistakes, lessons learned, and what actually worked in the Nepali context.

Finally, the session will translate this experience into a practical framework that attendees can apply to revive or bootstrap Ubuntu Circle and similar communities in their own regions.

More info: https://events.canonical.com/event/146/contributions/943/

世界是由原子組成的：微小、單純、各司其職，卻能堆疊出萬物。你有沒有想過，同樣的概念也能用來打造軟體？

這正是 UnJS 的核心哲學。UnJS 是由 Nuxt 作者 Pooya Parsa 發起的開源生態系，遵循 Unix 哲學，專注打造單一用途、高品質、且不綁定框架的 JavaScript 工具，例如 h3、Nitro、ofetch、unbuild、unstorage 等。每個套件就像一顆原子，把一件事做到極好，組合起來便撐起了 Nuxt、Vite 周邊，乃至無數現代 JS 專案的基礎建設。

這場 talk 會帶你認識 UnJS 這個組織、它的設計理念與運作方式，並走訪生態系中幾個關鍵的「原子」，看看它們各自解決什麼問題。

如果你對這個浩瀚的宇宙也有興趣，歡迎一起來參加這場星際冒險，讓我帶你一起航向 UnJS 宇宙！

本議程將探討居住在台北、且完全依賴 Linux 桌面環境的外籍居民與外國訪客所面臨的挑戰與困境。在臺灣，處理日常生活和行政事務往往需要與高度在地化的特定數位基礎設施進行互動。從基於晶片卡（智慧卡）的政府服務——例如全民健保（NHI）系統、網路報稅、自然人憑證——到傳統上僅支援 Windows 或 macOS 生態系的在地銀行網路 ATM（WebATM），Linux 使用者經常會遇到獨特的軟體相容性障礙。講者將分享其個人經驗，並詳細說明他們如何成功克服這些挑戰，在台灣作為 Linux 桌面使用者順利生存。

More info: https://events.canonical.com/event/146/contributions/947/

究竟讓 OpenClaw（龍蝦）利用 本地開放模型透過 Home Assistant 控制智能家居，會發生甚麼事？Amanda 會分享她的發現：究竟有甚麼更智能的自動化機會可以實踐？有甚麼方面不太可行？又發現了甚麼風險？

這是 Amanda 在過往 Women Techmakers Hong Kong 國際婦女節活動、香港開源年會、OpenTechConf 及 COSCUP 開源人年會所做的 Home Assistant 系列分享的續篇。

關鍵詞：#OpenClaw #LocalLLM #Gemma #Qwen #HomeAssistant #SmartHome #AgenticAI #AIagents #MCP

有鑑於大部分人不熟悉OpenStreetMap與Wikidata的匯入規則，特地運用COSCUP時段來處理，

以下成功案例：

• 村里匯入與連結Wikidata與戶役政資訊系統代碼
• 山屋
• 臺北好水飲水點
• 河川相關 (宿霧維基百科的問題)

以下有狀況的案例：

技術或是授權問題的案例：
- 村里匯入時參考舊資料，漏掉臺南2018年整併的里
- 宿霧維基百科bot產生條目/Wikidata項目的重覆或是整併河川問題
- 登山路徑
- ETC門架
- 環境資訊協會的飲水地圖

爭議處理機制：

• 社群共識與執行回退
• OpenStreeetMap Foundation Data Working Group，近期 AED 爭議

透過 Google 所推出的開源模型和開源工具，你可以打造出一個屬於自己工作助手的 AI Agent ，幫助你在日常工作上，能夠有一個小幫手。

當數發部推動公共程式，過去唐鳳擔任政委時也曾經推過將開源開放資料精神推入採購範本中，為什麼仍難以看到政府進行開源呢？軟體公司在承接政府標案的過程，為何整體生態仍顯得如此封閉？

每一個現狀的背後，都有其形成的脈絡。今天的演講，將從兩位講者的視角，拆解開源進入政府體系時可能面臨的阻力：從政府採購制度的運作方式，到實際導入開源的各種挑戰。除了理解這些脈絡，也希望邀請大家一起思考，是否存在能夠施力與介入的空間。

當我們使用 Claude Code、Gemini CLI 或 OpenAI Codex，只要輸入一句「幫我修好這個 bug」，agent 就能搜尋專案、讀取檔案、修改程式碼、執行測試，遇到錯誤後還會重新調整做法。

但這些事情並不是語言模型單獨完成的。純模型推論不會直接打開你的硬碟、執行 shell command 或保存工作進度；真正把模型接上專案資料、工具與作業系統的，是位於模型外面的 Harness。它負責整理 context、執行工具呼叫、管理權限、限制可操作範圍，以及保存 session 與執行狀態。

這場演講將透過三套 coding agent，帶大家理解 Harness 的不同面向：從 Gemini CLI 看最基本的 Agent Loop；從 OpenAI Codex 理解 approval、sandbox 與信任邊界；再從 Claude Code 看 instructions、skills、memory 與按需載入的 context 如何支撐長時間工作。

但 2026 年出現了一個重要轉折。Anthropic 在 2026 年 7 月 24 日表示，針對 Claude Opus 5、Claude Fable 5 等較先進模型，Claude Code 刪除了超過 80% 的 system prompt，而且在 Anthropic 自己的 coding evaluations 中沒有測得明顯退步。Claude Code 也開始讓模型動態產生專屬於當前任務的多代理 workflow。這代表過去寫在 system prompt 裡的大量工作規則，正在逐漸交給模型自身的判斷與規劃能力。

這是否表示 Harness 終將被模型取代？演講最後會提出一個更精確的答案：規劃、工具選擇與任務拆解可能愈來愈由模型負責，但 permission、sandbox、憑證、資源限制、稽核紀錄、測試結果與復原機制，仍然必須由模型外部的系統強制執行。

聽完這場演講，聽眾將能區分模型、agent 與 harness，理解 coding agent 為什麼可以修改程式碼卻不應該任意控制整台電腦，也能掌握下一代 agent 系統正在從「長 prompt、固定流程」走向「精簡指令、按需 context、模型動態編排與外部強制驗證」的方向。

你每天用 Claude Code 寫程式，但真的知道每輪 turn 燒了多少 token、context window 還剩幾趴、cache 有命中嗎？辛苦寫的 skill 到底被呼叫了多少次？
ccxray 是一支透明 HTTP proxy + 即時 web dashboard，夾在 Agent 與 API 之間。把所有的 request 和 response 都 log 下來，並提供清楚的視覺化。
本場演講將揭露本專案的開發過程。
https://github.com/lis186/ccxray

在聯邦宇宙 (Fediverse) 上，使用者的使用者名稱就是他們的姓名和地址。儘管來自世界各地的人們使用多種語言訪問聯邦宇宙，但幾乎所有用戶名都僅限於拉丁字母和數字，例如 @[email protected]。我們認為，使用者應該能夠使用自己的語言和字元建立使用者名，例如 @小明@範例.測試 或 @김@예시.테스트。我們稱之為 “globally inclusive Fediverse handles”「全球包容性 Fediverse 用戶名」。

本次演講將解釋為什麼用戶名目前僅限於字母和數字。我們將探討規範的作用，以及 Mastodon 等現有軟體的應用。我們回顧了其他地址類型（例如電子郵件地址 जिम@डाटामेल.भारत 和網域 http://ยูเอทดสนบบบบ）的國際歷史化。我們列出了 DNS、Unicode 和 IETF 關於允許和禁止使用哪些字元的一些規則：聯邦宇宙可以以此為基礎進行建構。

我們基於電子郵件地址和網域的歷史，提出了一條前進的道路。這條道路始於那些勇敢的先驅者，他們希望在自己的聯邦宇宙用戶名中使用自己的語言，即使這並非易事。下一步是幫助擴展規範，使其具有全球包容性。第三步是為開源軟體做出貢獻，以消除其對使用者名字符號的限制。希望許多這樣的先驅者都能參加 COSCUP 會議。也許這次會議將是我們相遇並開始合作的機會。
（這是個糟糕的翻譯；原文英文版比較好。）

在傳統 EVM 的世界裡，透明度是一把雙面刃，所有的代幣餘額、轉帳金額與交易流向都赤裸裸地攤在鏈上，這不僅讓使用者毫無隱私可言，更滋生了無數的 Mempool 搶跑攻擊 (Front-running) 與惡意 MEV。

如果我們能讓代幣的「狀態」變成密文呢？

本議程將深入探討由 OpenZeppelin 與 Zama 共同推動的革命性草案——ERC-7984 (Confidential Fungible Token)。本議程將解析如何利用全同態加密 (FHE) 技術與指標型 (Pointer-based) 架構，讓 Smart Contract 在「不解密」的情況下，直接對加密餘額進行加減運算與驗證。本議程將從底層架構出發，對比傳統 ERC-20 的明文盲點，實地剖析 fhEVM 環境下的合約開發挑戰，並探討這項技術將如何徹底顛覆 DeFi 的資安與隱私遊戲規則。

這幾年大家都在談 Multi-Agent，但把任務拆成四段、替四個 prompt 加上不同角色，真的就算 Multi-Agent 嗎？如果四個 Agents 只依序傳接結果，它和一般 workflow 又有什麼差別？

這場 talk 將以一個可重現的 Debugging War Room 為案例：使用者從 Discord 回報「不同 thread 的對話內容互相污染」，由 Google ADK 編排 Incident Commander、Triage、Antigravity Investigator 與 Evidence Critic。Agents 不只分工，還會平行蒐集證據、提出假設、駁回缺乏證據的診斷，並根據調查結果重新規劃下一步

The intersection of cloud-native principles and edge computing necessitates robust, scalable architectures capable of handling intermittent connectivity and resource constraints. This talk explores the design patterns for building resilient hybrid infrastructure tailored for local inference tasks. We will discuss the challenges of maintaining state and orchestrating services across distributed environments using Kubernetes. The session will detail how to architect control planes that gracefully handle edge node disconnections and the strategies for deploying containerized AI workloads seamlessly across diverse hardware environments. By focusing on the foundational cloud-native technologies, attendees will learn how to construct reliable systems that bring computation directly to the user's environment.

Intro: 一年一度的 COSCUP 即將尾聲，希望利用最後一個小時的時間，讓大家也有機會分享這兩天的所見所聞，而不只是聽議程。若有興趣，也可以 AMA 了解如何在明年不只是以參加者的身分參與，或許明年的妳也能加入籌辦團隊，或成為站上台分享的講者。

靜態應用安全測試（SAST）工具是軟體安全開發流程中不可或缺的一環，然而許多靜態分析工具往往產生大量誤報，導致開發者在人工審查上耗費巨大成本，甚至因「告警疲勞」而忽略真正的漏洞。

本議程將分享一套完全開源的混合式漏洞驗證框架，透過三階段流水線大幅降低 SAST 工具的誤報率：

第一階段：多工具統一掃描。整合 cppcheck、flawfinder、RATS、CodeQL 四款開源 SAST 工具，對 C/C++ 專案進行掃描，並將各工具不同格式的掃描結果統一轉換為標準化格式。

第二階段：CPG 語義上下文擷取。利用開源程式分析平台 Joern 建構 Code Property Graph（CPG），針對每一筆 SAST 發現的可疑漏洞行，自動擷取完整的函式上下文、資料流路徑、caller/callee 關係、以及全域變數賦值分析，為 LLM 提供充分的語義脈絡。

第三階段：LLM 漏洞驗證。將 CPG 擷取的上下文資訊，交給 LLM 進行漏洞路徑分析，最終對每筆發現做出「確認漏洞」或「誤報」的判定。

以 SQLite 等真實開源專案為實驗基準，評估了此框架在 Precision、Recall、F1-score 等指標上的表現。實驗結果顯示，此框架能有效過濾大量誤報，同時維持對真實漏洞的高偵測率。

聽眾將了解如何運用 CPG 為 LLM 提供精準的程式語義上下文的實作經驗，並在真實 C/C++ 專案上降低 SAST 誤報率的具體數據與最佳實踐。

這場 50 分鐘的工作坊／座談，從個人到組織，依序處理三件事。

第一，建立個人隱私風險矩陣。把威脅來源分級：廣告追蹤與資料仲介、詐騙與盜帳號、親密關係加害者、跨境盤查、針對性監控，對應到四個暴露面：數位身分、行動裝置、SaaS 與雲端、金流。每一格給出以開源工具與裝置內建設定為主的預設配置建議，涵蓋通訊、筆記、行事曆、檔案同步、密碼管理、瀏覽與搜尋等日常情境。

第二，自我檢核方法學。我們不評測所有工具，而是教方法：如何看 App 內嵌的追蹤器、如何觀察裝置真正連去哪裡、如何讀懂 iOS App Privacy Report、對照 NIST Privacy Framework 與 OWASP MASVS 做最小自評，並參考 Privacy Guides 等開源社群的資訊。

第三，組織層面的多人協作隱私。針對 NGO、獨立媒體、小型公司。古典層面：共享密碼管理、端對端加密協作、群組通訊的後向／前向保密差異、組織遭遇法律調取資料時的事前準備。前瞻層面：Shamir Secret Sharing、門檻簽章（FROST、TSS）、MPC、Private Set Intersection、OpenMLS。重點在辨識什麼情境下這些東西真的有用，而不是密碼學細節。

工作坊不提供推薦清單，提供的是判斷力：讓你在會場結束後遇到新工具、新威脅、新法規，仍然知道怎麼自己對號入座。

As AI workloads continue to expand beyond the cloud, developers are increasingly looking for open, efficient, and flexible platforms to run models at the edge and on personal devices. RISC-V, as an open instruction set architecture, is emerging as a promising foundation for this shift.
In this session, Martin will share practical engineering experiences from building AI-capable RISC-V systems — covering key areas such as CPU–accelerator integration, software stack enablement, and optimization for real-world workloads.
The talk will explore how Linux-based environments can support AI development on RISC-V today, what challenges remain across toolchains and runtimes, and how upstream collaboration is helping accelerate ecosystem maturity.

More info: https://events.canonical.com/event/146/contributions/952/

曾幾何時，你有沒有想過「畫大餅」的由來可追溯到三國時期？魏國盧毓曾以「名如畫地作餅，不可啖也」比喻空有名聲、不能實用。原來一句職場吐槽，也藏著意想不到的冷知識。

在資訊爆炸的時代，碎片化知識往往轉身即忘。為了讓學習與記憶變得更有趣，我們開發了開源趣味專案——逆轉喵判：一款結合 AI Agent、冷知識審判、卡牌對戰與桌面虛擬萌寵的智慧互動系統。

使用者在日常與 Agent 互動時，系統會根據對話補上一則相關冷知識，並延伸小問題；答對後可獲得貓飼料，用來餵養桌面貓，提升牠的飽食度與好感度。隨著好感度變化，貓貓會解鎖不同外觀、動作與互動反應，讓碎片知識透過養成回饋被重新記住。

為避免冷知識淪為隨機產生的有趣廢話，逆轉喵判以工程化方法建立評分流程，透過來源查證、語意比對與另一個 LLM 裁判，從冷度、可信度、關聯度、驚奇度、趣味度與可傳播度建立六邊形評分，將冷知識轉化為可收藏、可出戰的「知識喵牌」。

玩家可帶著日常獲得的知識喵牌，透過另一套對戰系統，與未知挑戰者展開冷知識決鬥；桌面貓也會成為戰鬥夥伴，牠的飽食度、好感度與心情將影響對戰中的分數權重、技能觸發率與情境加成。本場分享將拆解 Prompt Engineering、Skill 設計、幻覺降低、LLM 裁判與遊戲化對戰機制。

前端技術不只能做網站，也能成為製作 2D 遊戲的完整工具鏈。但如果 Unity / Godot 已經能跨平台，Phaser 也能直接做遊戲，為什麼還要把 React、Redux 放進遊戲架構裡？

本議程將分享如何使用 React、Phaser 與現代前端工具，打造一款可在 Web 與 Mobile 上運行的遊戲產品。Phaser 擅長處理遊戲核心，例如 scene、sprite、animation、input 與 game loop；React 則更適合處理遊戲外層的產品介面，例如選單、設定、狀態顯示、modal、流程切換與 responsive UI。

當遊戲不只是 canvas 裡的一段互動，而是包含多個畫面、流程、資料與產品體驗時，如何切分 Phaser 與 React 的責任邊界，就會成為架構設計的關鍵。本分享會討論哪些狀態應該留在 Phaser，哪些狀態適合交給 React / Redux 管理，這套架構如何延伸包裝成手機 App，以及 Web stack 相對 Unity / Godot 在開發速度、測試、自動化、部署與產品整合上的取捨。

For OSS to fulfill its potential in Automotive, the industry must learn from past mistakes and successes, then chart a more strategic course forward. The author brings experience of applying OSS to real-world vehicles from 3 OEM projects, including V2X IoT infotainment system and data-closed loop platform across vehicle and cloud.
In this talk, the author shares lessons learned from the painful deployment process of the open-source SDV projects. It starts from a practical experience of in-vehicle performance tuning, to process signals of the whole vehicle (> 10,000) while only consuming below 2K DMIPS. It also unveils the methodologies for trigger-to-upload and transmission prioritization, ensuring guaranteed safety-related data delivery in remote diagnostic services, even under poor network conditions. This also covers topics of CI/CD of OSS in mission-critical scenarios, by showcasing a story of building an in-vehicle real-time tracing feature for log and network packets. It serves as a workflow tool for better collaboration with other vendors, to escape from the blame game.
The session also gives an example of leveraging fuzzing technology to actively prevent intrusion.

RAG（檢索增強生成）在真實生產環境的落地，常受限於企業資安紅線與硬體資源。本分享以 Mohuhu 平台為例，探討如何利用開源 LLM 與系統整合技術，解決台灣上市公司資料中複雜的語意關聯與搜尋容錯問題。

我們將解析如何將 AI 能力拆解並注入系統環節：

• LLM 驅動索引強化：利用 Google Gemini 作為知識 Agent，在入庫階段自動產出非結構化別名（如「護國神山」、「2330」），從根本解決向量搜尋在特定領域的語意缺失。

• 四策略融合檢索（Hybrid RAG）：本系統核心為「加權評分引擎」，將檢索拆解為四個維度並合計信心分數：
  1. 精準比對：確保代號與統編之絕對準確。
  2. 中文模糊搜尋：處理名稱錯置與冗餘詞。
  3. 注音/拼音容錯：解決輸入法未切換（如 vm6vm42j/）之痛點。
  4. RAG 向量語意：整合本地 Ollama (bge-m3) 與 pgvector 處理深層語意。

• 高資安環境部署取捨：針對離線地端場景，提出「AI 預處理、地端輕量化檢索」架構。透過 PyInstaller 封裝，讓企業在完全離線下仍能享受 LLM 強化後的體驗。

• 自動化工作流：利用 OpenClaw 與 Telegram Bot 監控從爬蟲到 Embedding 的 ETL 管線，並實作失敗自動回補機制。

聽眾獲益
1. 混合搜尋實作：四路並行加權架構與權重調校細節。
2. RAG 實戰策略：利用 LLM 預處理提升特定領域檢索召回率（Recall）。
3. 工程設計模式：在資安、硬體限制與 AI 效能間取得平衡的落地經驗。

Open source is not only software we use, but a way for engineers, students, companies, communities, and even countries to learn and grow together. However, many people in Asia still face barriers when trying to join global open source communities: language, cultural distance, lack of confidence, and limited organizational support.

In this keynote, I will share how we have approached these challenges in Japan through Kubernetes Upstream Training Japan, Cloud Native Community Japan, localization activities, and corporate open source strategy. These efforts started as local-language onboarding, but gradually evolved into a pathway that helps users take their first steps toward real upstream contribution.

I will also discuss why sustainable contribution cannot depend only on heroic individuals. Companies, universities, OSPOs, policy makers, foundations, and local communities all have roles to play in building participation infrastructure. Through Japan’s experience, I hope to explore how Asian communities can learn from each other and build stronger bridges to global open source.

• Slido Audience Q&A

What if your CMS could not only host a collaborative blog or a news site, but also directly become a node on the Fediverse — followable, replyable, boostable by Mastodon users?

The Drupal ActivityPub module is turning this into a "just build a website" task. Leveraging Drupal's long-standing strength in flexible content modeling, any content type can map to an ActivityStreams object type, every user is an actor, and pairing it with the Blog module gives you a multi-author publishing platform that the Fediverse can follow.

Funded by NLnet, maintainer Swentel is sprinting toward the 1.0.0 release. Major milestones including Shared Inbox and the Mastodon-compatible API have already landed.

Meanwhile, last year's release of the Drupal CMS distribution and features like Recipes have made Drupal genuinely install-and-go. The pieces are falling into place — this path is finally accessible to non-developers.

In this talk I'll walk through how the module works, demo a multi-author blog being followed from Mastodon live on stage, and share what I've observed as a site builder and small-time contributor about what Drupal brings to the Fediverse.

SVG 和 Lottie 已經是常見的設計與動畫格式，但真正放進應用程式時，許多工程細節才會浮現：不同平台上的視覺結果是否一致、複雜動畫是否影響 UI 效能、設計素材如何被載入與重複使用、API 如何讓開發者修改場景中的元素。ThorVG 是 MIT 授權的開源 C++ 向量圖形引擎，支援 SVG、Lottie 與 2D rendering，v1.0 是專案邁向成熟應用的重要里程碑。

這場分享會從 ThorVG 主要貢獻者的視角，介紹 SVG 與 Lottie 跨平台渲染背後的實作經驗。我會透過幾個實際案例說明：圖形與動畫資料如何進入繪製流程、相容性問題如何影響最後呈現、API 設計如何服務應用程式與 contributor，以及效能、檔案大小、穩定性與維護成本之間如何取捨。聽眾不需要圖形學背景，可以從 ThorVG 的例子理解一套開源基礎函式庫如何從「功能可用」逐步走向「能被真實產品依賴」。

Twenty years ago, getting a custom circuit board made was slow, expensive, and painful. Then pooling services like OSH Park, JLCPCB, PCBWay, and Seeed Studio made it cheap, predictable, and open to anyone. Tim 'mithro' Ansell believes custom silicon should work the same way, and he has spent the last decade making it happen. While at Google, he drove the release of the SkyWater 130 nm PDK, the world's first open source PDK (the "toolkit" a factory publishes so you can design chips for their production line), along with the free OpenMPW shuttle program built on top of it. Add free design tools like OpenROAD and LibreLane and on-ramps like Tiny Tapeout, and today anyone can design a real chip using nothing but open software. Now with wafer.space, Tim is enabling real low volume production by anyone - hobbyist, scientist, startup and even you! Your design can become 1,000 real chips for as little as $2.50 USD each. Tim shares how we got here, what it takes to go from code on your laptop to a tray of working silicon, and how to get started even if you have never touched hardware.

For those who already know the ecosystem, Tim digs into the details of wafer.space and its shuttle runs on the GlobalFoundries GF180MCU open source PDK, a mature 180 nm mixed signal node that has shipped billions of ICs. Each run offers fixed ~20 mm² slots on a 5 metal layer stack with MIM capacitors and poly resistors. Designs go through an automated platform that handles sign-off (DRC, LVS, ERC, and antenna) whether you use LibreLane, OpenROAD, a proprietary flow, or a mix. You bring your own pad ring and ESD, and every slot returns 1,000 bare or chip-on-board dies. Run 1 taped in December 2025 and the wafers are back from the fab, so Tim has real silicon and real lessons to share: what worked, what broke, and what has improved. Run 2 is now being manufactured, and the upcoming Run 3 is your chance to get your own design onto a wafer. Come find Tim on Discord if you want to dive in before the talk.

本計畫源於民間司法改革基金會（司改會）的一場草根立法實踐，嘗試以社會運動的集體動能，集結科技、法律與人權背景的公民夥伴們共同草擬《數位權利基本法》。這不只是一份法典的產出，更是公民社群主動參與治理，試圖將所凝聚的價值轉化為推動政策的法條的努力過程。

在這場次中，我們首先會分享《數位權利基本法》的關鍵精神與內涵，再來進一步提出法律的制定本身即是一種價值觀的優先排列選擇—而民間對於開源、commons價值的嚮往與推進，也可以嘗試以「法律制定」作為載體，還促進更全面而穩健的政策落實。

《數位權利基本法》第十七條「公共程式原則」，探討如何落實公共資金開發成果開放予全民共享，落實數位公地的精神；第十八條「健全數位環境之落實」，旨在從法制面上構築支持數位公民權的基礎設施，確保群眾能在健康、永續的數位生態中共同協作與成長。

這是一場進行中的嘗試，我們誠摯邀請大家針對條文設計、實務落地及倡議路徑共同腦力激盪，期盼能將這份民間立法成功轉化為具體政策推力。

The Linux Foundation: The Linux Kernel Mentorship Program (以下簡稱 LKMP) 為 The Linux Foundation 主辦的實習計畫，目標是引導對 Linux Kernel 有興趣的開發者開始參與 Linux Kernel 開發與社群貢獻。

在本場議程中將會詳細介紹 LKMP 實習制度，如何進行申請，歷年來申請的錄取率等等資訊，最後簡單介紹我在 LKMP 計畫中所獲得到的幫助。

希望對於 LKMP 實習或是對 Linux Kernel 有興趣的聽眾在聽完本場議程之後，能夠獲得關於 LKMP 的詳細資訊，以及了解如何進行準備。最後成功參與 LKMP，逐步加入到 Linux Kernel 社群中。

Hyperledger Fabric (HLF) 擁有嚴謹的架構與豐富的官方文件，但在企業級環境實際落地與維運時，工程師往往會遇到文件上沒有寫的「驚喜」。本議程將濃縮過去一年在 HLF 專案中經歷的真實踩坑血淚史，帶領聽眾潛入 HLF 的底層架構，探索那些在 Tutorial 中學不到的實戰排障技巧。

本場分享將圍繞三個真實的維運災情與架構迷思展開：
- 末端憑證輪替大翻車與底層拆解：當更換末端憑證時，面臨「兩個 Channel 各自只成功更新一半」的驚險時刻。我們將從更新腳本一路往下追查，剝開底層 Envelope 結構的真實邏輯，找出背後的真相。
- 從「重啟治百病」到 GitHub 發 Issue：遇到連官方文件都找不到的神祕報錯 failed determine org 怎麼辦？分享從使用重啟作為 Workaround，到最終深入追蹤原始碼、並向 HLF 官方提交 Bug 單的開源參與歷程。
- 通往 Orderer 的單向道：破解 gRPC 網路連線的常見迷思，探討為何 Peer 到 Orderer 其實只需要單向連通，背後可能有什麼機制與優缺點。

AI Agent 已經不只是一個會寫程式的工具。從 Claude Code、Codex、Gemini 到OpenCode，不同 Agent 能力正在快速演進；但對企業來說，真正困難的往往不是模型夠不夠強，而是如何讓 Agent 在符合內部規範、權限治理與基礎設施要求的前提下，被團隊穩定採用。

實際導入時，使用者常常還是得自己處理 system prompt、MCP、skills、slash commands、工具安裝、SDK、CLI、專案起始檔案與執行環境。這些設定散落在個人經驗、團隊文件與本機環境裡，讓 AI Agent 很難從工程師個人工具，變成企業可管理、可複製、可擴展的工作方式。

本次將介紹 Aileron 開源平台, Aileron 的目標不是只讓 AI 更會寫 code，而是讓組織可以用標準化的方式提供 Agent 工作區，讓使用者打開 workspace 就能開始工作。

為了讓這件事成立，Aileron 聚焦在三個關鍵設計：

1. 讓 Agent 更容易被企業採用
   透過集中式 Marketplace、模板、權限與標準化能力，將 system prompt、MCP、skills、slash commands、起始檔案與工具需求包裝成可分發、可選擇、可治理的工作區能力。企業不需要依賴每個人手動拼裝 Agent 設定，而是可以用平台化方式管理不同場景的 Agent 使用方式。

2. 讓使用者更容易開始工作
   Aileron 將 Chat、檔案管理、Git、Web Terminal、OpenSpec 與常用 CLI / SDK 整合在同一個 workspace 中，並透過 base image 預先準備執行環境。使用者不需要先安裝一堆工具、處理權限或設定本機環境，就能直接進入可工作的Agent workspace。

3. 與 Kubernetes 結合，支撐正式環境部署
   Aileron 透過容器化 runtime 與 workspace-operator，將每個 Agent workspace 轉換成 Kubernetes 中可動態佈建、隔離、重現與管理的執行環境。這讓 Agent 不只是換 prompt，而是真的進入對應任務的工作場景，也讓企業能用既有的 K8s來承載 Agent 工作負載。

本次分享重點包括：
1. 導入 AI Agent 時，從個人工具走向平台化工作區會遇到哪些門檻
2. Aileron 如何用 Marketplace / 模板系統，讓 Agent 能力變成可分發與重用的 workspace capability
3. base image、容器化與預裝工具，如何降低使用者開始工作的成本
4. workspace-operator 如何結合 Kubernetes，動態建立可隔離、可重現、可管理的 Agent workspace
5. 使用 OpenSpec 開發 Aileron 的歷程與實務經驗

閃電秀講者指南 / Lightning talk speaker guide

閃電秀是一個由多場超短時的議程發表構成的一個表演性質居多的活動，通常會被放在獨佔時段，所有會眾都會聚集到這個會議廳觀賞這齣表演，稱之為閃電秀 (Lightning Talks)。

Lightning Talks feature a series of ultra-short presentations that are highly engaging and entertaining. Usually scheduled in a dedicated, exclusive time slot, all attendees gather in the main hall to watch the show.

報名以及了解相關資訊請參考 / For registration and more information, please visit:
https://s.coscup.org/lt26

閃電秀講者名單 / Lightning Talk Speaker List：
- 1. Product Coach agent
- 2. Make your own (open source) silicon chip for under $200USD.
- 3. SERPENTINE 開源自由曲線3D建模軟體
- 4. CoVTuberGraph: 使用Graph結構紀錄 VTuber 歷史
- 5. Japanese Open Source Activities with TV media.(Japanese idols cons etc.)
- 6. Godot In-game MCP server
- 7. 開源職涯
- 8. 從活動報名平台到活動報到平台
- 9. EZ100PU 讀卡機Linux驅動現況
- 10. DLLM 研究x教育社群
- 備取1. How our co-op has a cost-per-employee of $0 by self-hosting FOSS SASS
- 備取2. 不只 Good First Issue: 開源新手如何找題目
- 備取3. I made my own AI Assistant
- 備取4. "Personal Medical Knowledge Wiki" I built an AI- compiled personal health wiki, inspired by Andrejkapathy's post
- 備取5. 職人手作開源 App 在 2026 還能翻出什麼新花望

請於 16:00 抵達 RB105 左側前排座位向工作人員報到
如未於時間內完成報到將視同棄權，並將名額遞補給備取

Please arrive at RB105 by 16:00 and check in with a staff member at the front-row seats on the left side. Failure to complete check-in within the allotted time will be treated as forfeiture, and your spot will be reassigned to a waitlisted candidate.