bump: v1.0.0

Author: panayang

Cargo.lock

@@ -2,4 +2,23 @@
 
 [![Discord Server](https://img.shields.io/discord/1459399539403522074.svg?label=Discord&logo=discord&color=blue)](https://discord.gg/D5e2czMTT9)
 
-A arXiv daily reader writen in rust.
+A arXiv daily reader writen in rust with LLM capabilities.
+Also contains a special encryption algorithm based on rssn symbolic functionalities for surprises.
+We have also implemented a custom gemma3 preset based on candle-rs.
+
+## Installation
+
+```bash
+# Clone the repository
+git clone https://github.com/panayang/arxiv-daily.git
+cd arxiv-daily
+
+# Install cargo-leptos
+cargo install cargo-leptos
+
+# Run the project
+cargo leptos watch
+
+# Or you may want to have a release (optimized) version to run LLM
+# python3.14 release.py
+```

README.md

@@ -9,3 +9,138 @@
 ## Reporting a Vulnerability
 
 Please do not report a vulnerability via Github issues. Any vulnerability shall be reported by emailing to Pana.Yang@hotmail.com or via our official website security reporting section (under construction).
+
+## Developer Security Standards (Mandatory for Organization Members and Recommended for Contributors)
+
+### **I. Authorized Operating Environment**
+
+* **Recommended OS:** Fedora KDE Plasma Desktop
+* **Disk Encryption:** LUKS (Linux Unified Key Setup) **must** be enabled by default during installation.
+
+### **II. Mandatory Security Suite**
+
+To ensure system integrity and real-time threat detection, the following tools must be installed and configured:
+
+* **Endpoint Monitoring:** Wazuh-agent
+* **Hardening & Auditing:** SELinux (set to `Enforcing`), firewalld, Lynis
+* **Threat Scanning:** ClamAV, rkhunter, chkrootkit
+* **System Integrity:** AIDE (Advanced Intrusion Detection Environment), unhide
+* **Network Scanning:** Daily Nmap scan of the local network (e.g., `192.168.1.0/24`)
+* **Security Server:** Wazuh-server (includes Wazuh-dashboard, Wazuh-manager and Wazuh-indexer), Greenbone Community Edition
+
+### **III. Identity & Access Management**
+
+* **2FA Requirement:** Hardware-based authentication via **YubiKey** is mandatory for all organizational accounts and SSH access.
+
+---
+
+### Appendix
+
+```text
+# sysctl settings are defined through files in
+# /usr/lib/sysctl.d/, /run/sysctl.d/, and /etc/sysctl.d/.
+#
+# Vendors settings live in /usr/lib/sysctl.d/.
+# To override a whole file, create a new file with the same in
+# /etc/sysctl.d/ and put new settings there. To override
+# only specific settings, add a file with a lexically later
+# name in /etc/sysctl.d/ and put new settings there.
+#
+# For more information, see sysctl.conf(5) and sysctl.d(5).
+
+# --- A. Network Hardening ---
+
+# Protect against IP spoofing (source validation)
+net.ipv4.conf.all.rp_filter = 1
+net.ipv4.conf.default.rp_filter = 1
+
+# Ignore ICMP broadcast requests to avoid being part of Smurf attacks
+net.ipv4.icmp_echo_ignore_broadcasts = 1
+
+# Ignore bad ICMP errors (prevents some types of attacks)
+net.ipv4.icmp_ignore_bogus_error_responses = 1
+
+# Disable IP source routing (usually unnecessary and exploitable)
+net.ipv4.conf.all.accept_source_route = 0
+net.ipv4.conf.default.accept_source_route = 0
+
+# Disable secure ICMP redirects
+net.ipv4.conf.all.secure_redirects = 0
+net.ipv4.conf.default.secure_redirects = 0
+
+# Log spoofed packets, source routed packets, and redirects
+net.ipv4.conf.all.log_martians = 1
+
+# Protection against SYN flood attacks (enables SYN cookies)
+net.ipv4.tcp_syncookies = 1
+
+# Increase the maximum number of connections waiting for acceptance
+net.core.somaxconn = 4096
+net.core.netdev_max_backlog = 5000
+
+# --- B. Filesystem / Permission Hardening ---
+
+# Disable magic SysRq key (unless you need it for emergency debugging)
+kernel.sysrq = 0
+
+# Enable restriction of link/symlink traversal (to prevent user links in world-writable dirs)
+fs.protected_hardlinks = 1
+fs.protected_symlinks = 1
+
+# Restrict the permissions of dmesg to non-root users (hiding kernel messages from attackers)
+kernel.dmesg_restrict = 1
+
+# Restrict unprivileged users from using the bpf() system call
+kernel.unprivileged_bpf_disabled = 1
+
+# Randomize the virtual address space layout (ASLR) - Default is usually 2, ensure it's on
+kernel.randomize_va_space = 2
+
+# --- C. Resource and Memory Hardening ---
+
+# Prevent non-root users from writing to /proc/sys/vm/*
+kernel.yama.protected_sysctl = 1 
+
+# Restrict the dumping of memory (core dumps)
+fs.suid_dumpable = 0
+
+# Controls memory allocation behavior - often set to 1 or 2. 
+# A value of 2 ensures no overcommit, helping prevent stability issues when memory runs out.
+vm.overcommit_memory = 1
+vm.max_map_count=262144
+
+# Restrict non-root user create too many User Namespace
+user.max_user_namespaces = 10000
+
+# ---D. Yama Settings ---
+
+# Restrict ptrace to only ancestor processes (prevents snooping)
+kernel.yama.ptrace_scope = 1
+```
+
+```text
+0 2 * * * /usr/bin/freshclam --quiet
+5 2 * * * /usr/bin/flock -n /tmp/clamscan.lock /usr/bin/nice -n 19 /usr/bin/ionice -c 3 /usr/bin/clamdscan --multiscan --fdpass --quiet / >> /var/log/clamav-scan-$(date +\%Y\%m\%d).log
+10 2 * * * /usr/sbin/chkrootkit >> /var/log/chkrootkit-scan-$(date +\%Y\%m\%d).log
+15 2 * * * /usr/bin/aide --check
+0 3 1 * * /usr/bin/logger "REMINDER: Run 'aide --update' after a system upgrade to maintain database integrity."
+20 2 * * * /usr/sbin/unhide proc tcp udp sys >> /var/log/unhide-scan-$(date +\%Y\%m\%d).log 2>&1
+40 2 * * * /usr/bin/lynis --cronjob --quiet >> /var/log/lynis-report-$(date +\%Y\%m\%d).log
+50 2 * * * /usr/bin/rkhunter --cronjob --rwo >> /var/log/rkhunter-scan-$(date +\%Y\%m\%d).log
+0 4 * * * /usr/local/bin/daily_nmap_scan.sh >/dev/null 2>&1
+```
+
+```shell
+#!/bin/bash
+
+# Define variables
+TIMESTAMP=$(date +"%Y-%m-%d")
+SCAN_DIR="/var/log/nmap_scans"
+TARGET_SPEC="192.168.1.0/24"
+
+# Create the log directory if it doesn't exist
+mkdir -p $SCAN_DIR
+
+# Run the Nmap scan
+/usr/bin/nmap -A -T4 $TARGET_SPEC -oN $SCAN_DIR/nmap_scan_$TIMESTAMP.txt
+```

SECURITY.md

@@ -1,3 +1,3 @@
 version https://git-lfs.github.com/spec/v1
-oid sha256:d7783e2b901075fda76316d9bb1008f7bfd7e4257727c18872bf77e3cfa1b62a
-size 280
+oid sha256:f21fe6fc5dcad4833baf8e6674ff070c0e86ff42000daed899b95d12bda870bc
+size 528

assets/surprise.bin

@@ -1,6 +1,6 @@
 [package]
 name = "scraper"
-version = "0.9.0"
+version = "1.0.0"
 edition = "2024"
 rust-version = "1.90.0"
 authors = ["Xinyu Yang <Pana.Yang@hotmail.com>"]

scraper/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "shared"
-version = "0.9.0"
+version = "1.0.0"
 edition = "2024"
 rust-version = "1.90.0"
 authors = ["Xinyu Yang <Pana.Yang@hotmail.com>"]

shared/Cargo.toml

@@ -1,2 +1,2 @@
-key = "x^8 +x^7 + x^6 + x^5"
+key = "x^8 + sin(x)"
 payload = "A very secret surprise message!"

surprise.toml

@@ -1,6 +1,6 @@
 [package]
 name = "web_app"
-version = "0.9.0"
+version = "1.0.0"
 edition = "2024"
 rust-version = "1.90.0"
 authors = ["Xinyu Yang <Pana.Yang@hotmail.com>"]