Entries for July 6, 2026

  3. Portrait of Onur Solmaz
    @onusoz · /2026/07/06· View on
    yo @huggingface paris hq has a SICK gym to celebrate, I invented some 🤗 exercises for you mandatory for every employee
  4. Portrait of Onur Solmaz
    @onusoz · /2026/07/06· View on
    herdr is going places
    @herdrdev·
    herdr is 105 days old. i started writing a 10,000 github stars celebration post. before i finished it, we passed 12,500! on june 30, herdr hit #1 on github trending. it has stayed in the top 10 since. i’ve been building it solo and full-time, in public from day one: roadmap, issues, feature requests, releases. so instead of just celebrating, i’m opening the stats too: stars, downloads, website traffic, releases, and where the numbers come from. thank you for being part of the herd 🐑
  5. Portrait of Onur Solmaz
    @onusoz · /2026/07/06· View on
    Experimenting with a credential broker, and a telegram based approval flow for giving your claw access to your main @huggingface account
    @onusoz·
    Worried that giving your 🦞 @openclaw agent write access to your 🤗 @huggingface account can risk deletion of your datasets/models/spaces/buckets, or cause irreversible damage? 😱😱😱 No need to be! I have created an agent login helper to run in your YOLO mode remote machine, which prevents any risk of irreversible deletion. Just run: uvx hf-auth-helper agent login There is a specific set of scopes you can choose while creating a fine-grained HF token. These include all read scopes + discussion.write, which let's your agent create PRs. Since you are not giving repo.write, your agent cannot force-push your main branch, change repo settings or delete them It is unfortunately not super straightforward to choose those on the web UI. This will hopefully change soon, and this functionality might even be natively in hf cli Until that happens, use hf-auth-helper to login worry free in your remote or local openclaw instance Your agents will be able to create PRs on datasets/models/spaces, which you will then be able to merge on your own browser 2 caveats: 1) This does not solve the data exfiltration attack vector—nothing does. Make sure to exclude any repos which absolutely must remain private while choosing your scopes. See for more info: 2) As buckets are not repos, your agent will not be able to modify a bucket (add/remove data). To help with that, I have another project on the way, a credential broker. Stay tuned, coming soon Source: Demo authentication flow: