Opening

In 2026, hackers breached European supermarket refrigeration systems and forced defrost cycles, turning cold-chain rupture risk from theory into live fire. Today we're covering Coldframe, a single-file, zero-dependency honeypot that precisely mimics the web fingerprints of real Danfoss and Dixell controllers, and LearnHarness, a 9.2k-star AI learning companion desktop app that uses knowledge graphs to solve the "read the docs but still don't grasp the core concepts" problem. I'll explain why it's not just another chatbot.

Today's Open Source Picks

1. Coldframe: Single-File Honeypot Built for Real ICS Intrusions

• What it is: Built in response to the 2026 European refrigeration hack where attackers forced defrost cycles. It emulates the web fingerprints of two real refrigeration controllers, the Danfoss AK-SM 800A and Dixell XWEB EVO, so attackers think they've hit real hardware, while every action is only logged, never executed. Ideal for DevOps, self-hosted security researchers, and engineers wanting to observe ICS scanning behavior.
• Recent buzz: 289 points, 70 comments on Hacker News (observed 2026-11-13 at publication), 73 GitHub stars, MIT license.
• Key features: Exact replication of HTTP header ordering, TLS 1.2 certificate (CN=DanfossSM800A), favicon hash, Angular landing page Last-Modified/ETag; built-in detection for 8 CVEs/public exploits (including CVE-2025-41450 code-of-the-day bypass, CVE-2026-25085 XWEB Pro auth_mode bypass); post-login returns a fake dashboard with a defrost button, all operations logged as JSONL; provides summary.py 24-hour auto-summary reports.
• Quick start: Local test PERSONA=danfoss HTTP_PORT=8080 python3 -I honeypot.py spins up on port 8080; production deploy by pasting cloud-init.yaml into an Ubuntu 24.04 VPS user data, two minutes to live (a $4 Droplet suffices), just remember to only expose the honeypot port and your own SSH IP.
• vs. alternatives: More focused on web fingerprint accuracy and specific vulnerability detection than eppser/danfoss-ak-sm-decoy, and adds the Dixell XWEB persona; lighter than the general-purpose industrial honeypot Conpot, optimized for cold-chain attack surface.
• Who it's for: Security engineers wanting low-cost, high-interaction ICS honeypots to observe real-world scanning and exploitation behavior.
• Link: hedgerow-dev/coldframe

2. LearnHarness: Knowledge-Graph Desktop App That Helps Engineers Actually Learn New Tech

• What it is: An AI learning companion desktop app built for engineers (macOS/Windows/Linux). Uses a four-stage flow, "measure existing understanding → plan dependency graph → Socratic step-by-step teaching → varied practice", with a persistent knowledge graph tracking propositions and reasoning chains. Solves the real pain point of "reading docs but not grasping core concepts." AGPL-3.0 open source, supports local models, no subscription lock-in.
• Recent buzz: 9,210 GitHub stars (new project within 30 days, observed 2026-11-13 at publication), primary language TypeScript.
• Key features: Teaching phase enforces "predict → explain → confirm" three-step loop, forcing you to think out loud instead of passively receiving answers; practice questions auto-generated from the knowledge graph, requiring active recall instead of recognition; desktop-native drag-and-drop PDFs/images, voice input, web search (Tavily/Brave/Exa/Firecrawl/Ollama), visual explanations and interactive demos; all data stays local, system prompts viewable and editable.
• Quick start: Download the platform installer from learnharness.ai (macOS signed DMG, Windows installer, Linux AppImage/.deb), launch, configure API key or local model endpoint (Ollama, OpenAI-compatible endpoints both work), start your first lesson.
• vs. alternatives: Unlike ChatGPT/Claude which just give answers, or generic RAG tools, LearnHarness forces "thinking out loud" and builds a personalized knowledge graph, closer to an Anki + tutor hybrid; AGPL-3.0 license means commercial internal deployments need compliance review.
• Who it's for: Engineers who want deep understanding of new architectures, languages, or paper core concepts, not satisfied with shallow Q&A.
• Link: amosblomqvist/learnharness

Closing

Two tools today, one defense, one offense. Coldframe exposes the ICS attack surface in the lightest way possible; LearnHarness internalizes knowledge in the most thorough way. If you have a cloud box and want to watch real scanning behavior, Coldframe can be running tonight. If you need to chew through a gnarly tech stack, LearnHarness is worth downloading for one lesson. See you tomorrow, keep digging for the good stuff.