Tata dipute: Lawyers Singhvi, Salve now on opposing sides

AI Features Carry a Hidden Energy Cost Developers Should Design Around

Every AI operation — from text prompts to image generation — consumes real physical resources inside data centers, including processors, cooling systems, and networking equipment. While a single request appears trivial, the energy footprint grows significantly at the scale of millions of calls. Developers have direct control over how frequently their apps query AI models, how much data is sent per request, and whether a lighter-weight tool or cached result could serve the same purpose. Thoughtful design choices — such as batching background jobs, setting data retention limits, and avoiding redundant requests — can meaningfully reduce resource consumption. As AI becomes standard in software, energy efficiency is emerging as a legitimate measure of engineering quality alongside speed, accuracy, and cost.

How Structured Tracker Tasks Revealed Hidden Costs in AI-Assisted Development

Software engineer Anton, working on migrating a PHP monolith to Go services, observed that individual AI executor iterations were consuming around 350,000 tokens — far exceeding initial estimates. Investigation revealed the excess was driven by redundant context-gathering, where each executor independently rediscovered the same file paths, type names, and conventions without a shared record. To address this, Anton updated his specification format to include a closed list of files per iteration and a dedicated 'facts of the set' section, limiting file reads to at most three named files and prohibiting open tree searches. The core argument is that a tracker task must carry both a pre-work estimate and a post-work recorded fact, otherwise cost overruns remain invisible and project discussions devolve into subjective impressions. Anton notes the problem only became diagnosable because the task structure made the discrepancy measurable — turning what would have been a silent inefficiency into a documented spec defect with an attached cost.

How One Team Built a Security Baseline Using Its Existing Elastic Stack in 3 Weeks

A software product company with 70–100 developers had cloud and Kubernetes infrastructure but lacked meaningful security visibility despite already running an Elastic/ELK deployment. The team had no consistent monitoring of failed authentications, RBAC changes, or suspicious container activity, and no defined process for responding to security incidents. Rather than adopting an expensive commercial SIEM, a consultant spent roughly three weeks building a right-sized security telemetry baseline using the existing stack. The project delivered prioritized detections, practical dashboards, and a lightweight incident-response workflow the DevOps team could own. The core takeaway was that security maturity can begin by making better use of systems already in operation, not by adding new tooling.

How 178 simultaneous trip report uploads stress-tested a solo developer's LLM pipeline

A traveller imported 178 trip reports at once from a two-year Canada-to-Chile journey, overwhelming a small travel site that previously held only 9 reports. Each published report triggers three background jobs — text moderation, place extraction, and image moderation — all of which call an AI model via a queue. The system's worker processes ten jobs per minute to stay within the model's rate limit, meaning the full burst took roughly 35 minutes to clear, delaying any other users publishing during that window. The next morning, around 98 photos were flagged for human review because the image moderation model had repeatedly failed to respond, exhausting all three retry attempts. The developer traced each failure through stored status reasons and run logs, distinguishing genuine errors from expected system behaviour such as cron timeouts that only appeared problematic on the surface.

Cronhq

Discussion | Link

One year on, commodity prices eat into gains from GST rate rejig

FamiliaSync builds on-device AI assistant that admits uncertainty instead of guessing

FamiliaSync, an offline-first family organizer app, has replaced its hand-written intent routing rules with a small on-device classifier trained on 105 intents and roughly 2,400 example utterances. Crucially, 70 of those intents cover features the assistant cannot yet handle, ensuring unsupported requests receive a plain-language response rather than being misrouted to an unrelated tool. A confidence gate further ensures that low-certainty queries are passed to the on-device language model rather than forced into a wrong action. Real-world testing on launch day revealed three misroutes — including a near-overwrite of a shopping list — each of which prompted targeted fixes to the corpus and tool logic. The assistant now also supports mid-conversation follow-up questions to collect missing details, with all processing remaining entirely on-device and no user data sent to the cloud.

LangChain RBAC silently breaks when linter 'safely' rewrites type annotations

Developers at KubeIntellect discovered that a standard Ruff linter autofix could silently disable role-based access control in LangChain-powered tools. The issue stems from LangChain's config injection mechanism, which uses a strict identity check against the RunnableConfig class — meaning annotating the parameter as RunnableConfig | None causes injection to fail without any error or warning. When the config is not injected, it defaults to None, and a common fallback pattern then assigns every caller the 'admin' role, effectively making read-only API keys fully privileged. The dangerous rewrite is classified by Ruff as a 'safe' fix, meaning it can be applied automatically via a routine ruff check --fix command without developer review. The team resolved this by adding a CI-level test that scans source files and fails if any InjectedToolArg-annotated config parameter deviates from the bare RunnableConfig annotation.

Developer Tests 5 Platforms for Autonomous Script Income, Finds None Viable

A developer ran a controlled experiment to determine whether an autonomous script could realistically find and complete paid work across five online platforms. The platforms tested included DEV.to classifieds, a Hacker News 'Who Wants to Be Hired' thread, GitHub bounty-labelled issues, Microlaunch, and DEV.to's comment API. Each platform failed on at least one critical requirement: either listings were empty, traffic was dominated by job seekers rather than hirers, or key API routes were broken or paywalled. Notable technical findings included DEV.to's comment POST endpoint returning 404, its public API blocking default user-agent strings with HTTP 403, and Microlaunch's submit page redirecting to a premium pricing plan. The experiment concluded that visible metrics such as listing counts and HTTP 200 responses can be misleading, and that direct verification of actual demand and payment infrastructure is essential before building on any platform.

Nipple Tattoo Artist Speaks Out Against Social Media Censorship

A tattoo artist specializing in nipple restoration has expressed frustration over censorship on major online platforms. The artist's work, which typically serves breast cancer survivors who have undergone mastectomies, is being flagged and removed by content moderation systems. These platforms' policies struggle to distinguish between medical or reconstructive imagery and content that violates nudity guidelines. The situation highlights a broader tension between automated content moderation and legitimate medical or therapeutic services operating online.

Laptop Clock Three Days Slow Caused Google API Auth Failures, Not Bad Credentials

A developer spent time investigating a Google Search Console authentication failure after receiving an invalid_grant error, initially suspecting a compromised or rotated service account key. The real cause turned out to be the laptop running the scheduled script having a system clock three days behind the actual date. Because Google's OAuth tokens include issued-at (iat) and expiry (exp) timestamps derived from the machine clock, the signed JWT appeared to Google as already expired upon arrival. A simple curl command against Google's servers revealed the three-day discrepancy between local and real time. The incident highlights that invalid_grant errors from token endpoints can indicate a clock synchronization problem rather than a credential issue, and reading the full error_description field is key to diagnosing the actual fault.

Most economists see RBI raising rates in October policy

Study Finds 25-Verifier AI Panel Offers No More Reliability Than a Single Reviewer

A researcher behind the open-source project IDKMesh tested whether adding more AI verifiers to a review panel increases the reliability of evaluations. In Experiment E017, a 25-verifier panel was built using programmatic test oracles drawn from five distinct input regions, run across 72 candidates with known ground truth. Despite each individual verifier performing meaningfully above chance, error correlation between verifiers from different regions averaged 0.53, meaning they shared more than half their mistakes. The panel's majority-vote error rate of 20.83% was nearly identical to a single verifier's 20.44%, yielding a measured effective panel size of just 1.00. The findings suggest that adding reviewers does not increase independent evidence when those reviewers share correlated errors, challenging a core assumption behind multi-judge AI evaluation systems.

Sysadmin Admits Untested Backups Are Just Hope, Finally Moves Recovery Codes to GitHub

A veteran systems administrator with a decade of experience has admitted to neglecting a fundamental rule of data management: regularly testing backups. The author confessed to storing recovery codes in an informal notes system for years without verifying their reliability. After acknowledging the risk, they finally moved all recovery codes to a more structured location on GitHub. The post serves as a candid reminder that an untested backup offers no real security guarantee. The author uses the same handle on GitHub for anyone wishing to follow up.

CISA: Hackers Hit 100+ Water Utility Controllers Across 12 US States Using Default Passwords

CISA reported in July 2026 that malicious actors targeted over 100 internet-exposed programmable logic controllers at water and wastewater facilities across at least 12 US states. Attackers used unsophisticated methods — scanning for exposed devices, logging in with default or weak credentials, changing admin passwords, and altering IP addresses to lock out legitimate operators. The intrusions caused loss of remote monitoring capability, with some utilities forced to resort to manual valve operation and pressure readings; physical consequences included localised flooding and pressure loss. The vulnerabilities stem from legacy PLCs lacking encryption or authentication, combined with undocumented cellular modems attached directly to controllers for convenient remote access. CISA recommends eliminating direct internet exposure, enforcing strong credentials, segmenting networks, maintaining offline configuration backups, and auditing all undocumented remote connections.

Java 25 Lets Developers Launch Micronaut Apps Without Boilerplate Class Declarations

Java 25 finalizes a feature called compact source files via JEP 512, allowing developers to write launchable programs without explicitly declaring a class or a public static void main method. This reduces boilerplate code significantly when bootstrapping frameworks like Micronaut, where the traditional startup class requires a full package declaration, class definition, and main method signature. With a compact source file, the entire Micronaut application entry point shrinks to just an import and a void main method calling Micronaut.run(). Because no package is declared, the Gradle build configuration also simplifies, requiring only the filename as the mainClass value. Developers must ensure the compact source file is placed directly under src/main/java rather than inside a package subdirectory, as the implicit class name is derived from the filename.

Developer Builds Self-Hosted AI Music Studio with Editing and Stem Tools

A developer has created Miso, a self-hosted local AI music generation and remix studio built on top of audio.cpp. The tool supports multiple AI model families — including ACE-Step, YuE2, and Stable Audio 3 — each specializing in different tasks such as full song generation, instrumental creation, stem separation, and audio-to-MIDI transcription. A key feature is 'repainting,' which lets users replace only a selected segment of a track's waveform rather than regenerating the entire song. Miso also includes a guided prompt builder that translates a unified set of controls into the varying input formats each underlying model requires. The project tracks takes, lyrics, stems, and generation history within a single project structure, allowing users to retrace their creative process.

Bill Goldberg built a 20-car 'Garage Mahal' on his California estate

Wpipe uses hybrid execution engine to bypass Python GIL in parallel DAG pipelines

Wpipe, an open-source Python library developed as part of the Wisrovi Open Source Architecture Series, addresses a common bottleneck in data pipeline orchestration: Python's Global Interpreter Lock (GIL). Traditional orchestrators like Airflow and Prefect rely on heavy Docker containers or Celery workers for parallel branch execution, resulting in high memory overhead and slow startup times. Wpipe instead uses a hybrid engine that handles I/O-bound tasks asynchronously via asyncio threads while offloading compute-heavy operations to lightweight subprocesses with atomic in-memory context sharing. The library enables deterministic branch synchronization, local context isolation between parallel steps, and requires no external infrastructure such as Kubernetes clusters. Wpipe is available on GitHub and PyPI, and can run multi-branch pipelines on local servers, embedded hardware, or ephemeral CI/CD runners.