Developer shares MV3 extension preflight checklist to catch release failures early

A developer has published a practical preflight checklist for releasing Manifest V3 browser extensions, aimed at catching issues that only surface after packaging rather than during development. The checklist covers comparing permissions, host access patterns, and content script settings between the last shipped version and the new packaged build. It also recommends mapping each release check to a specific change — such as expanded host access or a modified service worker — rather than relying on a generic test list. The author is building a local command-line tool called MV3 Replay that automates parts of this checklist by reading an unpacked extension and comparing two packaged versions. The tool is in early development, and the author is seeking feedback from Chrome and Edge extension maintainers who already run manual release checks.

Smartphone LED detects hidden cameras with AI

Article URL: https://www.chosun.com/english/industry-en/2026/08/30/SBFXUIJQYZEARKP5T4FBAY25HQ/ Comments URL: https://news.ycombinator.com/item?id=49496292 Points: 101 # Comments: 31

Developer Builds Socratic AI Tutor That Teaches Secure Coding Without Giving Answers

A developer is building Achintisalive, an AI-powered tutoring tool designed to help users learn secure coding through guided questioning rather than direct code fixes. When users submit vulnerable code containing issues like SQL injections or XSS flaws, the tool responds with hints and Socratic prompts instead of ready-made solutions. The project is being developed as part of the Gen AI Academy APAC program, using Google Gemini 1.5 Flash for its AI engine, Streamlit for the frontend, and Google Cloud Run for deployment. A key technical challenge involves engineering strict system instructions that prevent the AI model from outputting direct code corrections. The project is currently a work in progress, with the repository publicly available on GitHub.

A Hidden Assumption in Trading Code Triggered Unnecessary Liquidations

A developer's automated trading program unexpectedly closed all open positions and halted activity for the day after the account owner made a personal cash withdrawal. The program's daily loss guard compared current equity against a stored opening baseline, but the logic assumed only trading activity could move the account value. When the withdrawal reduced equity by $500, the system misread it as a trading loss and triggered an emergency shutdown. The root fix involved detecting out-of-band balance changes — such as deposits or withdrawals — and adjusting all stored baselines by the same amount, so the profit-and-loss calculation continued measuring only trading results. The developer noted this is a broader software pattern affecting any system that caches a reference point while an external actor can silently alter the underlying value.

Vietnam outruns two Asian giants

40 Lines of Go Slashed One Team's LLM Costs by 71% Using Cheap-First Routing

A development team discovered they were routing nearly all LLM requests — including trivial tasks like naming files or generating titles — through an expensive frontier model by default. After reviewing their traffic mix, they built a lightweight Go-based router that sends requests to a cheaper model first and only escalates to the stronger model if the output fails a quality gate. The system moved 81% of requests off the expensive model, cutting the overall bill by 71%, with only a 15% escalation rate. The team found that pre-classifying prompts by difficulty was unreliable, since short prompts can be complex and long ones trivial, making output-based judgment more effective than input-based prediction. They noted that latency, not cost, proved to be the more significant constraint in practice.

Local AI Tools Like Ollama and Gradio Carry Serious Security Risks, Experts Warn

Engineers running local AI models via tools like Ollama, LM Studio, and Gradio often bind servers to 0.0.0.0 to enable multi-device testing, unknowingly exposing their machines to anyone on the same network. Since most of these tools ship without built-in authentication, unauthorized users on shared Wi-Fi can hijack GPU resources, download or delete models, and snoop on private prompts. A separate but common risk involves API key leakage through the system clipboard, where tokens copied from web dashboards can accidentally be pasted into public channels and scraped within seconds. A developer tool called RoamSwitch has introduced features to address both threats, including automatic port shielding when unsafe bindings are detected and on-device regex-based clipboard scanning for exposed secrets. The article urges developers to treat local AI setups with the same security discipline applied to production environments.

Polygon Bridge Flagged High-Risk With 8.2/10 Score in DeFi Security Analysis

A security analysis dated October 26, 2023, by a senior DeFi research team assessed the Polygon Bridge, which secures over $2.8 billion in assets between Ethereum and Polygon PoS. The report assigned an overall risk score of 8.2 out of 10, identifying four critical attack vectors including validator collusion, exit window manipulation, reentrancy flaws, and oracle dependency risks. The most severe threat involves a coordinated 51% validator attack combined with exit fraud, potentially executed during a network upgrade or fork. Researchers also flagged a reentrancy vulnerability in the ChallengeManager contract, where state updates occur after external calls, enabling possible double-slashing or state corruption. The report recommends immediate fixes to challenge-period logic and stronger real-time monitoring of validator activity.

Swiss Police Launch Manhunt After Shooting Leaves One Dead, Five Hurt

A shooting in Switzerland has left one person dead and five others injured, according to local police. Authorities have launched an active manhunt for the unidentified perpetrator responsible for the attack. The incident prompted an immediate law enforcement response in the affected area. Police have not yet disclosed the location or motive behind the shooting.

PM Modi Highlights Drug-Free India, Local Products in 137th Mann Ki Baat

Prime Minister Narendra Modi addressed the nation in the 137th episode of his monthly radio programme Mann Ki Baat, covering a range of social and national themes. He stressed the importance of building a drug-free India and recognised the contributions of women street vendors and sanitation campaigns at the grassroots level. Modi also highlighted the role of technology in preserving historical records and heritage. With the festive season approaching, he urged citizens to support locally made products under the 'vocal for local' initiative. The Prime Minister additionally encouraged people to turn environmental conservation efforts into sustainable business opportunities.

Why AI Engineers Are Moving Beyond Prompts to 'Harness Engineering'

A software engineer reflects on how three years of AI development revealed that prompt quality is rarely the reason agents fail in production. According to a Y Combinator survey of CTOs and CPOs from March 2026, around 40% of AI agent projects collapse after deployment, with leaders consistently noting that the model itself is not the differentiating factor. The real bottleneck, the author argues, lies in the infrastructure surrounding the prompt — including tool access, memory, context management, and loop control. This shift has driven the field from prompt engineering to context engineering, where the entire context window is treated as the core artifact to be optimised. With 75% of YC enterprise companies already deploying coding agents and workflows being redesigned around them, understanding the full agent harness is increasingly seen as essential to production success.

One Killed, Five Wounded in Shooting at Swiss Rave Party

A shooting at a rave event in northern Switzerland left one person dead and five others injured, some critically. Local police confirmed the incident on Sunday. The rave had drawn approximately 3,500 attendees at the time of the shooting. Authorities have not yet disclosed details about the suspect or the motive behind the attack.

Century-Old California Bike Shop Hank & Frank to Close After 101 Years

Hank & Frank Bicycles, a long-standing Bay Area institution, will permanently shut down on August 31, 2026, after more than a century in business. The closure has been prompted by a change in building ownership and upcoming redevelopment plans for the property. Owner Frank Dryer is stepping down after spending decades serving the local cycling community. Dryer shared a personal note with customers announcing the decision. A nearby shop has agreed to continue honoring the lifetime service commitments previously made to the store's patrons.

AI-Generated Database Migrations Are Outpacing Human Ability to Review Them

As AI coding agents like Cursor generate complex SQL migrations in seconds, engineering teams face a growing gap between code output speed and human review capacity. An eighty-line ALTER TABLE script can look syntactically clean while hiding critical semantic errors — such as a NOT NULL column with no default or a foreign key pointing to the wrong parent table. Existing safeguards like CI pipelines, linters, and agent self-review check formatting and parseability but cannot assess real-world impact, such as table locks during peak traffic. Stricter approval policies, including requiring multiple reviewers, do not solve the problem if reviewers are still evaluating raw SQL noise rather than meaningful change context. The core issue is structural: when an agent produces executable migration code faster than any engineer can reason through it, the approval process becomes a formality rather than a genuine safety check.

SBI, SBI Capital Markets plan 1% NSE stake sale

Developer builds dependency-repair agent, uncovers silent failures in security scanning

A developer spent a week building an AI agent designed to not only detect vulnerable dependencies but also apply fixes, run tests, and open pull requests — going further than tools like Dependabot. During development, nearly every major bug encountered reported success rather than throwing an error, making them especially hard to detect. A malformed API query to OSV silently returned 124 false positives instead of the correct three advisories, while a manifest-only scanner missed all real vulnerabilities by ignoring the lockfile and transitive dependencies. A separate merging issue caused a high-severity fix to silently disappear when two branches were combined, despite all tests passing on each individual branch. The experience highlighted a consistent pattern: in security tooling, silent failures that produce falsely clean results are far more dangerous than loud errors.

HDFC Bank’s new CEO hunt sets up a dual test

Building Nginx Load Balancing with DNS-Based Service Discovery Using Incus

A practical home lab was set up to explore Nginx load balancing combined with DNS-based service discovery in a self-hosted Incus environment. The architecture routes client traffic through an Nginx load balancer to multiple backend web servers, with a dnsmasq DNS server resolving a shared hostname instead of relying on hard-coded IP addresses. Nginx is configured with a resolver directive pointing to the local DNS server, allowing it to dynamically update its backend pool whenever DNS records change. This approach decouples service identity from server identity, meaning adding or replacing a backend node requires only a DNS update rather than an Nginx configuration reload. The lab demonstrated that DNS-based discovery offers greater flexibility and scalability compared to static IP configuration, particularly as the number of backend servers grows.

LinkedIn API version expiry silently breaks integrations with no code changes

A developer in Assis, São Paulo, discovered that her LinkedIn content-publishing script stopped working despite no changes to the codebase. The culprit was LinkedIn's REST API requirement for a rolling date-based version header in YYYY-MM format, which expires after a set support window. Once the pinned version 20250601 fell outside that window, the API returned a 426 error rejecting all calls, even with a valid token and correct payload. The error message itself identified the exact problem, allowing a quick fix by simply updating the version header value. The incident highlights a broader lesson: integrations relying on expiring external dependencies — API versions, certificates, or similar — can break without any change to your own code.

Missouri Deputy AG Found Alive After 5-Day Ordeal on Wyoming's Gannett Peak

A Missouri deputy attorney general was rescued after going missing for five days following a climb to the summit of Gannett Peak in Wyoming. The official had successfully reached the peak but subsequently became disoriented and severely dehydrated near Scott Lake. Search and rescue teams located him despite the area's difficult terrain. He is currently recovering and has expressed deep gratitude toward the rescuers who worked to find him.