SShortSingh.
Back to feed

Arbitrary code execution in QubesOS via copy-to-VM error reporting backchannel

0
·1 views

Article URL: https://www.qubes-os.org/news/2026/08/29/qsb-118/ Comments URL: https://news.ycombinator.com/item?id=49496918 Points: 7 # Comments: 0

Read the full story at Hacker News

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Log in to join the discussion and vote.

Log in

Related stories

0
ProgrammingDEV Community ·

Developer builds AI tool to validate planning objections at NSW council hackathon

A developer built Setback, an AI-powered tool, over a weekend for Google's All Things Agentic Hackathon, designed to help residents craft legally valid objections to development applications in New South Wales. The tool analyzes a resident's submission against the statutory list of grounds councils are permitted to consider under NSW planning law, filtering out irrelevant concerns such as property value impacts or personal grievances. Each rejected ground is explained to the resident in plain English, along with guidance on what would make it legally viable. The project was built using a multi-agent AI coding workflow, where several agents worked concurrently on separate parts of the codebase rather than the developer writing code line by line. The build surfaced critical bugs — including silently discarded uploaded evidence and a misconfigured API fallback — that only became apparent through end-to-end testing on live infrastructure, not unit tests or code reviews.

0
ProgrammingDEV Community ·

How to Benchmark an AI Code Reviewer Before Switching to a Free-Tier Model

A developer has shared a structured regression-testing approach for validating AI code review bots before migrating to free-tier infrastructure, published on DEV Community as part of MonkeyCode's product outreach. The method involves creating a benchmark suite of ten pull request diffs, each paired with manually written 'golden' review comments that serve as expected outputs. A comparison script then measures precision, recall, and F1 scores by checking how closely the new model's responses match the golden set. The reviewer bot is packaged as a Docker container and deployed on a free Linux server, with the API key passed as an environment variable. The author argues that skipping this validation step risks silent quality regressions, where a model returns responses without flagging real code issues.

0
ProgrammingDEV Community ·

OSDU Lite lets developers run the OSDU data platform locally without cloud infrastructure

A developer has released OSDU Lite, an open-source, LocalStack-style emulator that runs the Open Subsurface Data Universe (OSDU) data platform entirely on a local machine. The tool is implemented in a single Python file and exposes key OSDU service APIs — including Storage, Search, Legal, Schema, and Entitlements — accessible at localhost with no cloud, authentication, or database setup required. It is designed for three common pain points: local development, CI pipelines, and demos where provisioning a real OSDU deployment is impractical. The emulator replicates realistic platform behaviors such as ingest validation and a simulated asynchronous indexing delay, and ships with a complete Well 360 integration demo using the official Java OSDU SDK. The project is available on GitHub at github.com/sohaibqasem/osdu-lite and can be launched with a single Docker command.

0
ProgrammingDEV Community ·

Why Free LLM Tiers Need Load Testing Before You Ship to Production

Developers using free large language model quotas in production risk unexpected latency spikes and service disruptions, as shared queues and rate limits are outside their control. Two engineering teams recently adopted free model access for core features, only to face performance failures when traffic doubled, costing one team an entire sprint of rework. Open-source project MonkeyCode offers free model access and a free server tier suited for experiments, prototypes, and delay-tolerant background jobs, but the same risks apply. Experts recommend running concurrency-based load tests before adoption, tracking metrics like latency percentiles, success rates, and retry overhead to determine whether a free tier is viable. Additionally, developers should treat free capacity like a staging environment, keep endpoints configurable for easy switching, and always maintain a clear exit path to paid or self-hosted alternatives.

Arbitrary code execution in QubesOS via copy-to-VM error reporting backchannel · ShortSingh