Developer Builds Open-Source SIEM to Fix Security Blind Spots Left by Fail2ban

·4 views

A developer has created CNSL (Correlated Network Security Layer), a self-hosted, lightweight SIEM tool designed to address a core weakness in conventional Linux server security. Standard tools like Fail2ban, NGINX, and database loggers each monitor only their own logs in isolation, making it easy for attackers to slip through by spreading low-volume probes across multiple services. CNSL counters this by correlating activity from web, SSH, database, and cloud logs simultaneously, assigning a dynamic threat score to each actor based on behavior across all vectors. The system is modeled on the MITRE ATT&CK framework and includes a predictive blocking feature that can sever connections based on attack trajectory before any single threshold is breached. CNSL targets both Linux servers and Kubernetes environments, aiming to stop coordinated, multi-stage intrusions that traditional intrusion prevention systems typically miss.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Opus 5.5 Cut Coding Agent Costs by Half Despite Higher List Price Than Sonnet 5

A developer running multi-agent coding workflows on Claude models tracked five days of API spending between September 20–25, comparing Sonnet 5, Opus 5, and Opus 5.5 across 203 implementer pull requests and 411 reviewer runs. Although Opus 5.5 is listed at twice the per-token price of Sonnet 5, it cost roughly half as much in practice, delivering an estimated $0.39 per 100 changed lines versus $1.57–$2.13 for Sonnet 5. The key driver was not output token pricing but the number of API calls per task: Opus 5.5 required only 6 calls per 100 lines compared to 30–38 for Sonnet 5, and cached reads — which made up 68% of spending in one measured window — cost the same $0.20 per million tokens on both models. The developer also found that raising Sonnet 5's effort level increased cost by 35–51% per line with no clear improvement in first-review pass rates. Following the analysis, several workflow changes were adopted, including capping context windows at 400K tokens and extending reviewer cache duration, which together further reduced spending.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Benchmark: Container tool boxr starts 38% faster than Podman in controlled test

A developer benchmarked container startup times for boxr 0.1.44 and Podman 4.9.3 on a 2-vCPU Ubuntu 24.04 VM, running a minimal Alpine image 20 warm times each. Boxr recorded a median startup of 134 ms against Podman's 217 ms, a difference of roughly 83 milliseconds. Both engines ran as root due to user-namespace restrictions in the test environment, and networking was disabled on both sides to ensure a fair comparison. The tester noted several caveats, including that Podman required storage and cgroup workarounds, and that the benchmark covered only a single trivial workload on one machine. Results may differ significantly for real-world workloads involving volume mounts, port publishing, or running actual processes.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Only 3 of 12 Freelance Reddit Subreddits Are Worth Your Time, Analysis Finds

A developer spent several weeks auditing 12 Reddit subreddits commonly cited for freelance work, using Reddit's API and RSS feeds to verify subscriber counts and activity levels. Of the 12, only r/forhire (684,000 subscribers), r/DesignJobs (202,000), and r/gameDevClassifieds (158,000) were found to be active and functional job boards, each with minimum hourly rate floors and strict account age or karma requirements. Several others, including r/freelance and r/WorkOnline, explicitly ban self-promotion or hiring posts, while r/jobbit appears largely abandoned. New accounts face silent post removals due to undisclosed karma thresholds, meaning newcomers must spend weeks building account history through commenting before posting any work offers. All transactions occur off-platform with no escrow or dispute resolution from moderators, making Reddit a viable but high-friction client source that rewards patience over speed.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How a 300ms Voice AI Setting Was Cutting Off 22% of Users Mid-Sentence

A developer discovered that setting Deepgram's endpointing parameter to 300 milliseconds caused their voice AI agent to interrupt users mid-thought in 22% of long responses, after analyzing 1,140 user turns from one week of logs. The endpointing value determines how many milliseconds of silence Deepgram treats as the end of a speaker's turn, but natural thinking pauses in conversation often last 900ms or more. Raising the threshold to 1,200ms reduced cutoffs to 6% but added noticeable latency to every interaction. The developer instead implemented a two-stage fix: keeping the 300ms trigger as a tentative signal, then running a lightweight completeness check using a trailing-word heuristic and a small LLM classifier before the bot responds. This approach brought the cutoff rate down to 3.1% while adding only about 140 milliseconds of median delay, though it required discarding 19% of speculatively generated replies.

0 comments Read more at DEV Community