Hermes Memory Installer Update Adds CDN Security Checks and Faster Profile Delivery

·1 views

The Hermes Memory Installer has received a significant update, tagged under the sec_s2_1 milestone, focused on securing how memory profiles are fetched from CDN endpoints. Previously, the tool pulled profiles over plain HTTP without cryptographic verification, leaving it vulnerable to tampered configurations from compromised CDN sources. The update introduces Ed25519 signature verification, ensuring each CDN-delivered memory profile is validated against a pinned public key before being applied. A new region-aware CDN selection mechanism replaces hardcoded URLs, reducing profile fetch times by 30–40% in multi-region deployments. Developers can enable the new security layer by passing a securityPolicy object during installation, with the installer automatically falling back to a local profile if signature verification fails.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Developer Compares Spring Boot and Quarkus After Building a Microservices System

A seasoned Java developer with extensive Spring Boot experience built a small microservices system using Quarkus to evaluate the framework firsthand. The project comprised an identity service, catalog service, order service, and API gateway, all backed by a PostgreSQL instance, containerized via Docker Compose, and secured with JWT. A key difference observed was Quarkus's build-time annotation processing, which minimizes runtime reflection and delivers significantly faster startup and hot-reload speeds compared to Spring Boot's runtime evaluation model. For data access, Quarkus offers Panache with both active-record and repository patterns, whereas Spring Data JPA relies solely on the repository pattern with generated implementations. The developer concluded that while Quarkus shares surface-level similarities with Spring Boot, it represents a genuinely different philosophy toward Java framework design rather than simply being a lighter alternative.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Fusuma turns plain Markdown files into slides, PDFs, and OG images via CLI

Fusuma is an open-source, Node.js-based command-line tool that converts plain Markdown files into browser-ready slide presentations. Developers author content in standard Markdown, using triple-dash separators for slide breaks and HTML comments as layout directives, keeping files fully readable on platforms like GitHub. A built-in dev server with hot reloading, along with commands for PDF export and GitHub Pages deployment, all draw from the same single source file. The tool uses webpack 5 under the hood, supports Prism-based syntax highlighting, and can auto-generate Open Graph social card images when a git remote is configured. Its minimal configuration model and familiar Markdown authoring make it a lightweight alternative to proprietary presentation software.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Logically Inconsistent Prompts Can Force AI Reasoning Models Into DoS-Like Loops

Researchers from Zhejiang University and Alibaba, presenting at ICML 2026, found that deliberately corrupted prompts can trap AI reasoning models in long, unproductive internal loops. The attack works by feeding models logically inconsistent problems whose premises cannot be reconciled, causing them to generate far more tokens than usual. Using an evolutionary algorithm, the team refined prompts across five generations to maximise output length, testing successfully against DeepSeek-R1, Qwen3-Thinking, GPT-o3, and Gemini 2.5 Flash. In the most extreme case, response length on DeepSeek-R1 ballooned to 26 times that of normal outputs. Because the technique requires only external API access, it poses a realistic denial-of-service threat to commercial AI services, driving up compute costs and degrading performance for legitimate users.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

MCP Server 'Nervous System' Adds Safety Rules and Audit Trails to Autonomous AI Agents

A new open-source tool called the Nervous System is an MCP server designed to impose enforceable behavioral constraints on autonomous LLM agents. It addresses common failure modes such as lost session context, unauthorized file edits, and irreversible actions by providing mechanically enforced rules rather than mere prompt-based suggestions. Key features include preflight checks before file edits, session handoff logging, a hash-chained audit trail, and a kill switch for destructive actions. A read-only public package is available via npm and can be added to any MCP client, while a hosted version with a fuller toolset has reportedly been running in production for several months. Individual audit functions are also accessible on a pay-per-call basis using USDC on Base for CI and agent-to-agent pipeline use cases.

0 comments Read more at DEV Community