How a Homelab Grafana Stack Revealed Relentless Bot Traffic Scanning for PHP Files

·1 views

A developer set up a full observability stack on a personal homelab using Grafana, Prometheus, Loki, and several exporters, all deployed via Docker with minimal manual configuration. The setup monitors Nginx instances, a Proxmox host, an Ubuntu server, and Docker containers using tools like node-exporter, cAdvisor, pve-exporter, and Promtail. Once the first Nginx logs appeared in Grafana, the developer discovered unexpectedly high traffic volumes that turned out to be automated bots rather than real visitors. The bots were repeatedly probing the server with requests for PHP files such as /tool.php and /admin-footer.php, despite the site being built entirely with static HTML via Astro. The experience highlighted how home monitoring tools can surface real security noise that would otherwise go completely unnoticed.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

As AI Benchmarks Age and Saturate, Measuring True AI Progress Gets Harder

The launch of GPT-6 Astra, accompanied by NVIDIA CEO Jensen Huang declaring on X that 'AGI has arrived,' has reignited debate about how capable AI systems have truly become. Experts and developers quickly split between excitement and concern, with many questioning whether such milestones signal the end of software engineering as a profession. However, a closer look at AI evaluation reveals a deeper issue: benchmarks used to measure model progress can become outdated, saturated, or methodologically inconsistent over time. Astra's own system card acknowledges that some older evaluations are being retired and newer ones are adopting more realistic testing conditions, meaning a higher score does not always reflect genuinely broader capability. While AI will undoubtedly reshape software development, core engineering responsibilities such as system design, security, and architectural decision-making remain distinctly human concerns that raw benchmark numbers do not address.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to Build an AR Fallback Governor That Protects User Camera Privacy

A developer tutorial on DEV Community outlines how to build an application-side fallback governor for Tencent RTC's Beauty AR feature, ensuring avatar failures do not silently expose a user's camera feed. The core problem addressed is that when AR effects fail due to device overheating, asset loading errors, or OS interruptions, most apps default to the raw camera — a privacy-violating substitution. The proposed governor enforces a tiered degradation ladder: quality avatar, performance avatar, sticker, and finally a paused state if camera consent has not been explicitly granted. It adapts to device capability tiers, avoids oscillating between profiles, and rejects stale async events to prevent race conditions. The tutorial argues that consent must be collected separately for each presentation mode, since switching from an avatar to a live camera feed is a fundamentally different act, not merely a quality reduction.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

JQuickCurl Library Simplifies Multipart File Uploads in Java Using curl Syntax

JQuickCurl is a Java library that lets developers send multipart HTTP file uploads using familiar curl -F flag syntax, eliminating the need to manually configure OkHttp or RestTemplate multipart bodies. The library interprets the @ symbol convention to distinguish file paths from plain text form fields, then builds the corresponding multipart request over OkHttp automatically. Developers can upload single or multiple files, mix files with form metadata, and inject dynamic file paths at runtime using variable substitution in annotated interface methods. The approach keeps HTTP implementation details out of service code by expressing upload logic as a standard curl command string in a Java annotation. The library's behavior was demonstrated against the httpbin echo endpoint, which confirmed correct multipart transmission by returning uploaded file data in its response.

0 comments Read more at DEV Community

ProgrammingHacker News ·

YC-backed Cua seeks Founding Technical GTM Lead

Cua, a startup backed by Y Combinator's P25 batch, is currently hiring for a Founding Technical Go-to-Market Lead role. The position is listed on Y Combinator's official jobs board. This is an early-stage hire, suggesting the company is in its initial growth and commercialization phase. No further details about the role's responsibilities or compensation were publicly disclosed in the listing.

0 comments Read more at Hacker News