SShortSingh.
TopTechnologyAI & MLStartupsProgrammingScienceBusinessFinanceCrypto & Web3World
Back to feed
Programming

Local Gemma 3 Tool Audits and Revives Legacy Code Without Sending Secrets to the Cloud

0
·1 views

A developer built a local-first Python command-line tool called The Legacy Code Necromancer for Hacktoberfest's Ghost in the Machine challenge. It runs the Gemma 3 model through Ollama on the loopback address, with a regex scrubber that strips likely secrets before any code reaches the model. The tool scans legacy repositories for vulnerabilities, attempts refactors, and produces a Markdown audit report with a session manifest. In a test on a sample with planted flaws, the model reported 15 findings, of which the human reviewer confirmed 8, including all deliberately planted critical issues. The model's rewrite drafts, however, retained the dangerous patterns and only compiled, so they were judged unsafe to run.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Log in to join the discussion and vote.

Log in

Related stories

0
ProgrammingDEV Community ·

Silent Gaps in Billing Recovery Drive Customers Away, Argues DEV Community Post

A DEV Community piece argues that the silence between automated payment-recovery messages leaves customers guessing whether a failed payment was fixed or their subscription is ending. Such gaps tend to be read as indifference or a trap rather than patience. The author recommends clear confirmations when a card is updated, plain notices when a retry succeeds, and a closing message stating what happens next when recovery ends. The post notes that Swipe Again builds these confirmations and closures into its recovery flow as standard sends. The author concludes that customers tolerate payment failures but tend to cancel when left to guess.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Security researchers flag two risks in NVIDIA NeMo .nemo model files that scanners may miss

NVIDIA NeMo stores models as .nemo files, which are tar archives holding a config and a torch checkpoint that is a pickle, so the checkpoint can carry code-execution payloads. Many pickle scanners do not unpack the outer tar, leaving that payload undetected. A separate flaw in NeMo releases before r2.0.0rc0 failed to sanitise tar member names, allowing a crafted file to write outside the extraction folder (CWE-22, NVD score 7.8). The author released nemo_container_scan.py, an open-source Apache-2.0 tool that inspects .nemo contents in memory without extracting or unpickling anything. It exits with an error code on high-severity findings so it can gate CI pipelines, though it performs static review only and does not prove exploitability.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Student Adds UFW, Fail2Ban and Logwatch to Ubuntu Server Within Wazuh SIEM Setup

A new cybersecurity learner, who works as a full-time teacher, enhanced an existing Ubuntu server and its Wazuh SIEM monitoring environment. The project added three tools: UFW to control incoming traffic, Fail2Ban to ban IPs after repeated failed SSH logins, and Logwatch to compile system logs into readable reports. Testing with Nmap from Kali Linux showed UFW filtering the blocked port, while Fail2Ban successfully banned an attacking IP during a simulated SSH password-guessing attempt. Wazuh recorded the events, and Logwatch delivered a summary report to the server's root mailbox. The author's tests were aligned with MITRE ATT&CK technique T1046, Network Service Discovery.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Seven-Day Retention Logging for Node.js Game Notifications Balances Debugging and Data Minimization

The article argues that a production log for notification delivery should capture enough detail to reconstruct a failed send without storing every player action permanently. It recommends a Node.js-friendly ingestion API with a short seven-day retention window, a stable event schema, and a separate plan for alerting and deletion. The author distinguishes simple event collection from full observability, which would include alert rules, span-tree analysis, and GDPR deletion workflows. Storage cost is framed as event volume multiplied by retained bytes, using a sizing example of about 1.4 GB per week for two million events. The recommended record keeps identifiers, attempt number, status, timestamp, provider, and a correlation ID, while omitting full request bodies to limit sensitive content.

0 comments Read more at DEV Community