Vendor Dependencies Fail Quietly When Obligations Change Hands, Not Just When Systems Break

·13 views

Three recent tech stories, including Roku moving its developer repositories from GitHub to GitLab, show how obligations can shift without anyone formally accepting them. The author argues that contracts price custody of code, keys, and hardware, but rarely ensure who answers for a dependency when its holder stops responding. Moved addresses, vulnerabilities inherited through abandoned upstream libraries, and products that lose their supporting service illustrate the same gap. The piece suggests a practical audit: identify who a team could contact at 2 a.m. for each customer-facing dependency and whether that contact survives an acquisition. It concludes that the most critical dependencies often have the thinnest succession planning and that resilience must be designed into architecture rather than secured through contracts alone.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Why a Single Good Backtest Isn't Enough: A Three-Layer Validation Gate

A lone profitable equity curve may simply reflect luck after enough parameter combinations are tried. The author argues the real test is whether a trading rule's edge holds up under slightly different assumptions. Their pre-deployment gate has three layers: a parameter sweep, a monthly consistency check, and a component ablation, each with hard pass/fail thresholds. The sweep looks for a performance plateau rather than a spike at one exact parameter set, using metrics like profit factor, expectancy in R units, and a plateau score across neighboring values. The monthly check guards against results driven by a single outlier month, capping the best month's share of total profit and requiring a majority of positive months. The article illustrates the framework with a MACD divergence rule that passed the first layer but failed the second and third.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Claude Code Hooks: Which Events Add Tokens and Which Reduce Them

The Claude Code hooks reference now documents 33 events, though most tutorials show only a handful of simple examples. Some hooks can raise token usage: stdout on UserPromptSubmit, UserPromptExpansion, SessionStart and PostModelSwitch is added to the conversation, and additionalContext stays there after it is inserted. Other hooks can cut tokens, such as updatedInput on PreToolUse, which rewrites a tool call before it runs, and updatedToolOutput on PostToolUse, which replaces a result before Claude reads it. Each injected string is capped at 10,000 characters, and hooks that fire on every tool call cost more than those that fire once per session. Several pitfalls, including exit code 1 not blocking and timed-out PreToolUse hooks letting calls through, can leave a hook silently ineffective.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer builds local AI tool to filter 19,426 China civil-service exam job posts from one sentence

A developer created CouchFilter, an open-source tool that lets users search China's national civil-service exam position table by typing a single natural-language query. The table lists 19,426 posts covering departments, quotas, majors, degree requirements and locations. The system uses the open-weight Gemma 3 1B model, run locally through Ollama, to interpret the query, while plain Python code performs the exact filtering and ranks results by number of openings. A rule-based fallback parser activates if the model is unavailable. The project was built for DEV's Hacktoberfest Open-Source AI Challenge and is available on GitHub.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

What RAG Is and When It Helps Language Models Answer From Private Data

Retrieval-augmented generation, or RAG, lets a model search relevant documents from a user's own data before responding rather than relying solely on its training. The approach is likened to an open-book exam, since it supplies current or private information without retraining the model. It is especially useful for questions about internal documents, tickets, or policies, and it can reduce hallucinations by grounding answers in source text and enabling citations. The article cautions that RAG adds latency and complexity for tasks like pure reasoning, creative writing, or code generation that involve no private data. Common pitfalls include poor document chunking, retrieving irrelevant passages, and failing to measure retrieval quality rigorously.

0 comments Read more at DEV Community