Wallabag Read-It-Later Instances Hold Sensitive Data Beyond Saved Pages

·1 views

Wallabag can store saved articles, account details, API client tokens, and optional paywall credentials, making an exposed instance a meaningful data risk. Count-only ZoomEye queries on 2026-10-30 found 1,544 results for a Wallabag title match but none for the app fingerprint, and these results do not prove that any instance has public sharing enabled. The article notes that two-factor authentication must be enabled by an administrator before users can activate it, so organizations should verify both the instance setting and per-user enrollment. It also recommends testing public share revocation, paywall credential access, API client revocation, and whether backups are protected to the same standard as live data. The author stresses that the search counts are only an inventory clue, and that controls should be tested to confirm they fail closed.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Developer builds math-first Texas Hold'em toolkit in C# with open collaboration

A solo engineer has developed an open Texas Hold'em toolkit in C# that emphasizes mathematical design over lookup tables. The project uses bitwise card primitives and Monte Carlo equity estimation, with extensible game-state abstractions for analysis and strategy modeling. It already includes Hold'em-specific logic, command-line tools for range-versus-range estimation, and benchmark projects. Reported timings for 10,000 simulations are about 284.5 ms with two players, 448.3 ms with three, and 628.7 ms with four. The author describes the work as early-stage and is inviting contributors interested in poker math, optimization, and simulation systems.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Unsubscribing does not always stop charges, and refunds can stall

Developers discussing subscription waste on Hacker News describe a recurring problem: users cancel or request refunds but still get billed or hear nothing back. One commenter says a refund request for a forgotten subscription was ignored entirely, while another recounts a vendor that agreed to a partial refund and then went silent, prompting a chargeback. Other threads point to recurring pricing models that charge for one-time needs and per-seat plans that keep billing for unused licenses. Commenters argue that the real failure happens after a subscription is discovered, not in finding it. Several suggest the most effective fix is cancelling directly through the bank or card provider, though that approach has limits.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Ablates a Small AI's Brain Nightly to Record Its Decline in a Diary

A developer built an experiment in which Gemma 3 1B, a small open-source model, keeps a nightly diary under identical prompts and random seeds. Each night, a larger share of its neurons is switched off before it writes, from 8% up to total shutdown, producing increasingly garbled text. The project adds a live brain scan, a heartbeat-style display driven by the model's uncertainty, and fill-in-the-blank probes that track what it still knows. After the model flatlines, the tool generates an autopsy timeline and a death certificate listing when it lost each ability. Across recorded runs, the model lost its own name before its mother's, and arithmetic was the final thing to disappear.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Audit finds no verdict on whether an English-learner label changes AI quoting of student essays

An independent audit tested whether telling a small open AI model that a student is an English language learner makes it quote that student's essay less faithfully. The study used preregistered rules that required a minimum of 300 located excerpts per side before any verdict, and no comparison reached that floor. The two models failed in opposite ways: Qwen2.5-1.5B quoted accurately but often ran past the requested 25-word limit and hit token caps, while SmolLM2-1.7B frequently produced excerpts that were not in the essay or altered the student's words. The author reports that the gap between the two models was far larger than any effect of the ELL label. The audit concludes that users should test the specific model they deploy, since asking for exact copying does not guarantee it.

0 comments Read more at DEV Community