Why Ubuntu's App Center Cannot Replace a Real Security Audit of Your System

·1 views

A developer discovered that Ubuntu's App Center only displays packages from the Ubuntu archive and the Snap Store, leaving out every other potential attack vector on a workstation. Running dedicated commands like 'snap list' revealed publisher verification markers, confirming all 21 installed snaps came from known, trusted sources such as Canonical and Mozilla. Auditing APT sources showed seven third-party repositories, all using the modern 'signed-by' scoping method rather than the deprecated apt-key approach. One unfamiliar entry pointing to Google Cloud infrastructure turned out to be Google's Antigravity IDE, verified by matching its GPG key fingerprint against the officially published value. The exercise underlines that surface-level indicators like old package dates or missing icons are misleading, and that proper integrity checks require purpose-built tooling rather than a package browser.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Gemini Omni 1.1 Flash Now Supports Video Extension Up to 40 Seconds

Google's Gemini Omni 1.1 Flash model generates video clips of 10 seconds by default, but a scene-extension feature allows developers to append additional 10-second segments, reaching a maximum total duration of 40 seconds across four segments. The generally available version, released on August 27, 2026, expanded the model's context window to the previous 10 seconds, enabling improved visual consistency and narrative continuity between segments. Extensions work via the Files API, where users upload an existing clip and pass its URI along with a text prompt describing the next scene. Developers can also chain segments using a previous interaction ID, which reduces token usage and better preserves scene state across multiple extension calls. Notable limitations include the inability to insert footage at the beginning or middle of a clip, a 10-second cap on directly uploaded input videos, and restrictions on adding dialogue when extending an uploaded video.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Four Common Myths About Free AI API Tiers Debunked With a Python Script

A developer has identified four widely held misconceptions about free-tier AI model endpoints, commonly seen in issue trackers and code reviews. The first myth is that free tiers use inferior models — in reality, they run the same weights as paid tiers but on a shared queue. The second myth involves trusting p50 latency as a health indicator, when p95, p99, and stall rates provide a far more accurate picture. The third myth is that immediately retrying a timed-out request helps recovery, whereas doing so concentrates load and can trigger a thundering herd effect, making timeouts more likely. A standard-library Python script is provided to help developers verify these myths on any OpenAI-compatible endpoint in under an hour.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Open-Source Job Search Platform Adds Local AI Support via Ollama Integration

A developer building an open-source, AI-assisted international job search platform has released the second iteration of the project, available on GitHub. The update transforms the app from a basic foundation into a functional search workspace where users can import resumes, set job preferences, and interact with an AI assistant. A key addition is support for multiple AI providers through an OpenAI-compatible adapter, allowing users to choose between hosted models or a locally run model via Ollama. API keys are stored server-side and encrypted with AES-256-GCM, and local Ollama users can opt out of providing a key entirely. The design philosophy prioritises user control over privacy, cost, and model performance rather than automating bulk job applications.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why AI Demos Succeed But Products Fail: Four Core Engineering Gaps

Many AI projects that shine in demos collapse in production because a prototype only proves possibility, while a real product must deliver reliability at scale. A common root cause is that teams never define what a 'good' output looks like, making it impossible to evaluate or improve the system systematically. Poor context design is another major factor, as even capable models produce weak results when they lack essential information such as framework details, schemas, or coding conventions. Workflow design is also frequently neglected, with organizations treating the AI model as the entire solution rather than one component in a structured pipeline. Finally, companies often deploy AI on top of broken processes instead of fixing those processes first, compounding existing inefficiencies rather than resolving them.

0 comments Read more at DEV Community