SShortSingh.
TopTechnologyAI & MLStartupsProgrammingScienceBusinessFinanceCrypto & Web3World

Programming

LatestTopDiscussed
0
ProgrammingDEV Community ·

Keycloak Step-Up Authentication: ACR and LoA Flows, and the Cookie Bypass Gap

Step-up authentication lets users sign in with a lightweight method, such as a password or managed-device passkey, and requires a stronger factor only for sensitive actions like changing payout details or approving transfers. Keycloak implements this through Authentication Context Class Reference (ACR) values mapped to numeric Levels of Authentication (LoA), configured in the login flow instead of application code. The setup involves a realm-level ACR-to-LoA mapping, a browser flow with conditional subflows guarded by level conditions, and client requests that specify the required level. Keycloak's levels are hierarchical, which fits poorly when several unrelated authentication methods are considered equivalent. The guide also flags two places where step-up can quietly fail to protect an application.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Developer builds sub-500 KB multi-agent token usage widget with time-pace tracking

A developer describes a desktop widget for monitoring AI quota usage across multiple coding agents, including Google Antigravity, Claude Code, OpenAI Codex, and GitHub Copilot. The key metric is a pace marker that compares how much quota has been consumed against how much of the reset window has elapsed, projecting when a quota pool will run out. Rather than using a Tauri v2 WebView approach, the developer built a native Swift binary for macOS, about 483 KB as a Universal Binary, and a lightweight Tkinter bar for Ubuntu. The native design was chosen to keep idle CPU use near zero, since the widget runs continuously in the background. The article is the second part of a series on multi-model collaboration and quota management.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Compound V3 Faces Moderate Liquidity Risk Amid $1.39B TVL, Audit Report Finds

A security researcher's report assesses the liquidity risk of Compound V3, the lending protocol now deployed on Ethereum and several Layer 2 networks. The platform holds roughly $1.39 billion in total value locked, with about $950 million on Ethereum mainnet and the rest on L2s such as Optimism, Arbitrum, and Base. The analysis flags concentration risk, with about 62% of TVL tied to ETH, USDC, and WBTC, and dependence on third-party cross-chain bridges as the most significant vulnerabilities. Existing safeguards include per-asset collateral caps, rate-capping mechanisms, multi-feed oracles, and timelocked governance, which the report says keep the overall risk rating at moderate. The report also identifies governance misuse and flash-loan manipulation as areas requiring continued attention.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Free In-Browser Tool Removes Photo Backgrounds Locally Without Uploads or Watermarks

A developer has introduced NexTools AI Background Remover, a browser-based tool for isolating subjects in photos. The article argues that many existing services limit free downloads to low-resolution previews and charge per high-resolution export. The tool instead runs machine learning models on the user's device via WebAssembly, so images are not sent to remote servers. According to the post, it offers full-resolution transparent PNG exports, background presets such as studio white and passport blue, and free use without signup. The article is promotional in nature and its claims about performance and privacy have not been independently verified.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Arista Warns of Critical SQL Injection in VeloCloud Orchestrator On-Premises Deployments

Arista has disclosed CVE-2026-114625, a critical SQL injection flaw in VeloCloud Orchestrator, with CVSS 3.1 at 9.9 and CVSS 4.0 at 9.4. Fixes are available only in builds 5.2.3.18, 6.1.3.10 and 6.4.2.12 for the respective release trains, and the vendor has already patched hosted and dedicated orchestrators. Because on-premises deployments must be updated manually, organizations running these versions need to act, and earlier fixes from July and September 2026 do not cover this flaw. The vulnerability requires low-privilege authenticated access, so credential management is also relevant, and releases past end of support were not assessed. Interim steps include restricting access to the web interface and reviewing administrator activity until a patch can be applied.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

AsyncLocalStorage Does Not Enforce Tenant Access; Membership Checks Are Still Required

A technical article argues that AsyncLocalStorage, which propagates request context in Node.js, cannot serve as a security boundary for multi-tenant applications. Using a hypothetical scenario with synthetic users, it shows how a caller could select another tenant's identifier, and context propagation would still work while exposing the wrong data. The author stresses that authentication, membership-based authorization, context propagation and enforcement at data access are distinct steps that must each be handled. The experiment ran on Node.js 22.18.0, NestJS 11.1.6 and TypeScript 5.9.2, with reported passing tests and type checks. The article also notes that its demo authentication is only an instructional shortcut and that real permissions may require role or resource-level checks beyond tenant membership.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

WordPress 7.2 Set for December 8 Release With New Ipsum Theme and Notes Updates

WordPress 7.2 is scheduled to ship on December 8, 2026, following Beta 1 on October 20 and a first release candidate on November 17. Its headline features include Ipsum, a minimal blank-canvas default theme, suggestion mode for Notes, a Secrets API for storing credentials, and form styling in Global Styles. The core team will include only roadmap items deemed reasonably ready, so features remain subject to change until RC 1. Dates follow the official release page, and the earlier volunteer window allowed for a possible one-day slip. Several items, including sudo mode and suggestion mode, may be deferred to 7.3 if they are not ready in time.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Hexal: A Modal Text Editor With Helix Feature Parity and Lua Plugin Support

Hexal is a new modal text editor that aims to match Helix feature-for-feature while adding support for Lua plugins. Its developer created it partly because Helix has not adopted a plugin system, which limits its extensibility, and because Helix lacks several features the developer considers useful. The project went through early prototypes in C++ and in C# with Terminal.Gui before settling on C# with Native AOT and a dependency-light architecture, aside from the NLua library. The distributed builds are currently self-contained with the .NET 9.0 runtime bundled rather than Native AOT compiled, and AOT compatibility is still being worked on. The source code is available in the project's public repository.

0 comments Read more at DEV Community
0
ProgrammingHacker News ·

Developer Builds Custom TV Software After Unwanted webOS Update

After an unwanted webOS update was installed on his smart TV, a developer began writing replacement TV software of his own. Over a couple of weekends, with help from four different AI models, he got a first version working. The result lets his daughter control the TV by voice while he browses on the large screen. The developer made key decisions himself, including using WebRTC to reduce latency, adapting vendor logic for buffering voice samples, and designing the user experience. He described the project as a way to strip out bloatware and personalize the device.

0 comments Read more at Hacker News
0
ProgrammingHacker News ·

Mapping the Northern Sky: A Star Chart of Northern Hemisphere Constellations

A Hacker News post links to a web article presenting a star map of the stars and constellations visible in the Northern Hemisphere. The item was shared on the aggregator and received 5 points with no comments at the time of capture. The article itself is hosted on maps.com, and the post offers little detail beyond its title and link. Readers would need to visit the source page to see the chart and its specifics.

0 comments Read more at Hacker News
0
ProgrammingHacker News ·

Jank: A Native Clojure Dialect Offering Seamless C++ Interoperability

Jank is a programming language described as a native dialect of Clojure, the Lisp-family language that runs on the JVM. Its distinguishing feature is seamless interoperability with C++, allowing code to work directly with C++ libraries and facilities. The project was shared on Hacker News, where it received 7 points and no comments at the time of this report. The available source material provides only the project link and basic engagement metrics, so further details about its design, maturity, or adoption are not confirmed here.

0 comments Read more at Hacker News
0
ProgrammingDEV Community ·

Study finds gold-label conflicts in NLI training data, while evaluation splits stay clean

An AI-agent research effort examined ten reproducible audits of popular NLI and multiple-choice QA benchmarks for duplicate examples with contradictory correct answers. The conflicting duplicates found in SNLI, MultiNLI and ANLI were confined to their training splits, while held-out evaluation splits were clean. Checks on BoolQ, PIQA, CommonsenseQA and GSM8K turned up few or no conflicts. Notably, SNLI and MultiNLI share no identical premise-hypothesis pairs, so merging them into a combined training set adds no cross-corpus duplicates. The authors say the findings matter most for those training on these corpora without de-duplication.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Privacy-preserving active learning helps keep soft robot grippers maintained

A robotics researcher struggled to keep a silicone pneumatic gripper working after it failed from micro-tears around 4,000 actuation cycles. The lab owning the robot refused to send raw sensor data off-device because it contained proprietary designs, customer-specific force profiles, and details of a disputed manufacturing defect. To address this, the author combined active learning, differential privacy with federated training, and embodied agent feedback loops. The approach lets the robot itself estimate its uncertainty and decide which experiences are worth learning from, sharing only those decisions rather than raw data. The author argues that the robot's embodiment makes this privacy-preserving approach practical for soft robotics maintenance.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Malicious LiteLLM 1.107.0 uploaded to PyPI, stealing developer and AI tool credentials

A malicious version of the LiteLLM Python package, 1.107.0, was published to PyPI on October 21, 2026, and has since been removed by the registry. The package is widely used by AI developers to route requests to models such as Claude and GPT through a single interface. The malicious payload runs automatically whenever Python starts in an affected environment, without requiring the package to be imported. It searches for credentials including AI coding tool keys, environment variables, SSH keys and cloud logins, and it also runs a daemon that fetches and executes remote code hourly. Version 1.106.2 is confirmed safe, and developers are advised to check their environments for the 1.107.0 dist-info folder and review lockfiles.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Harvard Study Finds AI Coding Agents Boost Code Output but Not Ticket Completion

A Harvard study of 718 companies and over 725,000 developers from 2021 to 2026 found that AI coding agents increased code written and pull requests opened. Despite this, the number of completed Jira tickets and epics did not rise. The researchers attributed the gap to longer pull request review times, more rewrites, and senior engineers spending time on AI-related oversight. The author describes a workflow redesign that adds ticket pushback and adversarial code review before commits to address this bottleneck. The approach was tested across several production tickets and a vendor switch, with results reported in the author's flight logs.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Edtech Platform Outlines Private Storage and Deletion Strategy for Large AI-Generated Reports

A technical guide recommends storing AI-generated edtech reports in a private object-storage bucket, using multipart uploads for unusually large image files. It argues that a completed upload should not imply indefinite retention, so each report needs a database record tracking its state, retention deadline, and upload progress. Access is granted only after authorization checks, using short-lived signed URLs rather than permanent links. The approach treats multipart uploads as leased work that a reconciler can resume or abort, and it separates deletion of completed objects from cleanup of incomplete uploads.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

paste-sloth: One Chord Pastes Clipboard Text Restructured by a Local 1-Bit Gemma

paste-sloth is a background tool that restructures messy clipboard text, such as CSV into a markdown table or JSON into pretty-printed form, when the user presses Ctrl+Space+V. The cleaned output is generated by a small Gemma model and pasted directly into the focused window, replacing a manual copy-to-chat workflow. The author designed the key chord to avoid firing during normal typing, and forwards the Space key to other apps if it is not part of the chord. A safeguard checks the model's output and rejects it if it contains numbers absent from the input, since invented figures are considered the worst failure, while dropping numbers is allowed. The project offers a one-line installer that can set up a local Ollama-based 1-bit Gemma model, and it was submitted to the Hacktoberfest Open-Source AI Challenge.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

eMudhra to exit global SSL/TLS certificate business after key compromise disclosure

Bengaluru-based eMudhra announced it is leaving the global SSL/TLS certificate business entirely, following the disclosure that eight of its intermediate private keys were trivially guessable. The company says it revoked the affected CAs within 14 hours of discovery and that no end-entity certificates were issued from them, with no infrastructure compromise or data breach. It cited SSL/TLS making up roughly 1% of its revenue, rising compliance costs, and free offerings from larger competitors. Its G1 RSA roots will keep serving customers during a transition period, and a root-cause report to browser root programs remains outstanding.

0 comments Read more at DEV Community
0
ProgrammingHacker News ·

Developer Essay Argues Docker Is Weird in Its Design and Conventions

A post titled "Docker Is Weird" was published on codeandcake.dev and shared on Hacker News, where it gained 10 points and one comment. The available material contains only the link metadata and not the full text of the essay, so its specific arguments cannot be confirmed here. The headline indicates the author views aspects of Docker as unusual or unconventional. Readers interested in the author's reasoning would need to consult the original post directly.

0 comments Read more at Hacker News
0
ProgrammingDEV Community ·

Developer tests OpenShell's Z3 policy prover with 29 checks; it misses the cloud metadata address

NVIDIA's OpenShell, a runtime for autonomous AI agent fleets, reached the Hacker News front page and includes a formal verification tool, the openshell-prover CLI, that uses an SMT solver to check whether a candidate policy stays within a boundary policy. A developer built the Rust tool from source, linking it against Z3 via the Python z3-solver wheel because the prebuilt feature failed. Across 29 candidate and boundary pairs, the prover caught nearly every attempted escape, producing concrete counterexamples and refusing to guess when facts were unavailable. However, it failed to flag the cloud instance metadata address 169.254.169.254, the most commonly warned-about target in agent-safety discussions, and similar metadata endpoints were classified as within boundary.

0 comments Read more at DEV Community
← NewerPage 10 of 2829Older →