SShortSingh.
TopTechnologyAI & MLStartupsProgrammingScienceBusinessFinanceCrypto & Web3World

Programming

LatestTopDiscussed
0
ProgrammingDEV Community ·

Config Files Set AI Agent Intent, Hooks Enforce It — Here's the Difference

A growing distinction in AI coding agent setups separates prose configuration files, like CLAUDE.md, from executable hooks that enforce hard rules at runtime. While config prose shapes what an agent attempts to do, PreToolUse hooks can deterministically block dangerous actions such as force-pushing to main or modifying protected files like .env. Developers are advised to use a reliability ladder: placing linters and CI at the base, hooks for blocking unsafe commands, and prose only for judgment-based guidance that requires context. Hooks handle checkable, repeatable rules without consuming token budget, whereas prose is reserved for nuanced decisions like defining what 'done' means or explaining legacy workarounds. The framework recommends versioning both hook scripts and config files in git to maintain consistent, auditable agent behavior across a codebase.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

UK Website Redesign in 2026: Key Signs, Costs, and SEO Risks Explained

A 2026 guide aimed at UK businesses outlines when a website redesign is genuinely justified, citing poor performance, low conversions, outdated technology, and changed business needs as valid triggers — rather than aesthetics alone. One of the most significant risks highlighted is the loss of search rankings during a poorly managed redesign, often caused by changed URLs without redirects, removed content, or missing technical SEO elements. Experts stress that SEO preservation must be planned from the very start of a project, not reviewed after launch. The guide also distinguishes between a redesign, which improves an existing site, and a full rebuild, which replaces it on new technology, noting these differ considerably in scope and cost. Website redesign projects in the UK typically range from a few thousand to tens of thousands of pounds depending on complexity.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Doubling API concurrency cut load time 14% but introduced call failures, dev reverts change

A developer building Holder Atlas, a token-holder geography tool, found that generating a single world map required roughly 110 sequential Nansen API calls averaging nearly two seconds each, resulting in a cold load time of around 40 seconds. To speed this up, they doubled the concurrency pool from 4 to 8 workers and raised the rate limit from 5 to 10 requests per second during a benchmark test on four tokens in September 2026. The wider configuration improved the median cold load time by only 14 percent, from 40.3 seconds to 34.5 seconds, while the 95th-percentile time barely changed. More critically, the higher concurrency produced three failed API calls that the narrower setup had avoided, causing one token's cached result to differ from its cold-run output. The developer reverted to the original 4-wide, 5 rps defaults, concluding that per-call latency — not worker count — is the true bottleneck.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Microsoft Foundry Uses OpenTelemetry to Bring Deep Observability to AI Agent Runs

Microsoft Foundry offers a structured observability pipeline for AI agents, built on OpenTelemetry semantic conventions and backed by Azure Monitor Application Insights. Unlike flat logs, agent tracing captures the full execution tree of a single agent run — including model calls, tool invocations, retrievals, and handoffs to other agents. Each step in the tree is recorded as a span with its own latency, token cost, and failure data, enabling engineers to pinpoint exactly where errors originate across complex multi-step workflows. The platform also supports a continuous evaluation loop that automatically grades production traffic by sampling structured trace data, removing the need for manual review. Microsoft positions this tracing capability as a core architectural feature rather than an add-on, sitting alongside evaluation and monitoring as a first-class pillar of the Foundry platform.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

MyZubster Dev Team Fixes Privacy Bug and Brittle Tests While Stabilizing Node.js Platform

The team behind MyZubster, a Node.js platform with subsystems spanning payments, social login, and a marketplace, has been working to stabilize its test suite by classifying failures as real bugs, stale tests, or architectural mismatches. A seemingly outdated Cultural API test revealed a genuine privacy issue where the public event endpoint was still exposing owner identity data, prompting a targeted production fix. Separately, several UI test failures were traced to fragile string comparisons that checked exact whitespace and variable names rather than actual behavior, and these were replaced with semantic regular expressions. The approach allowed the team to fix a real privacy boundary violation and eliminate false failures without making arbitrary changes to production code. The effort reflects a broader principle that a failing test should be treated as evidence of a potential issue before it is simply rewritten or deleted.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Five techniques to shrink bloated Docker images from gigabytes to megabytes

Poorly optimised Docker images for simple Node.js apps can balloon past 1GB, primarily due to heavy base images, included dev dependencies, and unfiltered source files copied into the container. Switching from the full node:20 Debian base image to the Alpine variant alone can cut image size from roughly 1.1GB down to about 150MB. Using multi-stage builds further reduces this by keeping build tools and dev dependencies out of the final production image, pushing sizes closer to 100MB. A .dockerignore file prevents directories like .git, tests, and coverage reports from being copied in, which can save an additional 10–30% in size. For compiled languages like Go, using a distroless base image that contains only the application binary can reduce final image size to as little as 15MB, a roughly 90% reduction.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Developer builds RAG system to fix AI hallucinations in company knowledge tools

A developer replaced model-memory-based AI responses with a retrieval-augmented generation (RAG) system after finding that large language models confidently fabricate answers when queried about company-specific content. The solution was built using Python, FastAPI, LangChain, OpenAI, Anthropic, Pinecone, Postgres, and Docker. Answers are now grounded in actual source documents and delivered automatically via Slack on a scheduled basis. The system required no migration effort from the non-technical team responsible for maintaining it. The developer concluded that AI inaccuracy in enterprise contexts is fundamentally a retrieval problem, not a model capability problem.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

OAuth Scopes Control API Access, Not User-Level Permissions

OAuth scopes define which APIs a token is permitted to call, but they do not determine whether a specific user can access a specific resource. A token with broad read permissions can potentially be used against any resource ID unless the API enforces subject, action, and resource checks on every request. Developers are advised to treat scopes as a coarse credential gate rather than a complete authorization solution. Fine-grained access control — such as RBAC, ReBAC, or ABAC — must be implemented within the application itself, using the authenticated subject from the token. Validating a JWT confirms authentication only; authorization remains an entirely separate decision that the application must handle independently.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Define Key User Events Before Analyzing Website Traffic, Experts Advise

Analytics dashboards typically show visits and bounce rates but rarely explain why users behave as they do on a website. Experts recommend defining a small set of meaningful events — such as viewing a key section, clicking a primary call-to-action, or submitting a form — before collecting large volumes of anonymous click data. Each event should be tied to a specific business question, such as which page moves users forward or where they abandon a form. A clear naming convention using action, object, and outcome helps teams maintain tracking plans over time without losing context. The goal is a short feedback loop where each tracked event directly informs a content, design, or product decision.

0 comments Read more at DEV Community
0
ProgrammingHacker News ·

Apple Music to Open Concert Venue at Battersea Power Station

Apple Music has announced plans to open a concert venue at Battersea Power Station in London, according to a BBC report. The historic landmark, which was redeveloped into a mixed-use destination in recent years, would host the new music venue. The move signals Apple's continued investment in live music experiences beyond its streaming platform. Further details about the venue's capacity, opening date, and programming have not been confirmed in the available information.

0 comments Read more at Hacker News
0
ProgrammingDEV Community ·

Why Display Names Should Never Be Used for Authorization in Web Apps

A common security flaw in apps with anonymous participation is treating a user's display name as an authorization credential, which it is not. Display names are publicly visible, easy to guess, and only serve to identify a record — not to prove who has the right to modify it. Anyone who knows or guesses a participant's name could exploit such systems to overwrite another person's data. For anonymous users, a secure alternative is issuing a cryptographically random token stored in an HttpOnly cookie, with only its SHA-256 hash saved server-side. Authenticated users should be authorized via immutable session-based user IDs, never through values supplied in request bodies or query parameters.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Why SIGKILL Cannot Kill Zombie Processes and What That Means for Containers

When a Linux process exits, the kernel retains a minimal record — including the PID and exit status — until the parent process calls wait(); this remnant is known as a zombie process. Because there is nothing left to kill, SIGKILL has no effect on zombies and the kill() call simply returns success. If a parent process dies before its children, those orphaned processes are adopted by a designated subreaper or by PID 1 of the same PID namespace, with adoption stopping at namespace boundaries so container processes are never reparented to the host. In containerised environments, the application itself typically runs as PID 1, meaning it becomes responsible for reaping all child processes; apps that do not call wait() on indirectly spawned processes allow zombies to accumulate until the PID cgroup limit is reached and no new processes can be forked. Common fixes include using a dedicated init process such as tini, enabling Docker's --init flag, or configuring Kubernetes' shareProcessNamespace so the pause container handles reaping.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

EveryCli lets developers find shell commands using plain English or French locally

EveryCli is a command-line assistant that translates natural-language descriptions into shell commands without requiring an internet connection, API keys, or browser access. The tool supports English and French queries and covers popular tools including Git, Docker, npm, SSH, Python, Linux, and Bash. It features hybrid keyword and fuzzy search, a warm daemon for fast response times, and an interactive results picker with JSON and shell output modes. Users can build and manage a custom command corpus using built-in add, list, and remove functions. EveryCli never executes commands automatically and always prompts for confirmation when the --run flag is used; a macOS installer is planned as the project approaches its 1.0 release.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Stochastic Parrots or Emerging Intelligence: What LLMs Actually Are

A developer with 40 years of experience in systems and infrastructure examines the ongoing debate over whether large language models represent genuine intelligence or sophisticated statistical text prediction. The 2021 'Stochastic Parrots' paper by researchers including Timnit Gebru argued that LLMs generate fluent text through probability without true understanding, a view Redis creator Salvatore Sanfilippo has publicly challenged. The author sides with cautious skepticism, arguing that while LLMs have grown more capable, they cannot replicate the biological and emotional dimensions that shape human reasoning. A key distinction is drawn between technical users who treat AI as a productivity tool and everyday users who engage with it as they would a real person. The piece concludes that the question may be less about defining the machine and more about understanding how different humans relate to it.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

14-Day Micro-SaaS Launch Blueprint Tackles Stack Selection and Rapid Prototyping

A structured 14-day technical roadmap has been outlined for solopreneurs and tech agency owners aiming to launch a secure, scalable Micro-SaaS product in 2026. The guide identifies the 'boilerplate trap' as the primary failure point, where developers lose critical early days configuring authentication, databases, and payment systems before building core features. Over-engineering with complex infrastructure like Kubernetes and microservices is flagged as a costly mistake for products yet to reach their first hundred users. The recommended stack centers on Next.js 16.x, React 19, Supabase, Stripe, and Vercel to minimize overhead while maintaining security and performance. The blueprint argues this combination can compress a traditional three-month development cycle into a focused two-week sprint without sacrificing reliability.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Why Upgrading to a Bigger LLM Won't Fix Your Code Quality Problems

A software engineer building PatchCat, an open-source visual prompt and workflow engine, found that swapping to more powerful large language models failed to produce better architectural output. The core issue, which the author terms 'Mode Gravity,' stems from how autoregressive models statistically converge toward the most common, consensus-driven responses in their training data. Reinforcement learning from human feedback further compounds this by rewarding polite, safe, and generic answers over precise, context-specific solutions. The author argues that without explicit, high-specificity constraints anchoring a prompt, even frontier models default to vague, textbook-level advice that ignores real engineering constraints. To counter this, the article proposes an architectural shift toward 'Differential Diffing' — supplying concrete production targets and edge conditions to force models away from mediocre, statistically average outputs.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Developer shares lessons from deploying a containerized couples app on Google Cloud Run

A developer built a private couples web app featuring movie suggestions, trivia, and AI-powered adventures, using a Svelte and Node.js stack with MongoDB Atlas for storage. The app was deployed to Google Cloud Run inside a single Docker container built across three stages, keeping the final image lean by excluding build tooling. Google Cloud Run was chosen specifically for its scale-to-zero capability, ensuring zero cost during idle periods — critical for a two-user application. A Cloud Build trigger was configured to automatically redeploy the service on every git push, with each revision tagged with a commit SHA for traceability. The app ran live for about a month before being scaled down, with the developer documenting key architectural and deployment decisions for others adopting the serverless-container model.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Developer builds eval harness to measure prompt-injection defenses in LLM agent

A software developer created a LangGraph-based travel concierge agent and deliberately tested it against five categories of prompt-injection attacks, including RAG data poisoning and system-prompt leakage. To move beyond gut-feel assessments, they built a structured evaluation harness consisting of 35 prompts — 25 attack scenarios and 10 benign controls — paired with a two-layer judging system. The judge combines deterministic counters, such as checking whether a malicious email was actually sent, with a fallback LLM judge for attack classes that leave no direct tool trace. Results are persisted after every sample so that rate-limit interruptions on Groq's free-tier API do not force a full restart, and all runs use fixed temperature and seed for direct comparability. The exercise revealed that quantifying both attack success rates and false positives is essential, since a defense that blocks all attacks but disrupts legitimate use renders the product unusable.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

How One Developer Built a Sandboxed Firefox Profile That Leaves No Trace

A developer running Pop!_OS 24.04 set up a sandboxed Firefox profile using Firejail to safely open links from untrusted sources without risking the rest of their system. The goal was to retain deliberate configurations like extensions and a Gmail login, while ensuring no browsing activity persisted after each session. A key challenge was a path change in Firefox 150+, which moved profile directories to an XDG location that Firejail's default config did not whitelist, causing Firefox to silently create a throwaway profile each launch. After testing three approaches, the final solution combined a persistent sandbox profile, Firefox's native permanent private browsing mode enforced via a user.js file, and a custom Firejail whitelist scoped only to that profile. A wrapper launch script prevents accidental Safe Mode by clearing stale lock files and blocks the sandbox from opening if the profile is already in use.

0 comments Read more at DEV Community
← NewerPage 1028 of 3194Older →