SShortSingh.
TopTechnologyAI & MLStartupsProgrammingScienceBusinessFinanceCrypto & Web3World

Programming

LatestTopDiscussed
0
ProgrammingDEV Community ·

Developer releases free Windows tool to color-code and manage multiple VS Code windows

A developer has released vscode-border, a free, open-source Windows application written in C++ that draws colored borders around individual VS Code windows to help distinguish them at a glance. The tool was built to solve the problem of multiple VS Code instances appearing identical in the taskbar and Alt-Tab switcher. Beyond colored borders, it includes a floating project HUD that acts as a dedicated mini taskbar for VS Code windows, allowing users to click, pin, and jump between instances including minimized ones. Each HUD item also displays the repo and branch name, a right-click context menu, and an AI coding status indicator showing whether a window needs user input. Released under the MIT license, the standalone app requires no extensions or dependencies and is available on GitHub at github.com/dgtvan/vscode-border.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Chrome's Built-In EyeDropper API Replaces Complex Color-Picker Workarounds

Chrome and other Chromium-based browsers have included a native EyeDropper Web API called window.EyeDropper since late 2021, eliminating the need for complex canvas or screen-capture workarounds. The API allows users to sample a color from anywhere on their screen — including other apps and the desktop — by delegating the screen-reading task to the operating system rather than the browser sandbox. It returns only a single hex color string, making it deliberately narrow in scope and exempt from the heavy permission prompts required by screen-capture APIs like getDisplayMedia. The feature requires a direct user gesture, such as a click event, to function; calling it from asynchronous chains or on page load will cause it to throw an error. Developers can implement a fully functional eyedropper tool in just a few lines of code, compared to the roughly 150 lines needed for a canvas-based workaround.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

ZCode AI Coding App Found Secretly Uploading Encrypted Git Repo Snapshots to Cloud

Security researcher ferstar discovered on September 18, 2026, that ZCode, an AI coding desktop app by Chinese firm Zhipu, was silently packaging and uploading entire workspace snapshots — including full Git histories — to Aliyun cloud storage without user consent. The researcher found a 313MB encrypted archive in ZCode's local data directory, with logs showing 564 failed upload attempts for a 345MB commercial project, while a smaller 15KB snapshot from a public repository was confirmed as successfully received by the server. Reverse-engineering the Electron app revealed a multi-step process: the client requests upload credentials from Zhipu's servers, compresses the workspace, encrypts it using AES-256-CTR with an RSA-wrapped key, and sends it directly to Aliyun OSS. Critically, the encryption key is held exclusively by Zhipu's backend, meaning users cannot decrypt their own uploaded data — a design the researcher argues serves the server's access, not the user's recovery needs. Zhipu publicly confirmed the upload behavior the same day the findings were published.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

GSoC Developer Rebuilds Nominatim's Category Model to Support Multi-Tag Places

Developer Agasta, selected for Google Summer of Code (GSoC), spent the summer overhauling the category model of Nominatim, the geocoder that converts OpenStreetMap place names and addresses into coordinates. The core problem was that Nominatim previously allowed only one class/type pair per place, making it difficult to represent objects with multiple identities, such as a hotel containing a restaurant. The rebuild introduced PostgreSQL's ltree extension to store categories as hierarchical dot-separated paths, enabling filters like 'all descendants of osm.amenity' without requiring explicit prefix storage. Changes spanned the import pipeline, database schema, ranking logic, search indexes, API, and SQLite adaptor, and also uncovered a pre-existing bug in the PostgreSQL array result processor. The updated API now supports advanced filtering with AND/OR semantics, hierarchy matching, and consistent behaviour across all supported backends.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

OWASP Core Rule Set Extended to Block LLM Prompt Injection via WAF

A technical guide published on September 20, 2026, demonstrates how to apply the OWASP Core Rule Set (CRS) to large language model traffic using Solo Enterprise's agentgateway and the Coraza rules engine. Unlike traditional web application firewalls that inspect URLs and headers, this approach buffers and parses the full JSON request body so that prompt content and tool call arguments become addressable fields for rule matching. Custom SecLang signatures can be added alongside CRS to detect and block common LLM attack patterns such as prompt injection, jailbreak framing, and system-prompt exfiltration attempts, all returning HTTP 403 responses. The WAFPolicy resource is decoupled from routing, allowing a single policy to be reused across multiple HTTP routes without modifying the underlying model or MCP server. Live cluster tests on version 2026.8.2 confirmed that normal requests pass while all adversarial prompt payloads were blocked.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Independent Benchmark Finds Jev AI Confident Only When Correct on Agent Risk Tasks

A software developer published a 60-case benchmark on September 19, 2026, testing Jev, an AI model launched by TypeSafe AI on September 15, 2026, on its ability to classify agent tool-call risk into four categories. The benchmark was designed to assess accuracy, latency, and the reliability of Jev's confidence scores — the operationally critical claim from the model's launch. Both jev-latest and jev-preview achieved 91.7% overall accuracy, with perfect scores on clear cases but lower performance on ambiguous ones, run from a residential connection in Portland, OR. The most consistent finding across all runs was that every incorrect answer carried a confidence score below 1.000, meaning the model never expressed full certainty on a wrong answer. The full benchmark harness, tasks, and per-call results are publicly available on GitHub for independent verification and re-running.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

How to Securely Verify Telegram Login Widget Payloads in PHP and Yii2

Integrating the Telegram Login Widget into web applications requires strict backend validation to prevent identity spoofing. Developers must verify the incoming authentication payload using HMAC-SHA-256, derived from a SHA-256 hash of the Telegram bot token. The process involves sorting query parameters alphabetically, building a formatted data string, and comparing the computed signature against the received hash using a timing-attack-resistant function. An expiration check on the auth_date parameter is also enforced to guard against replay attacks. In Yii2, a database migration adds a unique telegram_id column to the user table, allowing validated Telegram identities to be mapped to local user records.

0 comments Read more at DEV Community
0
ProgrammingHacker News ·

Insufficient content to generate a reliable headline

The submitted article contains no readable body text — only metadata such as a URL, a Hacker News comments link, a score of 4 points, and 1 comment. There is not enough factual information available to produce an accurate or meaningful summary. No claims, arguments, or reportable facts can be extracted from the provided content. A full article text would be required to generate a proper news item.

0 comments Read more at Hacker News
0
ProgrammingHacker News ·

Laya AI Model Runs Offline on Apple M4 Mac via CoreML at 45 Decisions/sec

A developer has demonstrated Laya, also known as OS Jev, running entirely offline on an Apple M4 Mac using Apple's CoreML framework. The implementation achieves a throughput of approximately 45 decisions per second on the local hardware. The project details were shared publicly via a GitHub Gist, suggesting an open and experimental nature. This highlights the growing capability of modern Apple Silicon chips to handle AI inference workloads without requiring cloud connectivity.

0 comments Read more at Hacker News
0
ProgrammingDEV Community ·

Developer Builds Automated Python Webhook Funnel to Drive Votes in Online Competition

A developer participating in the CANEX Create-Thon competition on the Gebeya platform built a zero-cost automated voting funnel to work around the platform's high sign-in friction. The Gebeya voting system requires a full email sign-in before a vote can be cast, which the developer estimates causes a 90% drop-off rate among organic visitors. To counter this, they engineered a three-part system comprising an Astro and Tailwind frontend, a Python FastAPI webhook engine, and an automated direct-message and reward trigger. The developer is currently load-testing the funnel over an eight-day period and has shared the live flow publicly. The project was documented on DEV Community, where the developer invited feedback on optimizing the Python routing logic.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Developer Releases Open-Source API Performance Profiler for Express Apps

A developer has launched an open-source tool called API Performance Profiler, designed to help backend engineers and DevOps teams accurately measure the response times of their API routes. The tool integrates with Express applications via a simple middleware setup and can replay real captured requests under load to simulate production conditions. It is available as an npm package under the handle @api-profiler/express and is published under the AGPL license on GitHub. A key design principle of the tool is that it only displays metrics backed by actual measured data, showing dashes rather than estimates when sample sizes are insufficient. The developer is actively seeking feedback from users who test it on real projects.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

What Do Users and Developers Look for When Trusting an APK Download?

A developer building an APK distribution platform called Aeroapk has raised questions about trust and transparency in sideloading Android apps. The discussion centers on what information users check before installing an APK from outside the Google Play Store. Key concerns include the identity of the publisher and the visibility of app metadata on third-party platforms. The developer is seeking input from both Android users and indie or open-source developers to shape how the platform presents app information. The goal is to make Android app discovery and APK distribution more transparent and trustworthy.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Developer runs 1,400 sanctions screening tests to settle fuzzy vs. exact match debate

A developer building an onboarding flow for a fintech client tested a sanctions screening API to resolve an internal disagreement over the right match threshold for OFAC compliance checks. Querying the common Russian name 'Sergei Ivanov' at a 0.7 threshold returned 101 total matches across OFAC, UN, and EU sanctions lists, including one perfect exact match and dozens of fuzzy hits. Among the fuzzy results was a terrorist organization flagged at 0.85 similarity simply because its name shared two starting letters with the query. The experiment revealed that while fuzzy logic successfully catches transliteration variants of sanctioned names, it also generates significant noise through phonetic and token collisions. The findings led the team to conclude that neither a strict 0.95 threshold nor a loose 0.65 threshold was appropriate, and that the shape and type of matches matter as much as their volume.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Why Static Sites Need Site-Wide Structured Data and Social Graph Metadata

Engineering teams building static sites with frameworks like Astro or Next.js often focus metadata efforts on individual article pages, leaving root domains, archives, and utility pages poorly instrumented. This gap causes blank or generic preview cards when links are shared on platforms like WhatsApp, LinkedIn, or Slack, and weakens brand identity signals sent to search engines. Robust metadata strategy requires implementing both OpenGraph tags and Schema.org JSON-LD across all route types, not just blog posts. OpenGraph properties control how links appear as visual cards on social platforms, while JSON-LD structured data helps search engines build accurate knowledge graphs, breadcrumbs, and site search features. For static architectures, embedding these metadata layers at build time — rather than injecting them at runtime — delivers better performance with no added JavaScript overhead.

0 comments Read more at DEV Community
0
ProgrammingHacker News ·

Hobbyist builds custom home server using recycled spare parts

A hobbyist documented the process of building a custom home server using spare and repurposed components. The project was shared on a personal blog, detailing the steps and decisions involved in assembling the system. The build was posted to Hacker News, where it attracted a small number of upvotes. The project highlights a growing interest in self-hosted infrastructure and DIY computing solutions.

0 comments Read more at Hacker News
0
ProgrammingDEV Community ·

mdjango: A Django App That Turns Markdown Files Into a Full Docs Site

A developer has released mdjango v0.1.0, a drop-in Django application that converts a directory of Markdown files into a fully functional documentation website. The tool ships with a sensible default design, limited but practical customization options, and client-side fuzzy search powered by MiniSearch.js. It also auto-generates llms.txt and llms-full.txt files, making documentation immediately consumable by AI agents and LLM-based tools. The project was built as a side quest from a larger Python effort, with the developer choosing Django over static site generators to retain dynamic behaviour. Available on PyPI, the tool is in early-stage v0.1.0 and was developed with AI assistance under the supervision of a professional software engineer.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

AI Agent Memory Can Be Silently Rewritten to Control Behavior, Research Shows

A researcher demonstrated that an AI agent's associative memory graph can be fabricated or overwritten without any training, reward signals, or lived experience. In experiments, a memory graph authored with zero trials produced the same perfect accuracy (1.00) as one built over 600 rewarded trials, meaning the agent could not distinguish real from fabricated history. The study identified three attack vectors — memory transplant, targeted poisoning, and full history fabrication — all enabled by write-access to the memory store. The key finding reframes agent memory not as data the system reads, but as a bias current that shapes behavior before any decision is made. The researcher argues this demands security standards beyond encryption and signing, treating memory integrity as equivalent to behavioral control.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Developer launches Angular-Ionic starter kit to eliminate repetitive mobile app setup

A developer has released LaunchKit Mobile, a reusable starter template built on Angular 22, Ionic, and Capacitor, aimed at eliminating repetitive groundwork in mobile app projects. The kit comes pre-configured with common production essentials including authentication, secure storage, biometrics, push notifications, offline handling, dark mode, and RTL support. A built-in mock mode allows developers to explore the app and its features without needing a live backend, with the option to connect a REST API when ready. LaunchKit Mobile is available for €39, currently discounted by 20%, and targets Angular and Ionic developers looking to skip boilerplate setup and focus on building unique app features.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

DockFlare Automates Cloudflare Tunnel and Access Config via Docker Labels

A developer built DockFlare in 2025 to eliminate repetitive manual work in the Cloudflare dashboard when deploying homelab containers. The open-source tool monitors Docker containers and uses their labels to automatically manage Cloudflare Tunnel routes, DNS records, and Zero Trust Access policies. Users define routing and access settings directly in their Docker Compose files using simple labels, removing the need to open inbound router ports or publish container ports. DockFlare also integrates with Cloudflare Access, allowing administrators to enforce identity-based authentication in front of services like Grafana by referencing pre-configured access groups via labels. The project targets self-hosters who want a single source of truth for both service configuration and network access control.

0 comments Read more at DEV Community
← NewerPage 1091 of 3217Older →