SShortSingh.
TopTechnologyAI & MLStartupsProgrammingScienceBusinessFinanceCrypto & Web3World

Programming

LatestTopDiscussed
0
ProgrammingDEV Community ·

JWT Security in 2026: Signing Algorithms, Common Attacks, and Token Rotation

A DEV Community guide examines JSON Web Token security, explaining how JWTs are structured and why they remain frequently misconfigured in modern applications. It compares signing algorithms such as HS256, RS256, ES256, and EdDSA (Ed25519) and their cryptographic trade-offs. The article details major vulnerabilities, including algorithm confusion, the "alg: none" exploit, and kid header injection attacks. It also highlights risks such as storing tokens in localStorage, which exposes sessions to cross-site scripting theft. The guide concludes with recommended practices for stateless authentication and Refresh Token Rotation.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Which messaging apps does OpenClaw support? A capability-based breakdown

OpenClaw, formerly known as Moltbot with Clawdbot still used in some community circles, is expanding quickly, prompting questions about which chat platforms it works with. The article argues that 'supported' is ambiguous and should be understood across three tiers: native official connectors, community-maintained connectors, and bridges built through webhooks or APIs. Platforms with event webhooks and outbound message APIs are the easiest to integrate, while encrypted or policy-restricted apps often only allow narrow or notification-style interactions. The author recommends validating six dimensions before rollout, including event coverage, outbound capabilities, identity fidelity, reliability, security, and rate-limit handling. A reference pipeline is outlined, running from signature-verified webhook ingress through event normalization and policy enforcement to the OpenClaw runtime and back out to the messaging app.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Measuring what idle hardware earns: a VPS, a GPU and a Raspberry Pi tested

The author checked three idle machines to see whether they could earn money, expecting a clear ranking. A rented VPS turned out to be barred from crypto mining under its providers' terms, and the estimated yield would not cover its rent anyway. A desktop RTX 5060 Ti could mine a small coin for about 0.99 USD a day gross, but German electricity costs made the result marginal or negative depending on power draw. Renting the same GPU out roughly broke even after power costs. The Raspberry Pi 1 was the one machine where the outcome was a small, modest win.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

DeepSeek publica como código abierto DeepInfer, su motor de inferencia para modelos de IA

DeepSeek liberó el 20 de octubre DeepInfer, el motor de inferencia que usa en sus servicios de producción, bajo licencia Apache 2.0, y el repositorio superó las 19.000 estrellas en GitHub a los pocos días. La herramienta reparte el cómputo entre chips, agrupa peticiones y controla la velocidad de respuesta, funciones que definen buena parte del costo de operar un servicio de IA. La primera versión solo ejecuta el modelo DeepSeek-V4.1-Flash en modo por lotes, y aún carece de caché de claves y valores, separación completa de fases y balanceo de carga. Según el repositorio, el proyecto se apoya en gran medida en vLLM, al que se suman núcleos optimizados propios y soporte para chips Nvidia Blackwell y Ascend 950 de Huawei. La publicación coincidió con una orden del Gobierno estadounidense que retiró los modelos de DeepSeek de los sistemas federales.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Five NGINX CVEs Depend on Configuration, So Exposure Must Be Measured Beyond Version

Two NGINX releases, 1.31.7 and 1.30.6, fix five vulnerabilities, each triggered only when a specific directive is enabled. This makes exposure a question of configuration rather than version alone. The article explains that scan-based fingerprinting, such as ZoomEye queries on app or Server header values, cannot see those directives and so cannot reliably count vulnerable deployments. It suggests narrowing candidates, for example TLS-terminating edge hosts or QUIC-terminating deployments, and then confirming exposure by reviewing each asset's configuration with nginx -T. It also stresses reporting search queries, fields, collection dates and units accurately when presenting exposure counts.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Aprenda inglês por chunks: 20 expressões prontas para usar no dia a dia

O artigo argumenta que decorar palavras isoladas torna a fala lenta, pois o cérebro precisa montar cada frase peça por peça. Ele propõe o estudo de chunks, unidades de várias palavras prontas, como "it depends on..." e "get back to you", que nativos usam com naturalidade. Segundo o texto, essas unidades aceleram a fala, já trazem a gramática correta embutida e soam mais naturais. O autor também afirma que aprender chunks ajuda a compreender a fala rápida, porque o ouvinte reconhece blocos em vez de palavras soltas. Por fim, o texto apresenta 20 expressões úteis agrupadas por situação de uso, com exemplos e significados em português.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

SGLang Outpaces vLLM on Prefix-Heavy Agent Workloads, but Gaps Shrink or Reverse Elsewhere

Benchmarks of multi-turn LLM agent workloads with an 8,000-token system context show SGLang's RadixAttention cutting time-to-first-token from 440ms to 38ms, while vLLM v0.6 with prefix caching reduced it from 480ms to 92ms. The gap stems from data structures: SGLang stores the KV cache in a radix tree that reuses any common prefix, whereas vLLM's block-based prefix caching is less effective when overlaps don't align to block boundaries. A separate 4,096-token test at 75% prefix overlap showed SGLang reaching a 78.6% cache hit rate versus 41.2% for vLLM, with substantially lower latency percentiles. However, the advantage disappears when workloads lack shared prefixes, where the two engines performed nearly identically on Llama 3.3 70B. On a single H100 running Qwen2.5-7B, vLLM delivered higher raw throughput, though SGLang retained a notable time-to-first-token advantage.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Notebook update: A(7) <= 8 bounds the last open Kakeya-type cases with 45 instances closed

An open notebook on Kakeya-type problems extends earlier work on finite 2-groups whose involutions are all central. The central question reduces to a number A(t), and the author reports that the largest anisotropic dimension over F_2^7 is now bounded by 8, with A(7) = 7 still unresolved. The argument proceeds by ruling out rank-4 elements and then case-checking the rank-3 shapes, which closes 45 remaining instances labeled (B6). A new bounds script recomputes the derived corollaries and passes unit tests against hand-checked values. The first open cases with small b, (11, 2) and (11, 3), still depend on bounds for A(8) and A(9). Certification jobs for the closed instances are queued but have not yet produced results.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Turtle Trading Rules Explained: N, Units, Breakouts and Stops

The Turtle trading rules form a mechanical trend-following system built on Donchian channel breakouts for entries and volatility-based position sizing. The author walks through each rule as stated in the 2003 'Original Turtle Trading Rules' PDF, using worked examples. N, the 20-day Wilder average of true range, underpins most other rules, and position units are sized so that a 1N move equals 1% of the account. Entries occur on breakouts of 20- or 55-day highs and lows, with unit additions every half N and stops set 2N away. The post also notes six points where the original PDF leaves decisions to the trader, and reports that the author's backtest of these rules on 26 Exness markets from 2020 to 2026 lost 57.7%.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Measuring How Long a Silent Failure Lasted Requires Bounded Start and End Points

A blog post examines what it takes to turn a 'time broken before detection' figure into a valid duration. The author argues that a duration needs a bounded start, a bounded end, and persistent evidence to read both from. Using a machine whose push attempts failed for forty days, the post shows how timestamps in logs and repository history can date the window. It also warns that counts of retry events are not the same as spans of time, a common source of inflated durations. The author stresses that durable version-control history is the strongest evidence for silent failures.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

mnemoa Tool Flags Stale and Redundant Lines in AI Coding Agent Instruction Files

The developer built mnemoa, a Rust-based tool that scans AI coding agent instruction files such as AGENTS.md and CLAUDE.md to find outdated, duplicated, or contradictory guidance. It checks for overly long instructions, broken paths and commands, plans that have drifted from the code, and rules that linters or formatters could enforce instead. The tool produces a dry-run prune plan with estimated token costs and can convert rules into enforceable checks, logging each change in a ledger. Deterministic checks run locally, while an optional LLM feature is disabled by default, and it supports seven coding agents along with a CLI, HTTP API, Python SDK, and GitHub Action. The developer is seeking feedback on which findings prove useful and which are noisy.

0 comments Read more at DEV Community
0
ProgrammingHacker News ·

Dijkstra's 1978 essay argues against natural language programming

A 1978 note by computer scientist Edsger W. Dijkstra, resurfaced on Hacker News, criticizes the idea of programming in natural language. The piece argues that everyday language is ill-suited to precise instructions because of its ambiguity and vagueness. Dijkstra contends that formal notations are essential for reasoning reliably about programs. The source text provided here is limited to a link and discussion metadata, so the full argument is not reproduced in this summary.

0 comments Read more at Hacker News
0
ProgrammingDEV Community ·

Managers Build Trust Through Follow-Through, Fairness and Honest Communication

Trust at work is shaped less by how much people like a manager than by how that manager responds when things go wrong. Missed commitments, especially when left unexplained, can quickly turn small problems into credibility issues. The article recommends being transparent about changing decisions, applying expectations consistently and explaining the reasoning behind them, and following through on promises or flagging delays early. It also argues that addressing problems directly is better than avoiding hard conversations, and that owning mistakes with a clear plan for change helps repair trust when consistent action follows.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Keycloak Step-Up Authentication: ACR and LoA Flows, and the Cookie Bypass Gap

Step-up authentication lets users sign in with a lightweight method, such as a password or managed-device passkey, and requires a stronger factor only for sensitive actions like changing payout details or approving transfers. Keycloak implements this through Authentication Context Class Reference (ACR) values mapped to numeric Levels of Authentication (LoA), configured in the login flow instead of application code. The setup involves a realm-level ACR-to-LoA mapping, a browser flow with conditional subflows guarded by level conditions, and client requests that specify the required level. Keycloak's levels are hierarchical, which fits poorly when several unrelated authentication methods are considered equivalent. The guide also flags two places where step-up can quietly fail to protect an application.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Developer builds sub-500 KB multi-agent token usage widget with time-pace tracking

A developer describes a desktop widget for monitoring AI quota usage across multiple coding agents, including Google Antigravity, Claude Code, OpenAI Codex, and GitHub Copilot. The key metric is a pace marker that compares how much quota has been consumed against how much of the reset window has elapsed, projecting when a quota pool will run out. Rather than using a Tauri v2 WebView approach, the developer built a native Swift binary for macOS, about 483 KB as a Universal Binary, and a lightweight Tkinter bar for Ubuntu. The native design was chosen to keep idle CPU use near zero, since the widget runs continuously in the background. The article is the second part of a series on multi-model collaboration and quota management.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Compound V3 Faces Moderate Liquidity Risk Amid $1.39B TVL, Audit Report Finds

A security researcher's report assesses the liquidity risk of Compound V3, the lending protocol now deployed on Ethereum and several Layer 2 networks. The platform holds roughly $1.39 billion in total value locked, with about $950 million on Ethereum mainnet and the rest on L2s such as Optimism, Arbitrum, and Base. The analysis flags concentration risk, with about 62% of TVL tied to ETH, USDC, and WBTC, and dependence on third-party cross-chain bridges as the most significant vulnerabilities. Existing safeguards include per-asset collateral caps, rate-capping mechanisms, multi-feed oracles, and timelocked governance, which the report says keep the overall risk rating at moderate. The report also identifies governance misuse and flash-loan manipulation as areas requiring continued attention.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Free In-Browser Tool Removes Photo Backgrounds Locally Without Uploads or Watermarks

A developer has introduced NexTools AI Background Remover, a browser-based tool for isolating subjects in photos. The article argues that many existing services limit free downloads to low-resolution previews and charge per high-resolution export. The tool instead runs machine learning models on the user's device via WebAssembly, so images are not sent to remote servers. According to the post, it offers full-resolution transparent PNG exports, background presets such as studio white and passport blue, and free use without signup. The article is promotional in nature and its claims about performance and privacy have not been independently verified.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Arista Warns of Critical SQL Injection in VeloCloud Orchestrator On-Premises Deployments

Arista has disclosed CVE-2026-114625, a critical SQL injection flaw in VeloCloud Orchestrator, with CVSS 3.1 at 9.9 and CVSS 4.0 at 9.4. Fixes are available only in builds 5.2.3.18, 6.1.3.10 and 6.4.2.12 for the respective release trains, and the vendor has already patched hosted and dedicated orchestrators. Because on-premises deployments must be updated manually, organizations running these versions need to act, and earlier fixes from July and September 2026 do not cover this flaw. The vulnerability requires low-privilege authenticated access, so credential management is also relevant, and releases past end of support were not assessed. Interim steps include restricting access to the web interface and reviewing administrator activity until a patch can be applied.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

AsyncLocalStorage Does Not Enforce Tenant Access; Membership Checks Are Still Required

A technical article argues that AsyncLocalStorage, which propagates request context in Node.js, cannot serve as a security boundary for multi-tenant applications. Using a hypothetical scenario with synthetic users, it shows how a caller could select another tenant's identifier, and context propagation would still work while exposing the wrong data. The author stresses that authentication, membership-based authorization, context propagation and enforcement at data access are distinct steps that must each be handled. The experiment ran on Node.js 22.18.0, NestJS 11.1.6 and TypeScript 5.9.2, with reported passing tests and type checks. The article also notes that its demo authentication is only an instructional shortcut and that real permissions may require role or resource-level checks beyond tenant membership.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

WordPress 7.2 Set for December 8 Release With New Ipsum Theme and Notes Updates

WordPress 7.2 is scheduled to ship on December 8, 2026, following Beta 1 on October 20 and a first release candidate on November 17. Its headline features include Ipsum, a minimal blank-canvas default theme, suggestion mode for Notes, a Secrets API for storing credentials, and form styling in Global Styles. The core team will include only roadmap items deemed reasonably ready, so features remain subject to change until RC 1. Dates follow the official release page, and the earlier volunteer window allowed for a possible one-day slip. Several items, including sudo mode and suggestion mode, may be deferred to 7.3 if they are not ready in time.

0 comments Read more at DEV Community
← NewerPage 110 of 2930Older →