SShortSingh.
TopTechnologyAI & MLStartupsProgrammingScienceBusinessFinanceCrypto & Web3World

Programming

LatestTopDiscussed
0
ProgrammingHacker News ·

Mayday Mystery: The Cryptic Notices That Have Puzzled University Readers for Decades

The Mayday Mystery refers to a series of enigmatic notices and puzzles that have appeared in the University of Arizona's student newspaper since the 1980s. The cryptic messages, filled with coded language, symbols, and obscure references, have been placed by an anonymous individual or group known only as 'Aristaeus.' Decades of analysis by curious readers and amateur investigators have failed to definitively decode the full meaning or identify the source. The notices blend philosophical, religious, and conspiratorial themes, fueling widespread speculation about their true purpose. The mystery remains unsolved, continuing to attract attention from puzzle enthusiasts and researchers alike.

0 comments Read more at Hacker News
0
ProgrammingDEV Community ·

Rust-Based GLSL Language Server Brings Real-Time Diagnostics to Zed and VS Code

A developer has released an open-source, Rust-based GLSL language server called glsl-extended, designed to work with both the Zed and VS Code editors. The tool addresses longstanding pain points in shader development, including the absence of real-time compiler diagnostics, broken syntax highlighting, and outdated WebGL-era extensions that mishandle modern GLSL versions. It supports both Desktop OpenGL and Vulkan SPIR-V validation, and resolves recursive #include directives to enable autocomplete and symbol navigation across shared shader headers. Setup requires no manual configuration, as the server automatically downloads and manages the required glslang compiler binaries in the background. The project is publicly available on GitHub and aims to bring shader development tooling closer to the standards expected in modern web and backend workflows.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Over 31M MikroTik Devices Indexed Online Amid Active RouterOS Exploit Chain

CERT Polska disclosed a two-CVE exploit chain called MikroTrick on September 5, 2026, targeting MikroTik RouterOS devices with SSH management ports exposed to the internet. The chain combines a missing authentication flaw in SSH public-key verification with an argument injection vulnerability, requiring no password or private key to gain administrator access. ZoomEye data collected on September 19, 2026 shows over 31 million MikroTik-fingerprinted records indexed, though these figures reflect scan observations and do not confirm vulnerable or compromised devices. Public reporting cites more than 122,000 potentially exposed instances, a figure distinct from confirmed intrusions. MikroTik has released patched versions including 6.49.21, 7.23.4, 7.24.2, and 7.25beta3, and administrators are urged to audit SSH reachability across their networks and update immediately.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Developer releases free frosted-glass icon theme for Linux with 134 file types

A developer frustrated with dull and inconsistent Linux icon packs has created and released a free, open-source icon theme called Frost. The theme applies a frosted-glass visual style, assigning distinct colours and symbols to 134 file types to help users quickly identify files by category. Frost also includes a smart-tagging feature that scans project folders and marks them with the actual tech stack they contain, such as Next.js, Go, or Flutter. To avoid shipping trademarked logos, brand icons are fetched locally from the public-domain Simple Icons library. The theme is MIT-licensed, installable via a single terminal command, and available on GitHub with support for GNOME desktops.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Fake job interviews used to deliver malware and drain crypto savings

Microsoft's Defender Experts team documented a cyberattack campaign called Contagious Interview, active since at least December 2022, in which threat actors impersonate recruiters from crypto or AI firms to target job seekers. The attack is designed to reach the technical assessment stage, where candidates are socially conditioned to run unfamiliar code without suspicion. Victims are typically instructed to clone and execute a malicious NPM package from seemingly legitimate platforms like GitHub or GitLab. In one case reported by BBC World Service on 4 September 2026, a UK job seeker lost £18,000 in cryptocurrency savings within hours of completing such an assessment. Microsoft advises that no legitimate employer requires candidates to run unknown code on personal machines, and recommends using isolated virtual environments for coding tests.

0 comments Read more at DEV Community
0
ProgrammingHacker News ·

Inside Hacker News: How Its Story Ranking and Penalty System Works

A 2013 analysis by righto.com explains the mechanics behind how Hacker News ranks submitted stories. The system uses a scoring algorithm that factors in upvotes and time elapsed since submission, causing stories to decay in rank as they age. Controversy and certain patterns can trigger penalties that suppress a story's visibility, even if it has many upvotes. The post resurfaced on Hacker News recently, drawing renewed attention to the platform's largely opaque moderation and ranking practices.

0 comments Read more at Hacker News
0
ProgrammingHacker News ·

Chrono Trigger's Dream Devourer Boss Can Be Defeated via Integer Overflow Exploit

A technique has been discovered that allows players to defeat the Dream Devourer, a boss in the classic RPG Chrono Trigger, by exploiting an integer overflow glitch. The method takes advantage of a programming limitation where a numeric value exceeds its maximum capacity and wraps around, producing unintended in-game results. This type of exploit is a known category of software bug that speedrunners and gaming communities frequently uncover in older titles. The discovery was shared on the Chrono Trigger fan wiki and gained attention on Hacker News, drawing interest from both gaming and tech audiences.

0 comments Read more at Hacker News
0
ProgrammingDEV Community ·

Developer Contributes Recent-Papers Section to Harvard's Open-Source ML Textbook

A developer successfully merged a pull request (PR #1962) into the Harvard CS249r Machine Learning Systems open-source textbook, hosted on GitHub with over 28,400 stars. The contribution addressed an existing issue requesting improvements to the StaffML section of the book. The developer built a new React component to display a curated list of recent papers on the About page, matching the project's existing design conventions. The pull request passed review by two project maintainers before being accepted. The textbook is used by thousands of machine learning students and practitioners worldwide.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Critical GitLab CVE-2026-85706 Exposes Over 1.2M Instances to File Read Attacks

A maximum-severity vulnerability, CVE-2026-85706, was discovered in GitLab's repository commits API, allowing unauthenticated arbitrary file reads with a CVSS score of 10.0. GitLab released patches on September 10, 2026, covering versions 19.1.8, 19.2.6, and 19.3.2, with CISA adding the flaw to its Known Exploited Vulnerabilities catalog the next day. Internet scans via ZoomEye identified over 1.26 million publicly reachable GitLab instances as of September 19, 2026, though the figure reflects exposure scope rather than confirmed vulnerable systems. Security teams are advised to inventory all self-managed instances, apply available patches immediately, and restrict public access where upgrades cannot be deployed right away. Additionally, service account credentials accessible through potentially exposed instances should be audited and rotated as a precautionary measure.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Stale READMEs Drive Away New Contributors — Here's an Automated Fix

Outdated setup instructions in open-source READMEs frequently cause new contributors to abandon projects before making a single contribution, according to a developer essay published on DEV Community. The author argues this 'README rot' is one of the costliest silent bugs in software, since frustrated users simply leave rather than filing issues. While the docs-as-code movement improved documentation review processes, it still relies on human diligence to keep content current — a dependency the author calls structurally flawed. To address this, the author built ReadmeForge, a GitHub Action that monitors code pushes, analyzes diffs, and automatically opens pull requests proposing README updates for human review. The tool is free for public repositories and requires no API key configuration, aiming to make documentation accuracy a continuous, automated side effect of normal development work.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

GitHub Action Auto-Updates README on Every Push Using AI-Powered API

A developer has built a GitHub Action called ReadmeForge that automatically keeps a repository's README in sync with code changes on every push to the main branch. The action computes the diff of each push, sends it along with the current README to a hosted API, and opens a pull request with the suggested documentation updates for the developer to review. No API keys need to be stored in the repository, as the AI credentials are managed server-side, reducing security risks. The free tier allows 20 syncs per month on public repositories, while a Pro tier at $9 per month unlocks private repo support, higher volume, and a direct-commit mode. The tool aims to eliminate outdated documentation by making README updates an automatic side effect of pushing code rather than a manual task.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Valid JWT Proves Identity, Not Access Rights — Here Is Why That Matters

A security review of the Salus project highlighted a common API vulnerability known as Broken Object Level Authorization (BOLA), where a valid JWT token confirms a user's identity but does not automatically restrict access to resources owned by other users. In the reviewed scenario, an authenticated User B could retrieve patient records created by User A simply because the API queried records by patient ID alone, without verifying ownership. The fix involved scoping database lookups to both the resource ID and the requesting user's ID, ensuring cross-user access is blocked. To avoid leaking resource existence, the API was updated to return a 404 Not Found response instead of a 403 Forbidden when unauthorized access is attempted. The correction was validated through TDD-based security regression tests, which now protect the ownership boundary as the codebase continues to evolve.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

How Turkey's GIB e-Invoice XML Signature Works: A XAdES Architecture Overview

Turkey's electronic invoicing system is built on the UBL-TR 1.2 standard, which itself follows the OASIS Universal Business Language 2.1 specification. The signing process begins with XML canonicalization to normalize whitespace and attribute ordering, followed by SHA-256 hashing of the invoice body. The resulting cryptographic hash is then signed using a certificate stored on a smart card issued by TÜBİTAK Kamu SM, a public certification authority. Finally, the signature and certificate data are embedded within the invoice's designated XAdES node, conforming to W3C XML Signature standards. The overall framework is governed by guidelines published by Turkey's Revenue Administration, known as Gelir İdaresi Başkanlığı.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

PKCS#11 Standard Explained: Smart Card Reading with Python and C#

PKCS#11, or the Cryptographic Token Interface Standard, is the primary protocol used by developers to communicate with smart cards and cryptographic USB tokens. The standard is essential because private keys stored on smart cards cannot be extracted from the hardware directly. Card manufacturers such as AKİS, SafeNet, and Gemalto provide platform-specific dynamic libraries that expose PKCS#11 functions to the operating system. Core functions include C_Initialize to start a session, C_GetSlotList to detect connected readers, C_Login to verify a user's PIN, and C_Sign to perform on-chip digital signing. The article references OASIS PKCS#11 specifications and TÜBİTAK BİLGEM UEKAE libraries as authoritative resources for implementation.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Developer Builds Aeroapk to Help Indie Android Apps Gain Visibility Outside Google Play

A developer has launched Aeroapk, a new platform aimed at helping independent Android developers showcase and distribute their apps beyond Google Play. The platform focuses on app discovery, direct APK access, and making app information easier for users to understand. The project is currently a work in progress, with the creator seeking feedback from developers on key pain points such as discoverability, APK distribution, and user trust. The builder is particularly interested in supporting indie developers and open-source Android projects. Aeroapk is being developed in public, with updates and learnings to be shared as the platform evolves.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Worktrunk Simplifies Git Worktrees for Running Multiple AI Coding Agents

Worktrunk is an open-source command-line tool written in Rust that streamlines Git worktrees, making it easier to run multiple AI coding agents simultaneously on separate tasks. Released in early 2026, the tool has already accumulated over 5,000 GitHub stars and is licensed under MIT or Apache-2.0. Git worktrees allow different branches to exist in isolated folders within the same repository, preventing agents like Claude Code or Codex from overwriting each other's changes — but native Git commands for managing them are verbose and repetitive. Worktrunk reduces multi-step Git commands to simple branch-name-based shortcuts, such as 'wt switch', 'wt list', and 'wt remove', and supports launching agents directly from the switch command. Additional features include LLM-generated commit messages, build cache copying, per-worktree port assignment, and hooks for automating setup tasks on worktree creation or merge.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Mypyc Can Double Python Library Speed Without Leaving Python

A developer demonstrated how to nearly double the performance of h11, a widely used Python HTTP/1.1 library with 710,000 GitHub dependents, using mypyc instead of rewriting code in Rust. Mypyc is an ahead-of-time compiler that converts type-annotated Python code into native CPython C extensions, eliminating runtime interpretation overhead. It achieves speedups by using efficient data representations, resolving function calls at compile time, and reducing dynamic namespace lookups. The process involves three stages: satisfying mypy's strict type checks, successfully compiling with mypyc, and verifying the compiled code works correctly at runtime. The author also documented real annotation errors encountered during the migration, such as bytearray and bytes mismatches, and how each was resolved.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

15,608 SonicWall WorkPlace Interfaces Found Online, but Exposure Count Has Limits

A CVSS 10.0 pre-authentication vulnerability, CVE-2026-83548, was disclosed in September 2026 affecting SonicWall's SMA 1000 remote-access appliances. A ZoomEye search for the WorkPlace interface named in the advisory returned 15,608 results, offering a rough indicator of potential exposure. However, the figure cannot be treated as a precise count of vulnerable SMA 1000 devices, since the WorkPlace portal has been used across multiple SonicWall product generations and the search does not filter by model or firmware version. The SMA 1000 has now been tied to two zero-day clusters in 2026, with CISA previously linking its exploitation to ransomware campaigns. Security teams are advised to run the same query against their own address ranges and cross-check results with asset inventories to identify untracked or outdated appliances.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

IBM-Born Docling Library Converts PDFs and Docs into Clean AI-Ready Data

Docling is an open-source Python library originally created by IBM Research Zurich and now maintained under the LF AI & Data Foundation, designed to convert messy documents into structured, AI-ready output. It supports a wide range of input formats — including PDF, DOCX, PPTX, images, and even audio — and exports everything into a unified internal format that can be rendered as Markdown, HTML, or JSON. Unlike basic text extractors, Docling uses machine learning models to detect page layout, preserve reading order, and accurately reconstruct tables and code blocks, with OCR support for scanned files. The library integrates directly with popular AI frameworks such as LangChain, LlamaIndex, and Haystack, making it easy to plug into existing RAG pipelines. It runs entirely locally with no data leaving the user's machine, though its ML-based approach means a heavier install and slower CPU performance on large document batches compared to lightweight alternatives.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Developer Builds 47 MB Bootable Tool to Test Laptop Keyboards Without an OS

A laptop refurbisher and repair technician built KbdCheck, a minimal bootable Linux tool, after finding existing keyboard-testing solutions either required a working OS or were bloated with unnecessary features. Based on Arch Linux, the ISO weighs just 47 MB and runs directly from a USB drive without installing anything or modifying the host system. The interface displays a full keyboard layout and highlights each key as it is pressed, making it easy to identify faulty, stuck, or mis-mapped keys; a basic mouse test is also included. Because it operates independently of any installed operating system, it rules out software-level issues such as driver faults or accessibility settings that could otherwise mimic hardware failures. KbdCheck requires Secure Boot to be disabled and is available as a downloadable ISO with a SHA-256 checksum for integrity verification.

0 comments Read more at DEV Community
← NewerPage 1112 of 3219Older →