SShortSingh.
TopTechnologyAI & MLStartupsProgrammingScienceBusinessFinanceCrypto & Web3World

Programming

LatestTopDiscussed
0
ProgrammingDEV Community ·

How TOTP Authenticator Apps Generate Secure One-Time Codes Without Internet

Time-based One-Time Passwords (TOTP) are temporary codes used as a second layer of identity verification during login, requiring no cellular or internet connection to function. During setup, a server generates a unique secret key, transfers it to the user's authenticator app via QR code scan, and that key is stored locally — no further network communication is needed. Both the app and the server independently calculate the same 6-digit code by combining the shared secret key with the current 30-second time block using a cryptographic HMAC function. The resulting hash is trimmed down through a series of mathematical steps to produce a short, human-readable passcode that expires every 30 seconds. To handle minor clock discrepancies between devices, servers typically accept codes from the current window as well as the windows immediately before and after, providing a roughly 90-second tolerance margin.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Google DeepMind Publishes Verified Gemini 4 Research as Unverified Benchmarks Leak

Two separate Gemini 4-related developments emerged the same week in September 2026: an unverified benchmark table circulating online and a peer-reviewed academic paper published by Google DeepMind on September 14. The leaked table claimed scores on tests like DeepSWE and OSWorld-2.0, along with pricing and hardware specs, but had no traceable source, author, or date. In contrast, the paper titled 'Dream-RSI: Recursive Self-Improvement through Evolving Worlds' was published on arXiv by 17 researchers from Google DeepMind, the University of Maryland, and the University of Virginia, with a verifiable DOI. Google had first publicly confirmed Gemini 4 was in pre-training via a blog post on July 21, 2026, with CEO Sundar Pichai later describing it as significantly larger than Gemini 3 Pro during a Q2 earnings call. The author emphasizes a clear distinction between the two information streams: the leaked data remains unverifiable, while the academic paper is fully open and independently checkable.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Nostra Finance Loses $3.5M After Attacker Manipulates NSTR Oracle 8,000x on Starknet

Starknet lending protocol Nostra Finance suffered a $3.5 million exploit on September 17, 2026, when an attacker manipulated the price of NSTR tokens from roughly $0.006 to $49.5 within minutes. The attacker created a fake NSTR/SolvBTC liquidity pool and used wash trades to inflate the price, then posted the overvalued NSTR as collateral to borrow ETH, STRK, USDC, USDT, WBTC, and DAI. Security firms including GoPlus Security, PeckShield, CertiK, and SlowMist classified the incident as oracle price manipulation rather than a smart contract vulnerability. Nostra responded by halting all protocol functions, causing total value locked to plummet from approximately $4 million to $710,000, freezing funds for all users including those uninvolved in borrowing. Investigators noted the attacker had been accumulating NSTR positions since March 2026 and exploited weaknesses in how price aggregators select reference pools, pointing to a broader supply-chain risk for DeFi lending protocols.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Developer builds text-based scripting language to generate whiteboard animations via AI

A developer has created Strokeline, a scripting language that converts simple text commands into hand-drawn whiteboard animations, with shapes and arrows rendered on a split-screen editor. The tool is designed to be AI-friendly, allowing users to prompt ChatGPT or Claude to generate animation scripts automatically. During development, the creator encountered a critical parser bug where an infinite recovery loop consumed 4GB of RAM and crashed the test suite entirely. A separate React and Zustand state management conflict caused endless re-renders whenever a script contained two or more scenes. Despite these hurdles, core features including character-by-character text reveal and shape-tracing animations are now functional.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Why Python Uses Indentation Instead of Braces, Explained for Beginners

Python uses indentation to define code blocks, unlike languages such as JavaScript and Java that rely on curly braces. This design choice enforces a consistent, readable code structure, but it can trip up newcomers who mix tabs and spaces or use inconsistent spacing. Python's parser strictly distinguishes between tabs and spaces, raising an IndentationError or SyntaxError even when the code appears visually aligned. Experts recommend always using 4 spaces per indentation level and configuring code editors like VS Code or PyCharm to automatically convert tabs to spaces. Linting tools such as flake8 can also help detect indentation issues before code is executed.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

AI-Generated Code Needs Rigorous Testing Before It Is Production-Ready

AI coding assistants can produce clean, functional-looking code within seconds, but experts warn that appearance does not guarantee safety or correctness. Testing consistently exposes logic errors, missing edge cases, security vulnerabilities, hallucinated dependencies, and weak error handling that survive casual review. Because AI models predict code from patterns rather than understanding business rules or security requirements, they silently fill gaps with unverified assumptions. Issues such as SQL injection risks, invented package names, and swallowed exceptions typically surface only under structured testing, often after deployment when fixes are most costly. Developers and engineering leaders are advised to treat AI output as a draft requiring thorough review and testing before it reaches production.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Factory raises $200M at $5B valuation to build AI-powered software development platform

San Francisco-based startup Factory announced a $200 million funding round on September 15, 2026, pushing its valuation to $5 billion — more than triple its $1.5 billion valuation from April 2026. The round was backed by major investors including Blackstone, Sequoia Capital, Khosla Ventures, and Insight Partners, bringing total funding raised to over $400 million. Unlike companies selling AI models, Factory offers a system designed to automate the entire software development lifecycle, from interpreting bug reports and feature requests to writing, testing, and monitoring code. The platform uses multiple AI agents working in parallel, with built-in tools like Droid Shield 2.0 to detect security vulnerabilities in AI-generated code. Factory positions its approach as a continuous feedback loop where deployed software generates new signals that feed back into the development cycle, with minimal human intervention.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

AWS Guide Shows How to Migrate Healthcare AI Agents from ECS to Bedrock AgentCore

AWS has published a migration guide detailing how to move a production healthcare AI agent from self-managed Amazon ECS containers to its managed Bedrock AgentCore runtime. The original ECS setup coordinated three specialized foundation models — for triage, diagnosis, and treatment planning — alongside vector-based knowledge retrieval, all requiring custom state management and observability code. Bedrock AgentCore replaces this with a declarative YAML or JSON configuration, automatically handling model orchestration, state persistence, retries, and CloudWatch logging. The trade-off is reduced operational burden at the cost of visibility, as teams lose access to container-level metrics and cannot customize the underlying execution environment. AWS positions AgentCore as suitable when managed convenience outweighs the need for fine-grained infrastructure control.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

A single order ID label crashed a metrics server and killed payment monitoring

A developer added an order ID as a label to a metrics counter on a Friday to track individual customer orders through a queue. Because order IDs are unique — around 60,000 generated daily across four services — the change caused active time series to explode from 1.1 million to 14 million within three days. The metrics server began crashing in a restart loop by Sunday evening, and by Monday morning the team had no monitoring during a live payments incident. Engineers stopped the bleeding by dropping the label at the scrape layer before redeploying the application, then introduced series budgets, CI checks blocking high-cardinality label names, and a dashboard showing series counts per metric. The incident highlighted that unique identifiers belong on traces or exemplars, not on metric label dimensions where they multiply storage costs across every existing label combination.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Developer Deploys Full-Stack Personal App 24/7 on Free Cloud Tier With PWA Support

A developer has published the fifth and final part of a series detailing the production deployment of LifeOps, a full-stack personal productivity web app, at zero monthly cost. The architecture uses Netlify's free CDN tier for the React frontend, Render.com's free web service for the FastAPI backend, and Supabase's free managed PostgreSQL database. A key challenge addressed is Render.com's automatic container sleep after 15 minutes of inactivity, which the app handles gracefully on the client side to manage cold-start delays. The app was also optimized for mobile browsers on Android and iPhone, and configured as an installable Progressive Web App, bypassing the need for costly app store submissions. The live application is publicly accessible and completes a five-part engineering blueprint covering backend design, frontend UI, interactive modules, reporting, and deployment.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Developer finds four silent failures after API usage check tool itself breaks

A developer building blockchain tools on Cloudflare discovered that the internal endpoint meant to track API usage was itself crashing in production due to an unbound KV namespace. After fixing that, they found rate limiting had also been silently inactive the entire time, failing open without any alerts. A separate investigation into the feedback form revealed that a D1 database had never had its table created, meaning every user submission since launch had been quietly discarded. A Content Security Policy misconfiguration had also been blocking Cloudflare's anti-bot widget from loading, and a mismatched Turnstile secret key compounded the problem. All four bugs shared the same failure mode — the system was designed to fail open and stay silent, making them invisible without deliberate manual investigation.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Split ConfigMap values caused duplicate dispatch emails for two months

A software team discovered that editing a Kubernetes ConfigMap does not trigger a pod restart, meaning environment variables are only updated when pods are recycled. A lease duration change made in June — cutting job timeout from ten minutes to two — never propagated to all running pods until a node pool upgrade in August partially applied it. This left 6 of 24 pods running the new two-minute lease while 18 retained the old ten-minute value, creating inconsistent job-handling behavior across the fleet. Any email send taking over two minutes would be reassigned by the queue and delivered twice, affecting roughly one in every nine thousand sends. The team resolved the issue by adding a configuration hash annotation to deployments and setting up alerts to detect when pods in a fleet report differing config values.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Ethena's sUSDe Contract Has Admin Power to Redistribute Restricted User Balances

The StakedUSDeV2 contract underpinning Ethena's sUSDe token contains a function called redistributeLockedAmount, which allows an admin to move an entire balance from one address to another or burn it. The function is not a hidden backdoor — it is documented in the contract's own comments and only applies to addresses already flagged with the FULL_RESTRICTED_STAKER_ROLE. Blacklisting an address requires a separate BLACKLIST_MANAGER_ROLE, meaning the admin cannot unilaterally restrict and then drain any arbitrary wallet. The admin role is held by a timelock contract enforcing a mandatory 24-hour delay, ensuring any such action must be publicly queued before execution. Key unknowns remain, including who holds the BLACKLIST_MANAGER_ROLE and who can propose transactions on the timelock, which determine the real-world strength of these safeguards.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Why AI Chat Models Should Never Be Used for Distributed Lease Management

A technical analysis warns that engineering teams are mistakenly routing distributed leader election logic through AI chat completion models, a practice that introduces serious reliability risks. Lease renewal operates on strict millisecond budgets, and free-tier or busy AI inference endpoints can stall, queue, or return malformed responses, causing locks to expire and triggering split-brain conditions. Unlike deterministic systems, language models can produce inconsistent outputs from identical inputs, making them unsuitable for control-plane decisions that require uniform, repeatable results. Additional risks include safety filters and rate limits imposed by AI vendors, which can silently hand those providers an effective veto over a system's write path. The article illustrates a correct approach using a PostgreSQL-backed fencing token implementation in Python, where lease acquisition and renewal return only a numeric epoch or nothing, with no model inference involved.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

How AI Agents Can Amplify False Memories Into Confident False Facts

AI agents with persistent memory can fall into a failure mode called a self-reinforcing memory loop, where an inference stored as memory is later retrieved and treated as established fact. Unlike hallucinations that vanish when a session ends, these stored inferences can resurface weeks later and gain false credibility through repetition. The core problem arises when AI memory systems fail to distinguish between what a user explicitly stated, what a tool observed, and what the model merely inferred. Each retrieval cycle can produce a slightly stronger, more confident claim than the last, all without any new real-world evidence entering the pipeline. Researchers note that collapsing these distinct categories into a single undifferentiated memory pool effectively launders an inference into a premise for future reasoning.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Google Play Requires 12 Active Opted-In Testers for 14 Days Before Production Access

Developers with personal Google Play accounts created after November 13, 2023, must have at least 12 testers actively opted into a closed test track for 14 consecutive days before gaining production access — a requirement Google reduced from 20 in December 2024. An opted-in tester is only counted after they click the 'Become a Tester' button via the official opt-in link; simply being added to a tester email list does not qualify. Testers must also install and engage with the app, as Google reviewers can deny production access if no real device activity is recorded during the testing period. If any tester leaves the program mid-run and the count drops below 12, the 14-day progress counter can pause or reset entirely. Additional pitfalls include country-restricted tracks that may silently block opt-in attempts from testers located in excluded regions.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

TypeSafe Launches Jev, an AI Model Built for Bounded Decisions, Not Text Generation

TypeSafe AI introduced Jev in early access on September 15, 2026, billing it as the first 'System One model' — a category inspired by Daniel Kahneman's fast-versus-slow thinking framework. Unlike generative large language models, Jev does not produce open-ended text; instead, it accepts structured state inputs and returns typed answers with probability distributions across a closed set of options. The model supports three question types — Choice, Score, and Noul — enabling semantic judgments such as routing requests, rating sentiment levels, or estimating the likelihood of a condition. As of September 19, 2026, the latest version is jev-1.13.0, supporting up to 64,000 tokens per request with a text-only interface. TypeSafe draws on Jevons paradox to suggest that making such decision-making cheaper could increase overall demand for AI-driven intelligence rather than reduce it.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

6 Docker Containers to Replace Google Services — and the Real Costs Involved

Developer Yash Patel documented his gradual migration away from Google services using six self-hosted Docker containers, as reported on XDA on September 18, 2026. The six replacements are Immich for Google Photos, Nextcloud for Google Drive, Radicale for Google Calendar, Grist for Google Sheets, Vaultwarden for password management, and Reitti for Google Timeline. Patel emphasized a phased approach, replacing only services he wanted personal control over rather than abandoning Google all at once. However, a Thai-language analysis by Nokka on DEV Community notes that the true costs extend beyond free software licenses to include electricity, hardware depreciation, and ongoing maintenance time — averaging around $412 per year based on 2026 self-hosting surveys. Immich alone requires a minimum of 6 GB RAM and 2 CPU cores, and thumbnail generation can increase storage usage by 10–20 percent, costs the original article did not highlight.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Why 'Free' AI Inference Can Still Cost You Dearly in Pipeline Time

Free-tier AI model access does not mean zero cost — when jobs queue behind others, teams pay in wall-clock time through delayed pipelines, idle CI runners, and repeated retries. The article argues that the critical metric is not token usage but time breakdown: how long a job waited, how long the model actually generated, and how often it had to retry. When queue wait dominates total elapsed time, the problem is scheduling, not model expense, and free shared capacity often makes this worse by absorbing demand through delays rather than scaling workers. The author proposes a lightweight instrumentation schema to log each inference attempt — including failures — capturing queued, started, and finished timestamps per job. Aggregating these spans by percentile rather than average is recommended to surface the outlier jobs that silently block users and inflate real-world costs.

0 comments Read more at DEV Community
← NewerPage 1124 of 3220Older →