SShortSingh.

Programming

0
ProgrammingDEV Community ·

Linux File Permissions Explained: Users, Groups, and chmod Basics

In Linux, every user has a unique UID and belongs to at least one group, with the kernel using these groups to enforce file permissions. Each file has three permission categories — owner user, owner group, and others — each assigned read, write, and execute rights represented in octal notation. Permissions are expressed as three-digit values, such as 755, where each digit is the sum of read (4), write (2), and execute (1) for each category. Commands like chmod, chown, and chgrp allow modification of permissions and ownership, though most require root access or specific group membership to run. The root user bypasses standard permission checks and retains read and write access even on files with 000 permissions, though it still cannot execute such files without explicitly granting execute permission.

0
ProgrammingDEV Community ·

Treat Every AI Prompt as a Data Egress Event, Security Architects Warn

Developers using AI code-generation tools are being urged to treat every prompt as a potential data egress event, since information sent to remote models leaves local control entirely. An architectural review published on DEV Community argues that working directories often contain sensitive tokens, hostnames, and credentials that must never reach external AI services. The proposed safeguard involves a local gate that classifies files before packing, allowing only explicitly approved paths while blocking secrets, environment files, and infrastructure maps. A sample policy file defines strict allow and deny rules, with any detected secrets triggering an immediate abort of the export process. The piece warns that the most common security failure is developers dumping entire repositories directly into prompt windows, bypassing all inspection and crossing trust boundaries unchecked.

0
ProgrammingDEV Community ·

Developer Verifies GitHub Stars for 12 Popular Claude AI Skills, Finds Catalog Data Misleading

A developer named Nokka published an analysis on DEV Community on September 19, 2026, examining 12 popular Claude AI skills by pulling star counts directly from the GitHub API. The investigation was prompted by significant discrepancies found between figures cited on various skill catalog websites and actual GitHub data — for example, the ui-ux-pro-max skill was variously listed at 88,743 to 119,920 stars, while the API returned 128,854. The top-ranked skill by stars was Superpowers (obra/superpowers) with 288,565 stars, followed by Matt Pocock Skills at 265,304 and UI/UX Pro Max at 128,854. Nokka also flagged the Caveman repo's unverified claim of 65% token reduction and noted its license could not be identified as a standard type by the GitHub API. All figures in the article reflect a single-day snapshot and are expected to change daily.

0
ProgrammingDEV Community ·

Step-by-Step Guide: AWS IoT Fleet Provisioning with CSR on ESP32-S3

Fleet provisioning is a secure IoT onboarding method where a device generates its own private key locally and submits a Certificate Signing Request (CSR) to AWS IoT Core to receive a unique X.509 certificate on first connection. The private key never leaves the device, making it suitable for hardware with secure elements and custom PKI setups. A developer has published a detailed walkthrough using an ESP32-S3-WROOM-1 module running on Ubuntu with ESP-IDF v5.5.5 and the esp-aws-iot SDK. The guide covers setting up a provisioning policy in AWS IoT, generating claim certificates, building the firmware, and configuring a provisioning template to register and activate devices. The approach supports both AWS-managed and self-managed certificate authorities, offering flexibility in certificate validity and signing algorithms.

0
ProgrammingDEV Community ·

MongoDB Indexes Explained: B-Trees, ESR Rule, and Query Optimization Tips

A technical guide published on DEV Community revisits how MongoDB uses B-Tree data structures to power collection indexes, enabling logarithmic O(log N) query lookups instead of full document scans. Every MongoDB collection automatically receives a unique index on the _id field, while additional indexes must be designed carefully using the Equality-Sort-Range (ESR) rule to avoid inefficient in-memory sorting. Developers are advised to run explain('executionStats') to detect slow COLLSCAN operations and monitor the ratio of documents examined versus documents returned. The guide also covers compound, multikey, text, and TTL index types, mapping each to specific query patterns. A key trade-off highlighted is that indexes consume memory and slow down write operations, so write-heavy workloads such as IoT telemetry should use as few indexes as possible.

0
ProgrammingHacker News ·

Designer argues AI-generated event posters can achieve quality results

A designer named John Hartnup published a blog post on June 7, 2026, challenging the notion that AI-generated posters are inevitably low quality. The article, shared on Hacker News, argues that thoughtful use of AI tools can produce visually appealing event posters. The post attracted modest engagement, earning 13 points and 5 comments on the platform. Hartnup appears to advocate for a more nuanced view of AI in graphic design, suggesting outcomes depend heavily on how the technology is applied.

0
ProgrammingDEV Community ·

Fix macOS Stage Manager Full-Screen Gap Caused by External Keyboard Fn Key Limits

Mac users running Stage Manager often find that window-maximizing tools like Rectangle leave a 15–20% strip on the left side of the screen reserved for app thumbnails. The built-in macOS 'Fill' command solves this by stretching a window edge-to-edge while keeping Stage Manager active, but its default shortcut Fn+Control+F fails on third-party keyboards because those devices process the Fn key internally and never pass it to macOS. Users can work around this by creating a custom keyboard shortcut — such as Control+Option+F — mapped to the menu item 'Fill' under System Settings > Keyboard > App Shortcuts. Logitech keyboard users should also switch their device to Mac mode by holding Fn+O for three seconds, ensuring modifier keys map correctly to Apple's layout. Together, these two steps restore full-screen functionality without requiring an Apple Magic Keyboard.

0
ProgrammingDEV Community ·

Why AI Coding Agents Should Leave Replay Scripts, Not Just Chat Logs

A backend engineer merged a fix generated by an AI coding agent, but reviewers found the build failed on a clean machine with no trace of the original chat session. The core problem is that chat transcripts record intent rather than reproducible steps, meaning work validated inside one AI session may not survive outside it. To address this, a structured 'spike' ritual is proposed where the agent must produce a replay script — a shell script that restores a clean environment, applies only committed changes, and exits successfully on any machine without agent involvement. The spike runs within a fixed time budget, starts with a written hypothesis and a pre-existing failing test, and is killed outright if the replay script is missing or unrunnable elsewhere. The framework treats reproducibility, not conversational confidence, as the true measure of whether engineering work is done.

0
ProgrammingDEV Community ·

Why Comparing AI Agent Pass Rates Without Token Budgets Is Misleading

A software engineering analysis argues that pass rates alone are an unreliable benchmark for evaluating AI coding agents when the token and tool-call budgets differ between runs. An agent that retries repeatedly until hitting a cap may outperform one given a single attempt, yet both results get averaged as if conditions were equal. The proposed protocol requires declaring a fixed budget before any model call, logging every attempt in a JSONL ledger, and publishing three metrics together: pass rate, truncation rate, and tokens-per-success. Task files must be hashed with SHA-256 so any fixture change invalidates the run ID, ensuring reproducibility. The author frames this as a methodological standard rather than a vendor comparison, noting that omitting budget data turns an engineering review into what they call 'a vibe with a percentage sign.'

0
ProgrammingDEV Community ·

Developer builds AI-integrated platform where models share app architecture

A software developer has been experimenting with embedding AI directly into application architecture, rather than treating it as a standalone chatbot feature. An early project involved an AI-assisted chess database, where users could search games, add commentary, and configure the app through conversational AI assistants. This experiment demonstrated that AI could serve as a core interface for operating an application, not merely an add-on layer. The developer has since expanded the concept into a more general platform where AI models, databases, and application components share a unified architecture. In this evolving system, the application manages context, exposes functions to the models, and retains control over the overall workflow.

0
ProgrammingDEV Community ·

Codpal open-sources Deckgauge, a self-hosted engineering metrics dashboard

Yaniv, founder of CTO-as-a-service firm Codpal, has open-sourced Deckgauge, an engineering analytics tool his team built to rapidly assess how large engineering departments operate. The platform integrates data from Jira, GitHub, GitLab, and Azure DevOps into a single dashboard, surfacing DORA metrics, team focus, per-engineer workload, and CapEx vs OpEx breakdowns. Notably, the tool was largely developed by AI agents using Claude Code with human review at every merge. Deckgauge is fully self-hosted via a single Docker deployment, meaning no data leaves a company's own infrastructure. It is available under the FSL-1.1 license, which permits free use for non-competing purposes and is set to convert to Apache-2.0 in September 2028.

0
ProgrammingDEV Community ·

Developer Builds AI Agent to Automate Real Estate Comps, Shares What Works

A real estate investor and developer documented their hands-on experience building an AI agent to automate property comparable analysis, a process traditionally requiring hours of manual spreadsheet work. Early attempts using a basic LangChain agent with web scraping tools repeatedly failed with silent timeouts and no useful output. Switching to LangGraph provided more structured control by defining explicit states for data retrieval, filtering, adjustment calculation, and report generation. The developer also experimented with CrewAI's multi-agent setup, separating data analysis and property valuation roles, though this introduced additional failure points. Key lessons included building robust edge-case handling, structured JSON outputs, and pre-filtering steps to reduce API token costs.

0
ProgrammingDEV Community ·

How LLMs Actually Process Text: Tokenization Explained for Developers

Large language models never process raw words — instead, text is first broken into fragments called tokens and converted into sequences of numbers before the model sees anything. A token is typically a piece of a word rather than a whole word, and a separate component called a tokenizer handles this conversion before any neural network processing occurs. Modern models use subword tokenization algorithms such as BPE or WordPiece, which balance vocabulary size and sequence length by splitting rare words into smaller reusable pieces. This design explains several practical AI engineering realities, including why APIs charge per token, why long prompts cost more, and why context windows have hard limits. Developers can explore tokenization hands-on using OpenAI's open-source tiktoken library to see how different types of text — including code, emojis, and non-Latin scripts — map to token counts.

0
ProgrammingDEV Community ·

Plugin4Shell: AI Coding Agents Ignore SHA Pins, Exposing Millions to Supply Chain Attack

Security researchers at AIR have disclosed a vulnerability called Plugin4Shell, which they describe as the first supply chain vulnerability in the AI agent ecosystem, affecting Claude Code, Codex, GitHub Copilot, and Gemini CLI. The flaw allows attackers to substitute malicious code in place of a pinned commit SHA, because none of these agents verify that the checked-out code actually matches the requested commit. The attack requires zero user interaction and can be triggered silently via auto-update features enabled by default in Claude Code and Codex. Anthropic and OpenAI have issued patches, but Microsoft has yet to release a fix for Copilot — used by nearly 90% of Fortune 500 companies — while Google has deprecated Gemini CLI entirely without patching it. Users of unpatched tools remain at risk of attacker-controlled code executing with elevated agent permissions until vendors ship verified checkout logic.

0
ProgrammingDEV Community ·

Student from Kabirwala Launches Blogging Journey Using Only a Mobile Phone

Waqas, a student from Kabirwala, Punjab, has published his first post on DEV.to, marking the start of his blogging and web development journey. Working without a laptop, he manages all his work entirely from a mobile phone. He plans to post daily, covering topics such as mobile blogging, Linux basics for beginners, and ways students can earn passive income online. His stated goals are to sharpen his writing skills and document his learning for others in similar situations. He is also looking to connect with fellow students from smaller cities who share an interest in technology and blogging.

0
ProgrammingDEV Community ·

Filters, Interceptors, and AOP: Choosing the Right Spring Tool for Cross-Cutting Concerns

Spring provides three tools — Servlet Filters, Handler Interceptors, and AOP Aspects — to handle cross-cutting concerns like logging, authentication, and metrics without duplicating code across controllers. Filters sit at the outermost layer, operating on raw HTTP requests before Spring even initializes, making them ideal for security gates, CORS headers, and compression. Handler Interceptors run inside Spring's DispatcherServlet and have awareness of which controller method will handle the request, offering hooks before and after the controller executes. AOP Aspects sit deepest in the stack, wrapping individual bean methods and firing even for non-web calls, making them suited for service-layer concerns. The key distinction is depth: as you move inward from Filter to Interceptor to Aspect, each layer gains more Spring context but loses direct access to raw HTTP details.

0
ProgrammingDEV Community ·

Why a 45 KB webpage can still damage your phone's lifespan, carbon models aside

Current per-byte carbon models used to rate webpage sustainability assign equal scores to pages with identical file sizes, regardless of how they actually perform on a device. Research from two independent sources — the Sustainable Web Design model and France's ADEME–Arcep study — agrees that end-user device manufacturing, not data transfer, accounts for the largest share of digital's carbon footprint. However, both models still calculate manufacturing impact as a proportion of bytes transferred, even though device lifespan is shortened by poor runtime performance, not page weight. A poorly optimised 45 KB page running continuous CPU loops or blocking the main thread can accelerate device obsolescence just as much as a much heavier page. Metrics like Interaction to Next Paint and CPU idle state are argued to be more meaningful proxies for real-world environmental impact than transferred kilobytes alone.

0
ProgrammingHacker News ·

Chess Atlas Visualizes the Geographic History of Chess

A project called Chess Atlas has been shared on Hacker News, presenting a visual gallery exploring the history and geography of chess. The tool is hosted online and appears to map or chart the spread and evolution of the game across regions and time periods. It received 7 upvotes on Hacker News at the time of posting, though no comments had been added yet. The project is accessible via a public web gallery built on the Vercel platform. It represents a community-driven effort to document chess history in a visually engaging format.

0
ProgrammingDEV Community ·

How domain coloring renders complex functions as vivid images in a browser

Domain coloring is a mathematical visualization technique that maps complex functions onto a 2D plane by encoding each output's angle as hue and its magnitude as brightness, making zeros, poles, and growth rates instantly readable. A developer has implemented this method inside LK Forge, a free browser-based graphing calculator, without using WebGL or 3D rendering. The tool relies on a custom shunting-yard expression parser that handles complex arithmetic using paired real-imaginary values, correctly computing identities such as i² = −1 and e^(iπ) = −1. To maintain interactivity, the renderer samples at half resolution during idle states and drops to quarter resolution while dragging, achieving roughly 3.4 million evaluations per second on a single thread. The result is a fully interactive complex function plotter that loads any expression safely via a URL parameter and repaints the canvas within milliseconds of user input.

← NewerPage 1125 of 3220Older →