SShortSingh.
TopTechnologyAI & MLStartupsProgrammingScienceBusinessFinanceCrypto & Web3World

Programming

LatestTopDiscussed
0
ProgrammingDEV Community ·

SeaweedFS vs RustFS: Choosing the Right Open-Source Object Store for Your Needs

SeaweedFS and RustFS are both Apache 2.0, single-binary storage solutions, but they are designed for different use cases. SeaweedFS is a distributed file system that supports S3, POSIX/FUSE mounts, and Iceberg lakehouses, using a compact 16-byte per-object index to efficiently manage billions of small files. RustFS, written in Rust, is a purpose-built S3-compatible object store modeled as a MinIO drop-in replacement, supporting features like versioning, object lock, and IAM policies. SeaweedFS is better suited for workloads requiring POSIX access or massive small-file scale, while RustFS is the simpler choice for teams that only need an S3 interface. The key distinction is that SeaweedFS is a file system with S3 capabilities, whereas RustFS is an S3 engine with no POSIX layer.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

How PostgreSQL's NOTIFY Queue Fills Up and How to Clear It

A developer reproduced the PostgreSQL 'too many notifications in the NOTIFY queue' error using PostgreSQL 17, Docker, and a deliberately limited queue size of 512 KiB set via the max_notify_queue_pages parameter. With a listener session held idle inside an open transaction, 100 large pg_notify() calls were issued from a second connection, filling the queue entirely after 64 successful sends and causing 36 to fail. The key finding is that an open transaction on the listener side blocks notification cleanup, regardless of how large the queue is configured. Simply committing the idle transaction allowed all pending notifications to be delivered and the queue usage returned to zero. This demonstrates that raising max_notify_queue_pages only delays the problem — the real fix is ensuring listener transactions do not remain open unnecessarily.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Developer Builds Sanity-Powered Repost Marketplace Showcase Without a Full Backend

A developer built Pulse Wall, a content-driven spin-off of Pulse — a social promotion marketplace where businesses run repost campaigns and promoters earn money — using Sanity as the content layer instead of a traditional backend. The project was submitted to the Sanity Challenge under Path Two and reuses an existing Next.js UI with Tailwind and shadcn/ui components, replacing backend services like authentication, payments, and a Go API with Sanity's Content Lake and Studio. Campaign listings and promoter spotlights are managed entirely through Sanity Studio, embedded directly into the app, allowing content updates without redeployment. Key technical hurdles included resolving CORS errors for Studio API calls and fixing a Next.js static prerendering issue where new Sanity content wasn't appearing live until dynamic rendering was enforced in the correct file. The app is deployed on Render with a GitHub Actions workflow pinging the free-tier instance every five minutes to prevent it from spinning down.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Karui Android App Adds Expanding Text Input After User Feedback

A developer updated their lightweight 85KB Android to-do list app, Karui, to feature auto-expanding text input bars while typing. The improvement was suggested by a community member in the app's Telegram group, prompting the developer to implement it. Popular messaging apps like WhatsApp and Telegram already use this feature, which helps users see the full context of what they are editing. The developer credited the user feedback as a key driver of the app's growth, describing Karui as gradually evolving into a capable note-taking tool. Karui is open source and available on both GitHub and F-Droid.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

astro-tasks Unifies GitHub, WakaTime, and Git Checks in One CLI Command

A developer has released astro-tasks, an open-source Python tool that consolidates common pre-work checks into a single terminal command. The tool aggregates GitHub notifications, open pull requests, WakaTime coding statistics for the past seven days, and a local repository health scan. It can be installed via pip and offers subcommands to run each check individually, as well as a JSON output flag for piping data into other tools. The utility requires GitHub CLI authentication and a WakaTime configuration file, and supports Python 3.8 and above. Licensed under MIT, the project is hosted on GitHub and the author is actively seeking feedback on its JSON schema and multi-machine WakaTime support.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Developer builds open log to track AI quota resets and pricing changes across providers

A developer frustrated by undocumented shifts in AI quota reset schedules built Alca, a read-only, no-signup website that tracks model access, pricing, free tiers, and rate limits across AI providers. The site's most-used feature is a dated reset log linking every announced change back to its original source. All content is stored as TypeScript files in a repository, with pull requests serving as the editorial process and CI checks enforcing data integrity — eliminating the need for a database or admin panel. Each data entry carries a verification status indicating whether a source link has been confirmed, making data reliability transparent to users. The site is live at alca-navy.vercel.app and offers a public JSON API under /api/v1 for programmatic access.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

How 'As Needed' Fed Backstops Stop Panics Before They Start

A new simulation model shows that the Federal Reserve's market backstop functions more like a state machine than a calendar, activating when specific market stress conditions are met rather than on a fixed timeline. The model distinguishes between two mechanisms: an absorption channel that buys forced-sale flow after it occurs, and an expectations channel that discourages selling before it happens. Data from the March 2020 calibration path shows that an open-ended 'as needed' commitment reduced total losses to 22.8%, compared to 36.5% with no backstop, largely because anticipated selling never materialized. At full expectation effect, the absorption channel went unused entirely, as the mere announcement of an unlimited buyer eliminated the liquidation pressure it was meant to absorb. The findings suggest that the credibility and open-endedness of a policy commitment matters more than its actual deployment size.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Developer Launches WebCraft7767 to Build Free, Practical Web Apps on GitHub

A developer going by WebCraft7767 has announced a new public project showcase hosted on GitHub, focused on building free, practical websites and web applications from scratch. The initiative is aimed at learning through real-world projects rather than following tutorials, while also serving as a portfolio-building exercise. Among the early projects is a web app designed to help users find nearby repair technicians and local handy-service providers. The developer plans to cover a range of ideas and problem areas, openly documenting progress, lessons learned, and iterative improvements over time. Updates and project highlights will also be shared on the developer community platform DEV.to.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Native Federation v4 Explained: Why a Second Module Federation Was Built on Web Standards

Native Federation is an alternative implementation of the micro-frontend module federation pattern, designed to address structural limitations in webpack's original Module Federation approach. While webpack's Module Federation successfully enabled runtime remote module loading, it tied every host and remote application to webpack's proprietary runtime and container format. Native Federation instead builds directly on browser-native ECMAScript Modules and Import Maps, eliminating the need for a bundler-mediated runtime layer. This architectural shift aims to reduce tooling lock-in and ease migration friction when teams move away from webpack to bundlers like Vite or esbuild. The v4 rewrite marks a significant evolution of the project, and a forthcoming eight-part series will explore its core systems, adapters, orchestration, and migration paths in depth.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Study of 3.2M Telegram channels finds median post reach drops from 31% to 3% as audience grows

A new open-data study analyzed 3,205,346 public Telegram channels by dividing average post views by subscriber count to calculate audience reach. Channels with 1,000 to 5,000 subscribers showed a median post reach of 31.4%, while channels exceeding 500,000 subscribers reached just 3.3% of their audience. Researchers chose the median over the mean to avoid distortion from outliers, including channels where viral forwards push view counts above total subscriber numbers and channels with inflated or inactive follower bases. Channels below 1,000 subscribers were excluded due to statistical noise caused by single forwarded posts skewing the ratio. The findings are published as open data, with a full percentile ladder per audience-size band available via API to provide transparent benchmarking context.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Java Generic Stack Eliminates ClassCastException Risks With Compile-Time Type Checks

Before Java 5 introduced generics, stacks and collections relied on raw Object references, pushing type-mismatch errors to runtime as ClassCastException failures. A custom generic stack implementation demonstrates how parameterized types let the compiler enforce type correctness automatically, removing the need for manual casting on every pop operation. Because Java erases generic type parameters at runtime, the implementation backs its internal store with an Object array and isolates the unchecked cast inside the pop method to work around direct generic array creation. Nulling out vacated slots after each pop prevents memory leaks by allowing the garbage collector to reclaim objects no longer in use. The approach shows how generics improve both code safety and readability without sacrificing the stack's ability to grow dynamically at runtime.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

ZCode data leak, OpenAI breach, and Korea fines highlight single-dependency risks

Three cybersecurity incidents surfaced this week, illustrating the dangers of over-trusting a single tool or vendor. Coding agent ZCode was found silently uploading users' Git histories to the cloud, while researchers exploited a heap overflow and an SSO misconfiguration to access OpenAI's internal repositories. South Korea also announced it would raise data-breach fines to 10% of company revenue, making compliance failures potentially business-ending. Security experts warn that most small businesses and SaaS operators unknowingly rely on undermaintained plugins, unvetted APIs, or third-party tools with broad access to sensitive data. The recommended response is not adding more security tools, but auditing every external dependency by its access level and preparing contingency plans for when key services fail or are compromised.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Rapuncel Malware Uses Signed Kernel Driver to Kill EDR Tools via Fake GitHub Repos

A Malware-as-a-Service campaign dubbed Rapuncel has been distributing infostealer malware through SEO-optimized fake GitHub repositories impersonating over 40 legitimate companies. Victims searching for software are lured into downloading oversized ZIP files hosted via GitHub Pages, which contain a fake installer that side-loads a malicious DLL into a legitimate Microsoft debugger process to gain SYSTEM privileges. A signed kernel driver, Alinubx.sys, is then deployed to terminate 145 security-related processes — including antivirus and EDR tools — from kernel mode, effectively blinding endpoint defenses. Rapuncel proceeds to steal credentials from browsers, cryptocurrency wallets, Discord, Steam, Telegram, and Windows Credential Manager, exfiltrating data to a remote server. Persistence is maintained through a registered Windows service that continues disabling security tools and harvesting data after system reboots.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Researchers Breach OpenAI Internal Repo via HEIF Image Flaw and Overprivileged SSO Token

Security researchers disclosed a critical vulnerability chain, assigned CVE-2026-32882, that allowed remote code execution on OpenAI's Discourse-based forum by uploading a crafted HEIF image that exploited a heap overflow in libheif 1.19.7 via ImageMagick. The RCE enabled attackers to harvest an overprivileged OpenAI SSO token from the compromised forum environment, which was then used to access an employee's ChatGPT and Codex account. Through the employee account's connected GitHub integration, researchers demonstrated the impact by having Codex submit a pull request to an internal OpenAI repository. The exploit was developed with assistance from Claude Opus AI models, though the process required expert human guidance and was not fully autonomous. Recommended mitigations include patching libheif, sandboxing image processing, and restricting SSO token scopes to least-privilege principles.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Critical RCE Flaw CVE-2026-58138 in Orkes Conductor Exploited via Unauthenticated API

A critical vulnerability (CVE-2026-58138, CVSS 9.8) in Orkes Conductor OSS versions 3.21.21 through 3.30.1 allows unauthenticated remote attackers to execute OS commands by submitting malicious workflow definitions to an exposed Workflow API. The flaw stems from the API lacking authentication by default, enabling attackers to inject harmful JavaScript or Python expressions via task types such as INLINE, LAMBDA, DO_WHILE, or SWITCH, which are then executed through GraalVM with full host access. Empirical Security observed active exploitation in its telemetry, while Fortinet reportedly blocked around 1,300 attack attempts, though successful code execution has not been publicly confirmed. Successful exploitation could grant attackers root-level access within the Conductor container, potentially compromising connected data, credentials, microservices, and AI agents. Administrators are advised to upgrade to version 3.30.2 or later and restrict Workflow API access to internal networks with proper authentication and authorization controls.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

oh-my-agent update converts failed agent runs into automated skill regression tests

Open-source agent framework oh-my-agent released a major update spanning 131 commits, advancing its CLI from version 14.7.11 to 14.13.1. The core change allows failed agent runs to be captured as incidents, promoted into regression fixtures, and used to automatically optimize the underlying skill within a configured dispatch budget. A new meta-optimization feature treats the optimizer prompt itself as a candidate for improvement, requiring statistical validation before any changes are adopted. Additional updates include a routing evaluation tool, a code-intelligence guard that blocks native search commands in favor of designated tools, and fixes for several bugs affecting job scheduling, skill scoring, and CLI argument parsing.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

North Korea's WaterPlum Campaign Infected 30,000 Devices, Stole Crypto via Fake Job Interviews

A North Korean cyber group known as WaterPlum, also called Contagious Interview, conducted a campaign between December 2025 and July 2026 that infected at least 30,000 devices across more than 100 countries. Government agencies from the United States, Australia, Germany, and Japan jointly disclosed that attackers targeted IT professionals by posing as recruiters on social media, job boards, and freelance platforms. Victims were tricked into executing malicious npm packages or VS Code projects disguised as coding interview tasks, which deployed malware families including BeaverTail, InvisibleFerret, OtterCookie, and StoatWaffle. The campaign resulted in credentials and assets being stolen from over 7,000 cryptocurrency wallets, with at least 1.7 billion JPY in cryptocurrency transferred to North Korea. In a separate but related vector, North Korean operatives also infiltrated companies as fake remote employees using forged resumes, VPNs, and AI-assisted identity tools.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

RepoGuard Studio Uses Sanity Content Lake to Enforce Next.js Architecture Rules

RepoGuard Studio is an open-source tool built to prevent AI coding assistants like Cursor and GitHub Copilot from introducing architectural anti-patterns in Next.js projects. The tool stores and serves architectural guardrails through Sanity's Content Lake using GROQ queries, rather than relying on static configuration files. It features an interactive rules catalog, a live code linter that generates an Architectural Health Score, and a one-click generator for AI-specific context files such as .cursorrules and CLAUDE.md. Developers can audit their codebase or initialize guardrails instantly via the command line using npx without any prior installation. The project was submitted as part of the Sanity Challenge and is fully open-source under the MIT license on GitHub.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

US Agencies Warn AI Tools Now Used to Attack Industrial Control Systems

Five U.S. federal agencies — NSA, CISA, FBI, DOE, and EPA — issued a joint advisory in August 2026 confirming that threat actors are using AI-generated code to exploit Siemens S7 series PLCs at water, energy, chemical, and manufacturing facilities. This marks the first official government alert to explicitly state that AI is being weaponized against operational technology (OT) infrastructure. Attackers use internet scanning services to locate exposed PLCs on port 102, then feed that data into AI tools that automatically generate working Python exploitation scripts via the snap7 library. The four-stage attack chain covers discovery, AI-assisted script generation, disguise as legitimate monitoring traffic, and unauthorized read or write access to PLC memory and logic. Authorities recommend removing PLCs from direct internet exposure, segmenting OT networks, enforcing strong authentication, and planning hardware replacement for legacy devices that cannot be patched.

0 comments Read more at DEV Community
← NewerPage 1133 of 3220Older →