SShortSingh.

Programming

0
ProgrammingDEV Community ·

Opinion: Agent Log Output Is Not a Substitute for Real Test Verification

A developer essay published on DEV Community argues that AI agent stdout logs are unreliable as test evidence, warning that confident-sounding output can mask skipped runs, recycled snippets, or fabricated results. The author identifies four common myths engineers hold about agent logs, including trusting exit codes and treating chat transcripts as proof of code changes. To counter these habits, the piece proposes a minimal acceptance harness requiring four verifiable fields: the exact command invoked, working directory, numeric exit code, and hashes of stdout and stderr. The author also stresses that git status and git diff are the only valid votes on whether files actually changed, not the agent's narrative. A sample Python script called accept_run.py is provided as a reproducible, language-agnostic gate to run after any agent session.

0
ProgrammingDEV Community ·

Developer Builds Auto-Approval Daemon to Bypass Claude Code's Recurring Computer Use Dialog

A developer created a Python daemon that automatically dismisses Claude Code's Computer Use approval dialog, which reappears every time a session boundary is crossed and cannot be suppressed through settings. Investigation of the Claude 2.1.266 binary confirmed that approval state is stored only in session memory and resets on each new process, ruling out any permanent settings-based fix. The script polls all open Terminal tabs every two seconds and sends an Enter keystroke when the dialog is detected. To prevent misfires, the daemon first checks that the cursor is pointing at the 'Allow for this session' option before acting. Key technical hurdles included AppleScript tab-indexing quirks, the performance cost of reading terminal history, and the daemon failing entirely when launched via launchd instead of as a Terminal child process.

0
ProgrammingHacker News ·

Alibaba releases open-source medical AI model capable of detecting 150+ conditions

Alibaba has open-sourced a medical AI model designed to detect cancer and nearly 150 other health conditions. The release makes the technology publicly available for researchers and developers to access and build upon. The model represents a significant step in applying large-scale AI to clinical diagnostics. By open-sourcing the tool, Alibaba aims to broaden its impact across the global healthcare and research community.

0
ProgrammingDEV Community ·

Senior Engineering Is About Designing Failure, Not Just Making Code Work

A software engineering perspective argues that writing code for the 'happy path' is straightforward, but true senior engineering lies in anticipating and containing failures. The article distinguishes between fault-tolerant 'sovereign bulkhead' systems, where failures are isolated, and fragile systems where a single crash can cascade across services. Examples include circuit breakers, read-replicas, and cached fallbacks that keep core functions like a shopping cart running even when dependent services fail. The piece also cautions that AI coding tools can generate isolated functions but lack awareness of an organization's broader system dependencies and failure blast radius. Engineers are advised to evaluate every critical code path by asking how far damage could spread if that component fails.

0
ProgrammingDEV Community ·

Cisco Email Gateway Patch Fixes Five CVEs, Including Subtle DoS Flaw

Cisco's September 2026 hardening release for its email security appliances addresses five vulnerabilities, tracked under advisory cisco-sa-hardening-esa-dfCrfXkm. Among them, CVE-2026-20353 is a resource lifetime control flaw that can cause excessive resource consumption, service degradation, and system unresponsiveness through improper memory or handle management. CERT-In rated the full set of CVEs as CRITICAL under bulletin CIVN-2026-0461, published on 17 September 2026. Affected products include Cisco Secure Email Gateway and Cisco Secure Email and Web Manager, both version 15.5 and earlier, across physical and virtual deployments. Administrators are advised to verify the exact build against the Cisco advisory and apply the specified fixed release, as the flaw could halt mail flow entirely for organisations routing all inbound email through the appliance.

0
ProgrammingDEV Community ·

How to Keep a Backup Billing Supplier Truly Ready, Not Just Reachable

Vendor concentration risk in metered platforms arises when a fallback supplier can pass a health check but cannot accurately reproduce invoice totals. To stay genuinely prepared, platforms should mirror a small, controlled sample of production events to a secondary supplier and reconcile both against an internal authoritative ledger. The exercise requires two separate budgets: one capping spend on warm-path drills and another governing how much traffic is rerouted during an actual supplier failure. Reconciliation success — not just request acceptance — should serve as the readiness signal, catching issues like missing billable records, duplicate retries, or misassigned customer data. Warmth must be revalidated on a regular schedule since credentials, schemas, and network policies change over time.

0
ProgrammingDEV Community ·

Career Changer With Retail Background Navigates Tech Job Hunt Using Dual-Framing Resume Strategy

A job seeker with eight years in retail management and two years in front-desk work is documenting their honest experience breaking into tech with no formal computer science background. Despite shipping two real Linux projects with active users, the author reports that recruiters frequently treat their non-tech work history as a gap rather than evidence of transferable skills. To compensate, they have developed a strategy of rewriting the same project descriptions in two distinct ways — one technical for software engineering roles, and one focused on problem-solving and user empathy for support or onboarding positions. The author acknowledges the process is often exhausting rather than clever, noting the extra effort required to be taken seriously compared to candidates with traditional CS credentials. They are currently building a more conventionally structured Creator Operations Dashboard as a portfolio capstone, hoping its familiar shape will resonate more readily with hiring managers.

0
ProgrammingDEV Community ·

AI Coding Tools Boost Productivity in Some Cases, But Not All, Research Finds

A developer and researcher named Florence Owusu Aduomi published an article on DEV Community on September 18 examining whether AI coding tools genuinely improve developer speed. The analysis drew on existing research to assess productivity claims surrounding AI-assisted development. Findings indicate that productivity gains from AI coding tools are real in certain contexts but are not a universal outcome. The results suggest that the effectiveness of these tools depends heavily on the specific setting or use case. The article was shared within the DEV Community under topics including AI, web development, programming, and productivity.

0
ProgrammingDEV Community ·

OpenAI Reinstates 5-Hour Usage Cap for Plus Users, Frustrating Coders Mid-Sprint

OpenAI has reinstated a five-hour rolling usage cap for Plus subscribers on its Work and Codex surfaces, reversing a removal it had made earlier in the summer. The return of the limit drew sharp criticism from users, particularly developers who had structured their workflows around the assumption of consistent access. A recurring complaint was not simply that limits exist, but that they shift unpredictably, making it impossible to plan or budget usage across a workday or week. Anthropic users reported similar frustrations, with weekly quotas resetting at irregular intervals and uncertainty over which AI models would remain accessible. The episode highlights a broader tension in AI subscription services: paying customers increasingly find that the usage they are paying for is subject to conditions that can change without reliable notice.

0
ProgrammingDEV Community ·

CoreShroud Platform Aims to Harden Android APKs Against Reverse Engineering

A developer has built CoreShroud, an Android APK protection platform designed to make applications significantly harder to reverse engineer through multiple layered security mechanisms. Rather than relying solely on obfuscation, the platform combines techniques such as string protection, DEX transformations, anti-debugging, runtime integrity checks, and native library protection. The goal is not to make apps impossible to crack, but to substantially raise the effort and cost required for an attacker to analyze or modify them. A key engineering challenge during development has been ensuring that security measures do not break app functionality or introduce excessive performance overhead across different Android versions. CoreShroud is currently under active development, with the creator planning ongoing improvements to its protection capabilities, compatibility, and developer experience.

0
ProgrammingDEV Community ·

Critical Magento RCE Flaw CVE-2026-75650 Exploited via Payment-Failure Emails

Adobe Commerce and Magento Open Source versions 2.4.4 through 2.4.9 are affected by an unauthenticated remote code execution vulnerability, CVE-2026-75650, which exploits the platform's payment-failure email rendering engine. Dutch security firm Sansec, which dubbed the campaign StyleSmuggler, recorded active exploitation beginning September 4, 2026, with CISA adding the flaw to its Known Exploited Vulnerabilities catalog on September 8. Adobe issued emergency hotfix VULN-39341 on September 7 under advisory APSB26-146, noting that stores already patched with the August 2026 monthly update remained exposed. Attackers inject malicious data into error reports and payment records, then trigger the standard payment-failure reminder email, causing the template engine to execute arbitrary PHP code with web-server privileges. Observed post-compromise payloads include a Rust backdoor disguised as system processes and PHP web shells, with remediation requiring the hotfix, credential rotation, and a targeted malware scan.

0
ProgrammingDEV Community ·

AI Coding Tools Boost Junior Devs but Slow Down Experienced Ones, Studies Find

Recent research presents a mixed picture of AI coding assistants' impact on developer productivity. A multi-company field study involving 4,867 developers found that those using GitHub Copilot completed 26% more tasks, with less experienced developers seeing the greatest gains. However, a July 2025 randomised controlled trial by METR found that 16 experienced open-source developers took 19% longer to complete tasks when AI tools were available, despite expecting a 24% speed improvement. The gap between perceived and actual productivity was notable — developers believed AI had made them faster even when measurements showed the opposite. Researchers suggest the two studies are not contradictory, as outcomes appear to depend heavily on developer experience, task type, and the familiarity of the codebase.

0
ProgrammingDEV Community ·

Developer Warns: AI-Assisted Coding Can Summon Products Nobody Truly Understands

A software developer behind a project called Contenox has shared a cautionary account of how relying heavily on AI-generated code led to a subtle but serious permissions bug that slipped past all standard checks. The flaw caused existing users to reference outdated permission values stored as key-value pairs, while new users correctly inherited updated settings — a design issue never consciously thought through by any human. The developer argues that AI-assisted development can produce clean, passing code that conceals flawed logic, making traditional code reviews largely ineffective since no reviewer retains context of the original implementation. The post raises a broader concern: when developers use AI to generate core architecture without deeply understanding it themselves, they risk building systems they have not truly designed. The author, a veteran engineer, concludes that products built entirely through AI prompting are effectively "summoned" rather than engineered, leaving teams ill-equipped to reason about or safely evolve them.

0
ProgrammingDEV Community ·

JetBrains Releases Ktor 3.6.0 with HTTP/3 and OpenID Connect Support

JetBrains launched Ktor 3.6.0 on September 18, 2026, delivering a significant update to its open-source Kotlin web framework. The release introduces experimental HTTP/3 support via the QUIC protocol on the Netty engine, promising lower latency and improved performance on unreliable networks. A new type-safe OpenID Connect authentication module is also included, aimed at reducing boilerplate code and minimizing security vulnerabilities in identity-aware services. Additional improvements cover routing DSL enhancements, multiplatform client defaults for JVM, JavaScript, and native targets, and various bug fixes including duplicate-cookie parsing. JetBrains has indicated a 4.0 release is planned for early 2027, expected to bring production-grade HTTP/3 stability and deeper Kotlin integration.

0
ProgrammingDEV Community ·

Developer builds tool to streamline AWS security change investigations

A developer identified a recurring pain point in AWS security workflows: while alerts are easy to receive, understanding the full context of a change is time-consuming. Investigating a single IAM policy update or security group modification can require jumping between CloudTrail, IAM, Terraform, and GitHub. To address this, the developer is building a tool called Kultarr, which aims to consolidate change context — including who made the change, what was affected, and any related deployment activity — into one place. The project is still in development, with ongoing work on complex IAM edge cases around effective access. The developer is also seeking input from AWS users on which part of the investigation process typically takes the most time.

0
ProgrammingDEV Community ·

Researcher Builds Meta-Learning System for Satellite Anomaly Detection in Climate Infrastructure

A developer spent six months investigating how to maintain anomaly detection on long-lived satellites that monitor carbon-negative infrastructure such as carbon capture facilities and orbital solar reflectors. The core challenge involves adapting AI models to novel satellite failure modes using only a small number of telemetry samples, given that LEO satellites have just 8–12 minutes of ground contact per orbit and radiation-hardened onboard processors are far slower than terrestrial hardware. The researcher applied Model-Agnostic Meta-Learning (MAML) variants to train model initializations capable of rapidly specializing to new anomaly types without forgetting previously learned ones — a problem known as catastrophic forgetting. An additional constraint stems from the carbon-negative mission itself: false-positive anomaly alerts can trigger unnecessary energy use on the ground, undermining climate goals. The article documents architectural patterns and early quantum-enhanced optimization techniques that showed promise for this resource-constrained, mission-critical use case.

0
ProgrammingHacker News ·

OpenAI Used Its Own AI Models to Help Design Its Custom Jalapeño Chip

OpenAI leveraged its own large language models to assist in the design of its custom AI chip, internally codenamed Jalapeño. The company applied LLMs as tools within the chip engineering workflow, marking a notable case of AI being used to build AI hardware. This approach highlights a growing trend of using generative AI to accelerate and optimize semiconductor design processes. The development was reported by IEEE Spectrum, a leading engineering and technology publication.

0
ProgrammingDEV Community ·

FlowScript 0.1 Debuts as a Semantic Language for Modeling Apps Before Coding

Developer Erland Kjensli has publicly released FlowScript 0.1, an experimental domain-specific language designed to describe the semantic model of an application before any implementation begins. The project addresses limitations of traditional flowcharts, which struggle to capture the full complexity of modern apps including state, navigation, UI structure, and dataflow. FlowScript separates structural hierarchy, navigation graphs, and state graphs as distinct but related concepts, aiming to reduce ambiguity in application modeling. A key hypothesis behind the language is that responsive UI layouts can be treated as projections of a single underlying semantic model rather than separate application hierarchies. The initial release is available as a working draft on GitHub under version 0.1.0.

0
ProgrammingDEV Community ·

Encoding API contracts in tool schemas beats prose descriptions for smaller LLMs

A developer team discovered in May 2026 that two AI models — Opus 4.7 and Sonnet 4.6 — produced different JSON outputs from the same tool description, with the smaller model returning an incorrect structure that triggered downstream 422 errors. The root cause was not a capability difference but an exposure gap: the larger model had seen the proprietary field names during training, while the smaller one guessed plausible-sounding alternatives. Because tool descriptions are prose rather than enforced contracts, models without prior exposure to a custom schema have no validated structure to follow. The team resolved this by migrating the structural contract into the JSON schema itself, using discriminated oneOf branches with strict required fields for the nine most common pattern types. They applied a permissive fallback branch for rare pattern kinds, limiting the upfront effort to roughly one afternoon while targeting the failures that actually occurred in production.

0
ProgrammingDEV Community ·

Microsoft's Record September 2026 Patch Tuesday Fixes 974 CVEs, Two Already Exploited

Microsoft's September 2026 Patch Tuesday addressed 974 CVEs — its largest-ever monthly release — including two zero-day vulnerabilities already being actively exploited at the time of release. One exploited flaw, CVE-2026-81963, is a local privilege escalation in the Windows Update Stack itself, meaning the patch-delivery mechanism became an attack surface capable of elevating a low-privileged user to SYSTEM. The other, CVE-2026-85880, is a heap buffer overflow in Windows ALPC that allows a sandboxed AppContainer process to escape and reach SYSTEM-level privileges. Both flaws require existing local access and serve as escalation steps in broader attack chains rather than standalone entry points. CISA added both vulnerabilities to its Known Exploited Vulnerabilities catalog on 8 September 2026, setting a federal remediation deadline of 22 September 2026.

← NewerPage 1135 of 3220Older →