SShortSingh.
TopTechnologyAI & MLStartupsProgrammingScienceBusinessFinanceCrypto & Web3World

Programming

LatestTopDiscussed
0
ProgrammingHacker News ·

Ledger Researchers Break RP2350 Secure Debug Using Laser Fault Injection

Security researchers at Ledger's Donjon lab have demonstrated a method to bypass the secure debug protections on Raspberry Pi's RP2350 microcontroller. The technique, called Photon-Emission-Guided Laser Fault Injection, uses emitted light from the chip to precisely locate and target vulnerable transistors with a laser. By inducing carefully timed faults, the researchers were able to unlock secure debug access that is normally restricted. The findings highlight a hardware-level vulnerability relevant to embedded security and chip designers. Ledger published a detailed technical writeup on the method via their security research blog.

0 comments Read more at Hacker News
0
ProgrammingDEV Community ·

Developer builds TikTok downloader, shares lessons on streaming and expiring URLs

A developer recently built a web service called FromTik that allows users to download public TikTok videos, slideshows, and audio files. Rather than saving full video files to disk before delivery, the service streams media in chunks directly from TikTok's CDN to the user, reducing disk usage and speeding up downloads. The developer avoided unnecessary re-encoding with FFmpeg, reserving it only for tasks like extracting MP3 audio or converting slideshows into video. A key technical insight was that TikTok CDN URLs are short-lived and signed, making long-term caching of extracted links unreliable. The article outlines how treating media metadata as request-specific rather than permanently stored leads to a more dependable architecture.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

OpenBot enforces audit logging before any bot action executes, not after

OpenBot, an open-source agent framework described as a template rather than a finished product, routes every bot action through a single gateway that evaluates policy and writes an audit record before the action is carried out. The system uses CEL-based rules to inspect tool names, file paths, shell commands, and other parameters, and is designed to fail closed — a missing or broken policy blocks rather than permits. Sensitive data such as secrets are partially obscured in logs, recording only that a request was made and the length of the value, not its contents. Human takeovers during bot sessions — such as handling login walls or two-factor prompts — are also logged, and bot actions are refused rather than queued while a person is in control. The project is currently in alpha, has no hosted version, and is explicitly intended as a starting point for teams to adapt with their own configuration.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

AI Model Jev Completes 60-Second Highway Drive Without a Single Crash

A developer used TypeSafe AI's decision-focused model Jev to control a simulated vehicle on a three-lane highway populated with 30 surrounding vehicles. After early attempts resulted in immediate crashes or the car stopping completely, the system was refined to ask Jev multiple simultaneous questions about lane changes, speed adjustments, and collision risk. The final run covered 1,203.72 metres in 60 seconds at an average speed of 72.3 km/h, with no collisions or full stops recorded. Jev, described by TypeSafe AI as a 'System One' model, returns typed decisions and probability values rather than conversational text, making it suited for real-time agent control. The experiment demonstrated that the model could apply roughly 2.73 driving decisions per second with a median response latency of around 311 milliseconds.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Amazon Hackathon Offers $138K Prize, Stanford Coding Course Among This Week's Dev Picks

The 17th edition of Dev Opportunity Radar highlights three developer opportunities and a free learning resource for software engineers. Stanford University's Code in Place X is a virtual programming course open until September 28, while Amazon's Build, Ship, Shape Hackathon runs online with a $138K prize pool and a deadline of October 24. The Dev3Pack Hackathon, a hybrid event, accepts applications until October 30. Additionally, Coding Interview University is featured as a free, self-paced resource covering data structures, algorithms, and technical interview preparation. A community-sourced find, the Dogfood 72-Hour Hackathon, was also highlighted this week, shared by reader Dhruv Jani.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

How to Diagnose and Fix SSH 'Permission Denied (publickey)' Errors

The SSH error 'Permission denied (publickey)' signals that every key the client offered was rejected by the server during authentication negotiation, not a simple password mistake. Developers can diagnose the issue using 'ssh -vvv' on the client side and server logs via 'journalctl -u ssh' to identify which keys were offered and why they were refused. The four main causes are connecting as the wrong user, the public key missing from the target account's authorized_keys file, overly open file permissions causing the client to silently skip the key, and legacy ssh-rsa keys being rejected by OpenSSH 8.8 and later versions. OpenSSH 8.8, released in October 2021, disabled SHA-1-based ssh-rsa signatures by default, meaning older RSA keys from CI systems or devices like Raspberry Pis may silently fail. Regenerating keys using the ed25519 algorithm and using ssh-copy-id to install them correctly prevents most recurring authentication failures.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Server-Side WebAssembly Enables Safe, Near-Native Plugin Sandboxing in Node.js and Go

WebAssembly (WASM), long associated with browser-based performance, is gaining traction in backend engineering as a secure runtime for executing untrusted third-party plugin code. Traditional alternatives such as Node.js vm modules, Docker containers, and embedded JS interpreters each carry significant trade-offs in security, latency, or language flexibility. By embedding lightweight WASM runtimes like Wasmtime or Extism into host applications written in Node.js or Go, developers can achieve isolated plugin execution with cold-start times under one millisecond and predictable memory limits. WASM instances operate on a deny-by-default security model, blocking file system access, network calls, and host memory reads unless explicitly permitted. Data exchange between host and plugin is handled through a pointer-based ABI over the instance's linear memory, and open-source frameworks like Extism and Wazero allow a functional host runtime to be configured in under 20 lines of code.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Inside a scam campaign: how a link shortener operator caught and tracked ad fraud

The operator of a small free link shortener discovered a suspicious destination that had accumulated nearly 90,000 clicks in just 48 hours, far exceeding all other traffic on the platform combined. After deleting the offending links, the scammer re-registered them within minutes, prompting a cat-and-mouse deletion cycle. Investigation revealed the destination URL served different content depending on who requested it — redirecting automated scanners harmlessly to Yahoo, while delivering a 42,000-byte fingerprinting payload to real Android users arriving via Facebook's in-app browser. The payload checked for bot indicators, ad blockers, GPU data, and even cursor movement, silently discarding any visitor it deemed non-human with a fake success animation. The scheme relied on a high-authority domain with a Domain Rating of 50, built on a vast network of inbound links from pirate streaming sites, indicating a well-resourced and persistent ad fraud operation.

0 comments Read more at DEV Community
0
ProgrammingHacker News ·

Systemd Launches Official Brand and Identity Website

Systemd, the widely used Linux init system and service manager, has published an official branding website at brand.systemd.io. The site presents systemd as a suite of basic building blocks for Linux operating systems. The resource appears intended to provide official visual and identity guidelines for the project. The link was shared on Hacker News, attracting minimal engagement at the time of posting.

0 comments Read more at Hacker News
0
ProgrammingDEV Community ·

Developer's Interview Wake-Up Call: AI Reliance Eroded Manual Coding Skills

A software developer recently underwent a technical interview with Wasmer, impressing the interviewer with polished demos of edge-deployed systems and durable workflows. However, when asked to manually review a small cache file, the developer struggled to articulate code issues despite instinctively sensing errors — a skill gap traced to years of delegating fixes to AI tools. The candidate managed to stay in the running but was assigned a follow-up task to identify and document all bugs in the file without AI assistance, which took over three hours. The experience highlighted how heavy reliance on AI coding assistants can quietly erode foundational skills like manual debugging, precise search phrasing, and code articulation. The developer concluded that in the AI era, refreshing core programming fundamentals may matter more in interviews than showcasing impressive AI-assisted projects.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Developer releases 425-byte library to parse partial JSON from streaming LLMs

A developer building an LLM-powered recipe app found that JSON.parse fails on every incomplete token during streaming, since valid JSON only exists once the final closing bracket arrives. To solve this without discarding streaming benefits or relying on fragile regex hacks, they built a minimal open-source library called SoFar. The library exposes two functions — parsePartialJSON and createJSONStream — that return the best structurally complete value available from any partial JSON buffer without throwing errors or guessing incomplete values. It works by scanning the buffer once, tracking open containers and string state, and identifying safe cut points where valid JSON can be reconstructed by appending the necessary closing brackets. At 425 bytes gzipped and zero dependencies, it is designed as a thin complement to the native JSON.parse rather than a replacement.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Hidden AI Reasoning Tokens Drive Unexpected Billing Costs for Developers

Companies using AI inference services are facing significant billing surprises due to hidden reasoning tokens that are charged as output but not visible during usage. A 2025 study found that these concealed tokens can account for over 90% of total token spend on complex tasks, with a seemingly simple response potentially hiding more than 10,000 reasoning tokens. The problem is expected to grow as Goldman Sachs projects global token usage to reach 120 quadrillion per month by 2030, a 24-fold increase. In response, the Linux Foundation has proposed a Tokenomics Foundation to establish open, vendor-neutral token measurement standards, while providers like Groq and Cerebras have moved toward flat per-token pricing models. Developers are increasingly demanding greater transparency in token accounting as AI costs shift from minor line items to significant operational expenses.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Security Audit Flags 11 Vulnerabilities in Aave V3, Rates Risk 7.4 out of 10

A security audit of Aave V3, the decentralized lending protocol with approximately $17.7 billion in total value locked, identified 11 vulnerabilities across reentrancy and access-control domains, with three rated Critical. The review, dated September 2026, found improperly guarded external calls in flash-loan and collateral-withdrawal paths, as well as overly broad admin role assignments in the upgrade proxy. Auditors warned that a successful reentrancy exploit on the flash-loan entry point could theoretically allow an attacker to drain up to $1.2 billion before liquidation mechanisms respond. None of the vulnerabilities are currently exploitable on the live mainnet, as existing safeguards such as reentrancy guards and multi-signature governance provide interim protection. However, the audit stresses that any future upgrade or misconfiguration removing those defenses could expose the protocol to significant risk, making prompt remediation essential.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

iOS camera briefly reports wrong orientation for ~100ms, masking a longstanding bug

A developer investigating sideways video recordings on iPhone discovered that the iOS camera temporarily reports incorrect landscape dimensions for roughly 100–150 milliseconds after a track is created, before correcting itself to portrait. This narrow window explains why the bug went undetected: tests that wait for a preview to load before reading track dimensions always land outside the faulty window and pass cleanly. The developer confirmed the timing across multiple runs, observing the flip from 1920x1080 to 1080x1920 occurring between roughly 100 and 150 milliseconds after track creation. The finding has broader implications beyond iOS, highlighting that any value which eventually corrects itself can silently fool well-written tests that wait for things to settle. The developer also found that most major webcam libraries, including react-webcam and react-media-recorder, are largely inactive, with LiveKit being the only one showing consistent recent human contributions.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

How LLMs Really Work: Probability, Not Knowledge or Reasoning

Large language models (LLMs) are mathematical functions that predict the most probable next token based on patterns in training data, not systems that understand or reason like humans. When a model correctly states that Paris is France's capital, it does so because that token sequence appeared frequently in training data, not because it holds the fact as truth. This same mechanism explains hallucination: the model must always output a high-probability token, even when its training data offers no reliable answer. LLMs also have no awareness of events after their training cutoff and no memory between separate sessions, which is why techniques like retrieval-augmented generation and context re-injection exist. Understanding this token-prediction loop is foundational to grasping broader LLM behaviours, including why chain-of-thought prompting improves outputs and why agents can fall into repetitive loops.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Developer builds tool to auto-compile all hackathon submissions using disposable cloud VMs

A developer and hackathon organizer identified a long-standing blind spot in hackathon judging: with 40–80 teams and only minutes per project, judges almost never verify whether submitted code actually builds. Evaluation has historically relied on live demos and pitches, which test a team's ability to describe software rather than build it. To address this, the developer used Fly.io's Sprites API — which spins up disposable Linux machines billed by the second — to create an automated tool that clones each submitted repository, detects the project type, installs dependencies, compiles the code, and runs any existing tests. The tool can process submissions in parallel and logs exactly how far each build progresses, making it feasible to check all entries before judging begins. The experiment, run across 164 submissions, suggests that systematic build verification at hackathons is now a practical option rather than a logistical impossibility.

0 comments Read more at DEV Community
0
ProgrammingHacker News ·

Blog Post Explores Why Mutable and Immutable Types Lack Subtype Relationship

A blog post published on September 17, 2026, examines a fundamental question in type theory: why mutable types are not considered subtypes of immutable ones, or vice versa. The article, hosted on crumbles.blog, delves into the theoretical and practical reasons behind this design decision in programming languages. The post received modest engagement on Hacker News, accumulating 4 points and 2 comments. The topic touches on core concepts of type systems and how mutability constraints affect type hierarchies in software development.

0 comments Read more at Hacker News
0
ProgrammingDEV Community ·

Developer Builds Functional Chess Puzzle Trainer Using Scala 3 and Tyrian Framework

A developer has built ChessKinetics, a web-based chess puzzle trainer designed to reduce cognitive fatigue by grouping puzzles into structured waves of six, scaling in difficulty based on the user's rating. The application uses a recovery mechanism that triggers a two-minute break of simple puzzles after an early failure, and aborts harder puzzles if a player fails twice in the same wave. To avoid race conditions from asynchronous events, the entire stack was built in Scala 3 using a purely functional approach, with the frontend powered by Tyrian, a framework inspired by Elm's Model-View-Update architecture. State is managed through a single immutable model and a unidirectional data flow, making the logic highly testable and traceable. The backend relies on the Typelevel stack, combining cats-effect, http4s, and Skunk to maintain the same functional philosophy from the database layer to the browser DOM.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

kagent v1.0 Replaces Deployment-Based Agents with gRPC Lifecycle Model

Open-source Kubernetes agent framework kagent released its first v1.0 line, tagged v1.0.0-alpha1, on September 18, 2026, after nine months of 0.x development. The release's core change is architectural: the old model where an agent mapped to a Kubernetes Deployment has been replaced by AgentInstance, an imperative gRPC lifecycle object with an explicit state machine. The changelog spans roughly 130 pull requests, dominated by removal of legacy controller runtime and deployment-backed agent APIs. A new conversation checkpoint system lets users fork agent sessions from a saved state rather than restarting from scratch, similar to git branching. The A2A gRPC gateway and actor resume-from-snapshot performance improvements are also included, though durable task persistence and related production-readiness features remain listed as follow-up work.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

AgentGateway CEL Policy Bug: Separate Rules Act as OR, Not AND

A developer building a CEL authorization policy for agentgateway discovered that listing multiple expressions under matchExpressions applies OR logic, not AND, meaning a request is allowed if any single condition is satisfied. In testing, a caller from a restricted jurisdiction (Iran) was incorrectly granted access because the model check passed, while an unapproved model request also slipped through because the country check passed. Neither misconfiguration triggered an error, and the policy status showed as healthy in both cases. The fix is to combine all conditions into a single matchExpressions entry joined with && operators, rather than using separate list items. The behavior is documented but easy to misread, making the bug particularly risky since it silently permits traffic that should be denied.

0 comments Read more at DEV Community
← NewerPage 1143 of 3221Older →