0
ProgrammingHacker News ·
LLM Classification Is Feature Engineering
Article URL: https://minimallysufficient.com/posts/llm-classification-is-feature-extraction/ Comments URL: https://news.ycombinator.com/item?id=49742437 Points: 5 # Comments: 0
Programming
0
ProgrammingDEV Community ·
How to Use Cursor AI's Full-Codebase Context in AWS Lambda Functions
Cursor AI can scan an entire code repository and provide context-aware suggestions, but many developers underuse it by treating it as a basic autocomplete tool. The platform's uploadRepoTree function allows developers to send a full repository snapshot to the service, enabling the AI to reference cross-module relationships and project-wide conventions. Deploying this capability inside an AWS Lambda requires careful packaging, as Node 22 on Lambda handles ESM modules differently and can silently fail to load them if the SDK is bundled incorrectly. Developers are advised to pin SDK versions and set the type field to 'module' in package.json to avoid runtime errors. The integration also supports streaming responses via an event-based channel, though token quotas must be managed to prevent service interruptions.
0
ProgrammingDEV Community ·
How std::mem::forget Silently Leaks Heap Memory and Triggers Linux OOM Kills
Rust's std::mem::forget function drops a stack-allocated handle without executing destructor logic, permanently orphaning the associated heap metadata inside allocator arenas. Because the operation produces no undefined behavior, tools like memory sanitizers raise no alerts and the Linux kernel logs no faults at the time of the call. Over weeks of sustained production throughput, the leaked allocations cause the process's Resident Set Size to grow monotonically, fragmenting virtual memory without generating panics or heap corruption reports. Eventually, the Linux kernel's Out-Of-Memory killer issues an uncatchable SIGKILL to the process, leaving engineers with no crash dump to diagnose. The root cause lies in how ManuallyDrop suppresses Rust's drop elaboration pass, preventing the compiler from emitting any call to the allocator's deallocation hook.
0
ProgrammingDEV Community ·
Five-Step 'Ship Gate' Checklist Aims to Catch AI Feature Failures Before Launch
A pre-deployment framework called 'Ship Gate' has been proposed to address a recurring pattern where AI features pass internal demos but break in production. The checklist covers five areas: threat modelling, data boundaries, evaluation sets, human override controls, and observability. A real-world case is cited where an AI email summariser invented a discount offer on its first day live, causing customer support issues that a basic gate could have prevented. The framework argues that most AI failures stem not from the underlying model but from skipping structured pre-launch checks in favour of demo-ready builds. Ship Gate is positioned as a minimal, afternoon-length review rather than a lengthy compliance exercise, designed to ensure AI features earn production deployment instead of learning from live customer mistakes.
0
ProgrammingHacker News ·
CrowdSec Confirms Accidental Source Code Exposure in Security Incident
CrowdSec, a cybersecurity company, has publicly acknowledged an unintended exposure of its source code. The company issued an official statement on its blog addressing the incident. The leak involved the exposure of CrowdSec's codebase, raising concerns within the security community. CrowdSec has communicated transparently with users by publishing details of the event on its website.
0
ProgrammingHacker News ·
GitLab.com to update rate limits in 2026
GitLab has announced upcoming changes to rate limits on its GitLab.com platform, set to take effect in 2026. Rate limits control how frequently users and automated systems can make requests to the service. The changes were detailed in an official GitLab blog post, though specific new thresholds were not summarized in the available content. Such updates typically aim to improve platform stability, reduce abuse, and ensure fair resource distribution among users.
0
ProgrammingDEV Community ·
Deterministic Linting Tools Offer Safer Guard Rails for AI-Generated DB Migrations
AI coding agents can draft database migrations quickly but frequently produce unsafe SQL that fails on production tables with existing rows or causes prolonged lock contention. The problem is structural: safe and dangerous migration patterns look nearly identical in code, and models never encounter the production-scale consequences that reveal the difference. Using a second AI model to review migrations is unreliable because results vary between runs and the model cannot enumerate which rules it actually checked. A deterministic rule-based linter called Bolvrk addresses this by running the same fixed corpus of checks — covering patterns like adding a NOT NULL column without a default or creating an index without CONCURRENTLY — inside the agent's loop via MCP, in the terminal via CLI, and on pull requests via GitHub Actions. The approach ensures the migration verdict remains consistent at every stage, preventing agents from bypassing safety checks that depend on fixed, verifiable logic rather than variable model output.
0
ProgrammingDEV Community ·
One SQL line prevents database outages during table migrations, yet few use it
A common PostgreSQL migration pattern — adding a nullable column with no default — can silently take an entire table offline, not because the operation is slow, but because it queues behind any idle transaction holding a lock. Since ALTER TABLE requires an ACCESS EXCLUSIVE lock, it blocks in the queue, and every subsequent read or write then stacks behind it, effectively freezing application traffic. Engineers at DEV Community reproduced this on PostgreSQL 16, where a 26-millisecond point-read waited over 26 seconds due to an idle session holding an unrelated lock. The fix is a single line added before the migration: SET lock_timeout = '2s', which causes the ALTER to abort after two seconds of waiting rather than clogging the lock queue. Unlike statement_timeout, lock_timeout only limits how long a statement waits for a lock, making it safe to use without risking cancellation of legitimate long-running operations like index builds.
0
ProgrammingDEV Community ·
CREATE INDEX CONCURRENTLY: When It Helps, What It Costs, and What Can Go Wrong
PostgreSQL offers two ways to build indexes in production: the standard CREATE INDEX, which blocks all writes for the entire build duration, and CREATE INDEX CONCURRENTLY, which avoids write locks but takes significantly longer to complete. Benchmarks on a 20-million-row table show the plain form blocked inserts for over 4 seconds, while the concurrent form kept the worst wait under 125 milliseconds. The concurrent build scans the table twice and waits for open transactions to close, making it slower but far safer on live, write-heavy tables. However, if a concurrent build fails midway due to a deadlock or cancellation, it leaves behind an invalid index that consumes write overhead without ever being used by the query planner. Developers should routinely query pg_index for invalid indexes after migrations and drop them using DROP INDEX CONCURRENTLY to avoid silent performance degradation.
0
ProgrammingDEV Community ·
How to Add Foreign Keys to Large PostgreSQL Tables Without Blocking Writes
Adding a foreign key to a large PostgreSQL table using a single ALTER TABLE statement locks both tables for the entire duration of validation, which can block writes for minutes on busy systems. PostgreSQL offers a two-step alternative: first add the constraint with NOT VALID to record it instantly with only a brief lock, then run VALIDATE CONSTRAINT separately under a weaker lock that still permits inserts, updates, and deletes. The end result is the same validated constraint, but with far less disruption to live traffic. Additionally, PostgreSQL does not automatically index the referencing column of a foreign key, so creating one with CREATE INDEX CONCURRENTLY is recommended to prevent slow sequential scans during parent-row deletions. The same NOT VALID and validate pattern also applies to CHECK constraints and can be used to safely enforce NOT NULL on large tables without an expensive full-table lock.
0
ProgrammingHacker News ·
Insufficient source content to generate a reliable summary
The provided source contains only a URL and engagement metrics, with no article body or verifiable facts. No meaningful summary can be produced without fabricating information. Please provide the full article text for accurate reporting.
0
ProgrammingDEV Community ·
Six Data Errors Later, a Digital Twin Yields Fiskardo's Real Evacuation Time
A geospatial analysis using pgRouting's Dijkstra algorithm was conducted to estimate road evacuation time from Fiskardo, a village on the Greek island of Kefalonia, in a wildfire scenario. The process uncovered six successive errors, including a stale road network table, a mislabeled cost column conflating meters with minutes, mismatched coordinate reference systems, and unsorted query results. A suspected connectivity gap in the coastal road data caused the router to favour a 29 km inland mountain route over a 15 km coastal alternative. After correcting all identifiable errors, the analysis concluded that evacuation to Agia Effimia Marina would take approximately 44 minutes across 116 road segments. The exercise highlights that in safety-critical geospatial work, a result's value lies in how rigorously it has been stress-tested, not merely in whether the query executes successfully.
0
ProgrammingDEV Community ·
Semrush Study: AI Citation Sources Shift Based on Query Type and User Intent
Semrush has released a focused mini study examining how AI platforms select citation sources differently depending on query type and user intent. The research, part of the company's AI Visibility Index initiative and backed by 126 million prompts, compares citation patterns for high-stakes YMYL queries against everyday commercial queries. Four platforms were assessed — ChatGPT, Google AI Mode, Google AI Overview, and Gemini — across 22 topics using US data with a UK cross-check. The study found that government sources, community content, and brand-owned domains each appear at different rates depending on the nature and intent of a query. Semrush concludes that optimising for AI citation visibility requires a context-specific strategy rather than a single universal content approach.
0
ProgrammingDEV Community ·
How Web3 Economic Activity Builds Businesses Layer by Layer
A new framework for understanding Web3 proposes mapping the ecosystem by economic activity rather than by blockchain infrastructure. The model identifies nine layers, starting from destination applications like trading and lending platforms at the top, down to base blockchain settlement infrastructure at the bottom. Successful applications such as Uniswap, Aave, and Polymarket generate demand that spawns businesses across adjacent layers, including data tools, risk management, wallets, and developer infrastructure. Each layer exists because real user activity at higher levels creates problems that need solving, making application adoption the engine of the broader ecosystem. The framework also notes that capital, liquidity, and autonomous software cut across all layers, and that many companies intentionally operate at multiple levels simultaneously.
0
ProgrammingHacker News ·
AI Surpasses Top Human Forecasters in Prediction Accuracy
Artificial intelligence systems have reached a milestone by outperforming some of the best human forecasters, according to a report published by The Economist on September 16, 2026. The development marks a significant advance in AI's ability to make accurate predictions about real-world events. Human superforecasters have long been considered the gold standard in probabilistic prediction, making this achievement notable. The findings suggest AI tools may increasingly be used in fields that rely on forecasting, such as geopolitics, economics, and public health.
0
ProgrammingDEV Community ·
Interactive Simulators Help Developers Master TLS Handshakes and OAuth Flows
Two free browser-based simulators aim to help backend developers learn the TLS handshake and OAuth authorization code flow by stepping through each sequence interactively, rather than studying static diagrams. The TLS simulator covers both TLS 1.2 and 1.3 protocols, highlighting key differences such as the single round trip and post-ServerHello encryption introduced in 1.3, while also letting users simulate failure scenarios like expired certificates, hostname mismatches, and untrusted certificate chains. The OAuth simulator walks developers through the full authorization code flow with PKCE, covering every party — the app, user, authorization server, and API — and showing exactly what data moves across each channel. A core learning point is understanding which secrets, such as the authorization code versus tokens, are exposed in the browser-facing channel versus the back-channel token exchange. Both tools require no signup and are intended to build the kind of hands-on familiarity that helps developers debug real-world security errors under pressure.
0
ProgrammingDEV Community ·
Why Software Engineering Is a Discovery Problem, Not a Production Line
A widely discussed essay argues that most engineering teams mismanage software delivery by treating it like factory output, pushing for speed through added staff, pressure, or process gates — all of which research shows make delivery slower. Drawing on Fred Brooks' 'Mythical Man-Month' and the State of DevOps Report, the piece contends these traditional management levers consistently backfire. The author proposes reframing engineering as continuous discovery, where the primary goal is minimizing the time it takes to validate a hypothesis rather than maximizing output. Practical recommendations include treating every code change as a testable hypothesis, using automated pipelines to shorten feedback loops, and deploying in small increments to isolate variables. The central argument is that optimizing for learning — not speed — is what organically produces faster, higher-quality software delivery.
0
ProgrammingDEV Community ·
KREMLIN Malware Forges Chrome Integrity Checks to Hijack Brazilian Banking Sessions
Elastic Security Labs has tracked a high-severity malware campaign called KREMLIN across seven operations over 15 months, targeting banking users in Brazil. The attack begins when a user opens a JavaScript file disguised as a bank receipt or invoice, which then silently downloads Node.js and establishes persistence via a scheduled task. KREMLIN uses Ethereum smart contracts as dead-drop resolvers to retrieve payloads and locate malicious browser extensions, which are injected into Chrome or Edge profiles without user consent by forging Chromium's Secure Preferences integrity checks. Once installed, the AVSync extension harvests cookies, session data, keystrokes, and HTTP traffic, and receives attacker commands over WebSocket. At the time of reporting, researchers had identified at least 1,515 infected endpoints, with blocking initial JavaScript execution identified as the most effective prevention measure.
0
ProgrammingDEV Community ·
BragJack Flaw Let Malicious Extensions Hijack AI Agents in Five Major Browsers
Security researchers at Forever Security disclosed a high-severity attack technique called BragJack, which allows a malicious browser extension to hijack built-in AI agents across Chrome, Edge, Opera Neon, Perplexity Comet, and Claude in Chrome. The attack exploits existing extension permissions—such as Declarative Net Request and debugger access—to weaken security policies, inject scripts, and force-send prompts to AI agents without additional user interaction. Affected products included Google Gemini, Microsoft Copilot, Opera Neon, Perplexity Comet, and Claude, with proof-of-concept demonstrations showing unauthorized access to files, emails, camera feeds, and authenticated websites. The vulnerabilities were assigned CVE-2026-0628 and CVE-2026-55945, and all affected vendors have since issued fixes. No exploitation in the wild has been reported by the cited sources.
0
ProgrammingDEV Community ·
Google Patches Actively Exploited Pixel Modem Zero-Day CVE-2026-58704
Google has disclosed a high-severity vulnerability, CVE-2026-58704, affecting the cellular modem in Pixel devices, with evidence of limited targeted exploitation in the wild. The flaw involves a logic error that bypasses permission checks, allowing privilege escalation without requiring prior access or any user interaction. An attacker must be physically nearby or in adjacent range of the target device to exploit the vulnerability. Google addressed the issue in the September 5, 2026 security patch level, released as part of the September 2026 Pixel Update Bulletin. Users are advised to apply the update immediately and verify their device patch level is 2026-09-05 or later.