SShortSingh.
TopTechnologyAI & MLStartupsProgrammingScienceBusinessFinanceCrypto & Web3World

Programming

LatestTopDiscussed
0
ProgrammingDEV Community ·

Why Self-Hosted CI Runners Are a Hidden Security Risk in Build Pipelines

Self-hosted CI runners execute code submitted by anyone who can open a pull request, making them high-value targets that are rarely covered by a formal threat model. Unlike managed runners, self-hosted ones often persist between jobs, retain deployment credentials, and have access to internal network resources. A documented attack chain shows how a malicious pull request can plant modifications on a persistent runner, which are then inherited by a later privileged job with access to production credentials. Key vulnerabilities include shared caches across job boundaries, guessable runner labels, and the runner's network position being exposed even when secrets are withheld from forks. Security experts recommend making runners ephemeral, separating untrusted and release build environments, requiring human approval for first-time contributors, and issuing short-lived per-job credentials to limit exposure.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Developer fixes entity resolution pipeline after news text exposed critical flaws

A developer building the entity resolution pipeline at 2asy.ai discovered major gaps after expanding from structured registry data to news articles, triggering two weeks of cleanup. The core problem was that news sources use informal company names — such as '삼성' instead of '삼성전자 주식회사' — which caused the pipeline's character-based blocking rule to match a short mention against every Samsung subsidiary at once. To address this, the developer added a post-scoring filter that uses surrounding article context, such as nearby entity mentions and sector keywords, to disambiguate top-scoring candidates. A stricter confidence threshold was also introduced specifically for short or informal name mentions, requiring a 0.90 score before merging them to a registry entry. However, the developer acknowledges the underlying benchmark still uses only registry-vs-registry pairs, leaving precision and recall for news-domain mentions unmeasured.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Developer Flags Codex CLI Polling Loop That Wasted 10M Tokens in One Overnight Build

A developer has filed a feature request with Codex CLI on 17 September 2026, highlighting a structural inefficiency in how parent agents monitor the completion of delegated sub-agents. Currently, the parent must repeatedly call a wait function with a fixed timeout to check if a worker has finished, with each check triggering a full model activation that re-reads the entire conversation history. Measurements from a single overnight build revealed 89 such polling waits consuming over 10 million tokens, accounting for 12.7% of the run's total cost despite delivering no new information 74% of the time. The request asks that a sub-agent's completion automatically wake an idle parent agent, eliminating the polling loop entirely — a mechanism the developer notes is already implemented in Claude Code. The author argues this is a harness gap rather than a model error, and that its cost scales directly with longer autonomous runs where a parent has fully delegated its workload.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Founder Measures AI Brand Visibility After Gemini Misidentifies His New Company

When entrepreneur launched Luxcerta, a platform that tracks how AI models represent brands, he discovered that Gemini with web grounding mistook his company's name for a typo and flagged his domain as a possible phishing site. Running his own product's measurement method on day one, he recorded zero correct mentions or citations across ten queries to Gemini. Notably, Google Search's AI Overview correctly identified Luxcerta from homepage metadata on the very same day, highlighting how different AI surfaces can reach opposite conclusions about the same brand. To improve AI recognition, he added structured schema.org data, a clearer meta description, a disambiguating GitHub profile, and submitted a fresh sitemap via Search Console. One week later, Gemini's grounded responses began correctly identifying Luxcerta, though he cautions the case involves one brand over one week with no controlled variables.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Developer Ships Second Open Redirect Bug in the Same Fix Meant to Patch the First

A developer maintaining the CAS-Authentication-User npm package discovered a second open redirect vulnerability in version 0.3.0, the very release that was meant to fix a previously identified flaw. The new guard function, isSafeReturnTo, correctly rejected malicious returnTo query parameters, but when it fell back to the request path as a default, it inadvertently constructed the same type of protocol-relative URL it was designed to block. The root cause was a modelling error: the request path, though fully controlled by an attacker, was treated as a trusted internal fact rather than as user input requiring validation. Unlike the first bug, this variant required no returnTo parameter, no service ticket, and no CAS server involvement, making it easier to exploit against authenticated users. The developer has since identified the actual sink — the res.redirect calls in index.js — as the correct place to enforce validation, rather than only auditing obvious query string inputs.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Headless Tables vs. Full Grid Components: How Developers Choose the Right Fit

Web developers building data tables must choose between headless table libraries and full grid components, a decision that significantly affects design control, speed, and long-term maintainability. Headless libraries give developers complete control over markup and behavior but require manual implementation of features like sorting and filtering, which can lead to complex, hard-to-maintain code. Full grid components offer faster setup by handling most functionality out of the box, but struggle when projects demand custom designs or unsupported behaviors. The right choice depends on project-specific factors such as design strictness, timeline pressure, and anticipated customization needs. The Svelte-based SvGrid project illustrates a dual approach, shipping both a headless core and a ready-to-use component to serve developers with different priorities.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

How to Connect to an Azure Virtual Machine Using SSH

SSH (Secure Shell) is an application-layer protocol that uses asymmetric cryptography to establish encrypted remote connections between devices, operating by default on TCP port 22. To set up SSH access on Microsoft Azure, users must create a virtual machine with SSH public key authentication enabled and ensure port 22 is open in the inbound port rules. During VM creation, Azure generates a key pair and downloads a .pem file, which must be moved to the ~/.ssh directory and set to read-only permissions using chmod 400. Users can then connect to the VM via the terminal using the ssh -i command along with the VM's public IP address, found on the Azure portal. On first connection, Azure prompts users to verify the host fingerprint, which can be cross-checked by running a keygen command directly on the VM through the Azure portal's Run Command feature.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Over 161,000 Assets Exposed on Port 102 Linked to Industrial PLC Advisory

A joint cybersecurity advisory (AA26-231A), issued on August 19, 2026, by the NSA, CISA, FBI, DOE, and EPA, warned that threat actors were using internet scanning services to locate exposed Siemens S7 programmable logic controllers running outdated software. The attackers reportedly used AI-generated scripts built on open-source libraries to read and write PLC memory and configuration data via the S7comm protocol on TCP port 102. A subsequent ZoomEye query conducted on September 16, 2026, found 161,764 assets with port 102 reachable, while more specific fingerprints returned far smaller counts — 10,160 for Siemens SIMATIC and just 173 for Siemens S7. Analysts caution that these figures reflect indexed exposure levels, not counts of vulnerable or compromised devices, as different query types measure different things. Asset owners are advised to audit their own network address space against documentation to identify any unintended internet-facing controllers.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Bitbucket Data Center has no native AI code review; Cloud users get Rovo

As of September 2026, Atlassian's native AI code review tool, Rovo Dev, is available exclusively to Bitbucket Cloud users on Standard, Premium, or Enterprise plans. Atlassian's official documentation makes no mention of AI-assisted code review for Bitbucket Data Center or Server editions. A search of the Bitbucket Server documentation returned zero results for the feature, confirming the absence of any vendor-supported native option for self-hosted teams. Data Center teams seeking AI code review must rely on third-party integrations wired through repository hooks or build pipelines. Merge enforcement in such setups depends on branch permissions and pre-receive hooks that administrators must configure independently.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

AMD MI300X GPU Benchmarked via MCP Tools on AMD Developer Cloud at $1.99/hr

A developer used a single AMD Instinct MI300X virtual function instance on AMD Developer Cloud, billed at $1.99 per hour, to conduct a detailed hardware inventory using custom Python MCP tools. The setup relied on twelve tag-scoped MCP tools for tasks including power management, GPU state monitoring, and remote execution, all accessed without a local AMD GPU. Hardware scans conducted on September 16, 2026, revealed the MI300X configuration includes 304 compute units, a 2100 MHz max clock, and 191.69 GiB of fully CPU-mappable VRAM in a large-BAR setup. Two initial tool readings were found to be inaccurate and were corrected by parsing raw output rather than relying on status codes. The resulting numeric format table also diverged from AMD's published performance peaks in two areas, with the author treating those discrepancies as primary findings rather than minor caveats.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

AWS Lambda Managed Instances: Setting Min/Max to Zero Deactivates Functions, Not Idles Them

AWS Lambda Managed Instances (LMI), introduced at re:Invent 2025, places Lambda functions on EC2 capacity while retaining Lambda's programming model, but its scaling behavior differs sharply from standard Lambda. When both MinExecutionEnvironments and MaxExecutionEnvironments are set to 0, LMI does not idle the function awaiting the next request — it fully deactivates the function version and terminates all backing EC2 instances. Any invocation against a deactivated version returns a hard failure with no cold start, no queuing, and no automatic retry or reactivation. Reactivation requires a manual intervention, such as pushing a new non-zero scaling configuration via the console, the PutFunctionScalingConfig API, or a scheduled action. This behavior is fundamentally different from standard Lambda concurrency throttling and represents a critical operational distinction for engineers running non-continuous workloads on LMI.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Why founders should replace AI prompt hoarding with a weekly shipping loop

A new practical guide targets founders who use AI coding tools like Cursor and Claude but struggle to show tangible weekly progress. The article argues that AI tools excel at generating activity — long chat threads, refactors, and prompt collections — but that this motion rarely translates into user-facing output. The author proposes a short, repeatable weekly review loop that takes five to fifteen minutes and centres on one honest shipped outcome and one clear bet for the following week. The loop covers five steps: naming what users could actually touch, comparing plans to reality, auditing AI habits, committing to one demoable next action, and flagging blockers. A free review template is offered alongside an optional paid kit, with the stated goal of reducing performative productivity rather than promising revenue growth.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Tool Evidence Guard v0.1.0 validates AI agent tool outputs before response generation

Tool Evidence Guard is a new open-source Python library and CLI tool designed to verify that AI agent tool outputs meet predefined data contracts before being used in a response. The core problem it addresses is agents continuing to generate responses — sometimes with fabricated values — even when a tool returns null or fails entirely. Version 0.1.0 supports JSON Pointer field validation with types including integer, number, string, and boolean, and allows constraints such as minimum, maximum, and enum values. The system requires contracts and captured results to come from a trusted execution layer, not the model itself, to prevent a coherent but false document from passing validation. The tool is available on GitHub and requires Python 3.10 or higher with no external runtime dependencies.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Two Critical RouterOS Flaws Enable Privilege Escalation on MikroTik Edge Routers

Two vulnerabilities affecting MikroTik RouterOS were published to the National Vulnerability Database on September 5, 2026. The more severe flaw, CVE-2026-86060, carries a CVSS score of 9.8 and exploits a parsing error in the SSH login path, allowing attackers to alter the device's authorization policy and escalate privileges. Because RouterOS devices typically serve as internet-boundary hardware managing routing, firewalls, and VPN termination, a successful compromise grants control over an entire network perimeter. ZoomEye data identifies over 8 million assets with a RouterOS fingerprint, though this reflects the broader installed base rather than the specific count of vulnerable, internet-exposed devices. MikroTik advises operators to upgrade to a patched release on their respective stable or long-term maintenance branch, with exact version details available through the official vendor advisory.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

AI Trading System Uses Gray-Scale Risk Protocol to Navigate Conflicting Market Signals

A developer team building an LLM-driven quantitative trading engine shared how their system handled contradictory signals on the ARBUSDT pair, where strong bearish technical indicators clashed with bullish fundamental and on-chain sentiment. Rather than defaulting to a binary veto, the system applied a proprietary framework called F-072 dynamic risk control to evaluate the conflict in probabilistic terms. The engine approved the trade but automatically tightened the stop-loss and scaled down position size to account for elevated uncertainty. This gray-scale decision-making approach contrasts with traditional algorithmic logic, which typically halts trading when signals conflict. The team argues that in volatile crypto markets, managing uncertainty through adaptive risk parameters captures more opportunity than strict binary trade filters.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Developer scores 66/100 after AI judge quizzes him on his AI-built hackathon project

A developer entered HackerRank's Orchestrate hackathon in September 2026 and built a financial decision tool called Praxi Clew, which forecasted 90-day balances to assess whether a user could afford an expense. The tool was largely constructed using AI coding assistants, including Antigravity with Gemini and ChatGPT Astra, while the developer directed the work. After submitting the project, he underwent a 30-minute voice interview with HackerRank's AI judge, Chakra, which asked adaptive follow-up questions probing his understanding of the architecture, implementation details, and trade-offs. The developer acknowledged mid-interview that he struggled to explain technical specifics of a system he had built with heavy AI assistance, ultimately scoring 66.1 out of 100. He concluded that being able to articulate how something was built should be an integral part of the building process itself.

0 comments Read more at DEV Community
0
ProgrammingHacker News ·

Monsanto's Grip on U.S. Agriculture: A 2008 Investigation Revisited

A 2008 Vanity Fair investigation examined Monsanto's growing dominance over American agriculture and the tactics the company allegedly used to consolidate control over the seed market. The report highlighted how Monsanto's patented genetically modified seeds reshaped farming practices across the United States. Farmers were reportedly subjected to strict licensing agreements that prevented them from saving and replanting seeds, a centuries-old agricultural tradition. The article raised concerns about the long-term implications of a single corporation holding such significant influence over the nation's food supply. The piece has resurfaced on Hacker News, drawing renewed attention to questions about corporate power in agriculture.

0 comments Read more at Hacker News
0
ProgrammingDEV Community ·

Developer Ships 4 AI Agent Payment APIs on Base Mainnet, Earns Zero Revenue

A developer has published a detailed build log after deploying four AI-agent payment APIs on Base Mainnet, reporting zero external revenue. The project encountered several real-world technical issues, including a facilitator hang and a silent scanner bug that went undetected for some time. Despite the systems functioning on a live blockchain network, no paying external users were acquired. The developer reframes the lack of revenue not as a technical failure but as a market signal, suggesting demand for this type of product may not yet exist. The candid post-mortem offers insights into the gap between functional Web3 infrastructure and actual product-market fit.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Developer finds AI coding agents routinely ignore their own stored rules

A developer ran controlled tests across hundreds of sessions to measure whether a coding agent actually follows rules loaded into its memory, finding the results far worse than expected. Despite relevant rules being retrieved and displayed to the model, the agent repeated the same heredoc-related coding mistake four times in a single conversation. Tests showed the agent followed a pointer instruction to read a rules file in only 4.9% of 89 sessions, and even with all 59 rules loaded simultaneously, violations still occurred six times in one day. The author found that neither preloading rules nor fetching them on demand could reliably stop a model once it chose to ignore a rule, and that enforcement required hook-based checks at the tool-call or turn-completion stage. The investigation also revealed that rule compliance varied significantly across different agent hosts and that many rules lack observable outputs, making automated enforcement structurally difficult.

0 comments Read more at DEV Community
← NewerPage 1187 of 3224Older →