SShortSingh.
TopTechnologyAI & MLStartupsProgrammingScienceBusinessFinanceCrypto & Web3World

Programming

LatestTopDiscussed
0
ProgrammingDEV Community ·

Octoweb 0.15 adds page memory search, keyboard link hints, and private tabs

Octoweb version 0.15.0 was released nine days after its predecessor, marking the browser's largest update since launch with changes across 46 files and roughly 5,100 lines of new code. A key addition is page memory search, which lets users query the text content of previously visited pages — not just titles or URLs — by prefixing a palette search with a forward slash. The release also introduces a 'Later' queue that saves pages for reading, automatically expiring them after 14 days if unopened, while still keeping them findable via text search. A new keyboard-driven link-hint feature, activated with a shortcut, overlays short labels on all clickable elements in the viewport so users can navigate pages entirely without a mouse. Two new MCP tools allow AI agents to access both the page-memory search and the Later queue, enabling automated workflows such as summarising saved but unread content.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Security risks in MCP servers: why you should scan before connecting to AI agents

MCP servers connected to AI agents like Claude Desktop or Cursor can pose serious security risks, as they run locally with full user permissions and access to environment variables including sensitive credentials. Unlike npm packages, these servers carry an additional threat vector: tool descriptions that are fed directly into the AI model's context and can contain prompt injection instructions, exfiltration directives, or hidden Unicode characters. Security researchers have identified real-world patterns where malicious tool descriptions instruct models to ignore user commands, silently send data to external endpoints, or hide their own existence from users. A basic security review involves checking which shell commands and network tools the server invokes, as well as scanning tool metadata for suspicious phrases before the server is ever executed. Tools like MCPGuard can automate this static analysis, helping developers catch threats in seconds without requiring a dedicated security team.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Developer Builds Browser-Based Chiptune Player with 1,300+ Tracker Modules Using WebAssembly

A developer has launched Tracker Music, a browser-based player that streams over 1,300 authentic 90s chiptune and tracker module files in real time using a WebAssembly-compiled version of the libopenmpt engine. The platform supports classic formats such as .mod, .xm, .s3m, and .it, featuring per-channel muting, tempo scaling between 40 and 300 BPM, and a 60 FPS FastTracker II pattern visualizer. Four visualizer layers were built to recreate the demoscene aesthetic, including a 3D WebGL engine powered by Three.js with procedurally generated environments. An AI coding assistant helped accelerate development by automating metadata validation, optimizing 3D rendering performance, and fixing layout alignment across tracker formats. An ECO LITE mode pauses graphics rendering when the tab is hidden, reducing CPU usage to near zero while keeping audio playback active.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Developer Rebuilds Daily Scheduler Four Times Before Getting It Right

A developer spent four iterations fixing a scheduled job designed to publish one article per day, encountering a series of subtle but costly failures at each stage. The first version used a nohup loop stored in /tmp, which was wiped on reboot with no error reported. A launchd-based replacement then silently failed because macOS system schedulers run with a minimal PATH, meaning Node.js — installed via Homebrew — was not found, while a Python step continued working and masked the breakage. A sleep-based loop inside the script further stalled when the laptop entered sleep mode, causing a 15-minute interval to stretch nearly three hours. The developer concluded that each fix must be tested in the exact environment where it will actually run, not just in a developer shell where tools and settings differ.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

How Shapezo and Meshy Can Work Together for Safer 3D Design Pipelines

Shapezo and Meshy serve distinct roles in architectural and visualization workflows: Meshy generates exploratory 3D assets from prompts, while Shapezo situates design options within full site context. The two tools are most effective when connected through explicit validation states — such as exploratory, reviewed, or approved-for-visualization — rather than a single ambiguous final flag. Each generated asset should carry metadata including its source prompt, units, scale, and bounding box, linked to the Shapezo option that uses it, ensuring traceability across iterations. Human review remains essential before any AI-generated mesh is treated as verified architecture, with checks covering street scale, shadow behavior, and relationships to surrounding elements. The recommended workflow is to generate multiple candidates in Meshy, evaluate only the strongest in Shapezo, and record any asset changes with reasons to keep visual iteration auditable.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Developer Builds PHP Ukraine Job Platform Using Laravel 13, PostgreSQL 17 and Livewire

A developer recently launched PHP Ukraine, a platform designed to help Ukrainian PHP developers find jobs, interview resources, and technical content in one place. Built on PHP 8.4, Laravel 13, PostgreSQL 17, Livewire, Filament, and Docker with FrankenPHP, the project grew beyond its initial scope to include job aggregation, deduplication, salary normalization, search, and analytics. Job listings are imported hourly from Robota.ua, DOU, and Djinni, each integrated via a common interface using JSON APIs or RSS feeds, with additional page scraping for Djinni to fill in missing vacancy details. The codebase uses a modular structure with separate domain contexts and architecture tests written in Pest to enforce layer boundaries and prevent tight coupling. A rule-based classifier — rather than an LLM — handles tagging of framework, seniority, salary, and other job attributes, with salaries normalized to USD for consistent filtering.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

MyZubster Adds Signed Wallet Verification for Off-Chain Marketplace Requests

MyZubster Marketplace has introduced a system allowing users to create marketplace requests verified by an EVM-compatible wallet using off-chain cryptographic signatures. The flow separates identity, intent, and payment — meaning a signed request is not a blockchain transaction and no funds are authorized at this stage. Users connect a browser wallet, sign a backend-generated challenge to prove ownership, and then sign a separate economic snapshot when submitting a marketplace request. Single-use challenge tokens are consumed atomically after verification to prevent replay attacks, ensuring a signature cannot be reused to generate multiple orders. The feature introduces defined wallet states and order statuses, though the team notes the complete end-to-end production flow is not yet finalized.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

AI Pentest Bot Found Admin GitHub Token at $13B Startup Baseten in 25 Minutes

An autonomous penetration testing agent called Strix discovered a live GitHub admin token belonging to ML infrastructure firm Baseten during a pre-vendor security evaluation. The bot found a publicly accessible Harbor container registry on Baseten's domain, pulled a Docker image, and scanned its build history using TruffleHog. A GitHub personal access token had been embedded in a RUN instruction during a March 2023 image build and was never rotated, leaving it exposed in plaintext for over three years. The token granted full admin and push access to core product repositories and read/write access to private customer code, with no human involvement beyond the initial prompt. The root cause was a non-expiring, repo-scoped GitHub token on a bot account, compounded by a long-known Docker ARG secret-handling mistake that bakes credentials permanently into image build history.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

How to Connect an Industrial Laser Distance Sensor to Raspberry Pi Using Python

A new tutorial on DEV Community walks developers through interfacing an industrial phase-shift laser distance sensor with a Raspberry Pi using Python. The guide focuses on the LDL-T series optical module, which offers millimeter-level accuracy over ranges up to 100 meters — far beyond what common ultrasonic or infrared sensors can reliably achieve. It covers hardware wiring, enabling the Pi's serial UART port, and installing the pyserial library to handle communication. The sensor communicates via HEX frame commands over serial, and the provided Python script triggers single-shot measurements, validates checksums, and converts the 4-byte response into a distance reading in meters. The tutorial also includes troubleshooting advice for common issues such as serial port permission errors and wiring mistakes.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Developer Separates AI Agent Task Execution from Its Own Success Verification

A software developer building a pre-release system called Ranex identified a structural flaw in AI agent pipelines: the same harness that performs a task often decides whether that task succeeded, creating a conflict of interest. To address this, the developer forked the opencode agent harness at a specific commit and locked its plugin surface to prevent unverified components from altering its behaviour. The redesigned architecture separates roles so the harness can only emit work and references, while an independent kernel cross-checks those outputs against its own append-only, hash-chained dispatch record. Completed work is logged as a CANDIDATE rather than a PASS, meaning no approval is granted by the worker that produced it. Final sign-off remains a manual, out-of-band human action to prevent automated self-approval from masking incomplete or incorrect results.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

VATNode Test API Lets Developers Build Without Using Live Quota

VATNode offers a dedicated test API key, prefixed with 'vat_test_', that allows developers to build and test against its VAT validation API without consuming their monthly quota or writing to validation history. The test mode is triggered automatically by the key itself, requiring no changes to request URLs or body parameters. Developers must use VAT numbers starting with 'XX', a prefix reserved to avoid collisions with real EU member-state formats, with five specific numbers mapped to distinct response scenarios including valid lookups, missing company details, and upstream errors. Test responses mirror the same field names and data types as live responses, providing deterministic verdicts while generating fresh timestamps on each call. The only internal record kept is a one-time timestamp of a developer's first test call, used for onboarding purposes and not visible in the dashboard.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Manticore Search Adds Built-In Document Chunking to Improve Vector Search Recall

Manticore Search has introduced native document chunking at insert time, addressing a longstanding limitation where embedding models silently truncate long documents beyond their token window. Users can now define a chunk_strategy parameter directly in the vector column of a CREATE TABLE statement, with five strategies available: truncate, mean, fixed, recursive, and sentence. No external ingestion pipeline or splitter library is required, as Manticore handles splitting, embedding, and searching all chunks internally. Testing on the Manticore manual — spanning 189 pages and roughly 298,000 words — showed recall@5 improving from 55.1% to 83.3% and MRR rising from 0.44 to 0.70 for content buried beyond the model's input window. The trade-off includes approximately 2.5 times higher RAM usage and four times longer ingest time compared to the previous single-vector approach.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Developer builds free offline AAC app for non-verbal autistic child

A developer built a free, open-source augmentative and alternative communication (AAC) app called 'Mes mots' for a specific non-verbal autistic child who cannot yet read. The app uses a touchable tile grid that speaks words aloud, with tiles that never reorganize so the child can learn by finger position rather than text. Built with Vue 3 and TypeScript over several weeks, the app stores all data — including family photos and recorded voices — locally on the device using IndexedDB, with no server, no account, and no data transmission. Users can back up their data manually in the Open Board Format (.obz), an open standard compatible with other AAC tools, and the app works fully offline as a Progressive Web App. While professional AAC apps like Proloquo2Go and Grid 3 already exist, the developer aimed to create a simpler, immediately usable solution tailored to one child's specific needs.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

How One Developer Designed a Projected UI to Protect Privacy in a Public Room

A developer building a Windows desktop app for a Spanish festival group faced an unusual design challenge: the software would be projected on a wall in front of the very people whose data it displayed. The app, called Rueda de Actos, is used once a year to fairly assign participation slots across five events for 96 members of a Moros y Cristianos festival group in Alcoy, Spain. Because sensitive information like unpaid dues and penalties could be visible to the entire room, the developer chose to show blocked table cells without explaining why they were blocked. Three different eligibility rules all render as the same visual pattern — a subtle diagonal stripe — so the audience sees that a rule was applied without learning the specific reason. This deliberate ambiguity replaced the usual tooltip approach, prioritising the dignity and privacy of members over the interface's typical goal of maximum transparency.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

AI-Driven Tech Disruption Is Pushing Some Workers Toward More Fulfilling Paths

The tech industry has seen widespread job losses and reduced hiring as AI reshapes what companies need, leaving many professionals feeling insecure. However, some displaced workers are responding not with despair but by redirecting their skills toward personal projects, entrepreneurship, or entirely new careers. Observers note that the stability of a steady tech job often keeps people from pursuing work they genuinely care about, and forced disruption is breaking that inertia. A number of former tech workers are moving into small businesses, crafts, teaching, or hybrid careers that blend technology with other interests. The common pattern emerging is that energy once consumed by job survival is being channelled into more intentional and personally meaningful work.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Five Common Myths About AI Agent Working Directories and Disk State

Developers using AI coding agents often make incorrect assumptions about working directories, interpreter paths, and leftover disk state on remote machines. A new technical guide challenges five widely repeated beliefs, such as assuming a new chat session means a clean workspace or that a matching command name guarantees the correct interpreter. The article provides a shell script called cwd_receipt.sh that captures hostname, user identity, current directory, and interpreter versions on both local and remote machines for direct comparison. It also recommends writing a sentinel file before trusting any environment, as leftover files from previous sessions can silently persist. The piece was published as part of outreach for MonkeyCode, a remote development tool.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Developer built three football party games, each as a single double-click HTML file

A developer created three browser-based football games designed for social viewing parties, with a strict self-imposed rule: every game must be a single HTML file that opens with a double-click, requiring no npm, no build tools, and no server. The first game is a quiz show format with four rounds, featuring leaderboard guessing, category questions, a hidden-theme round, and a multi-clue final. The second is a bingo-style game where players tap a 5×5 grid of live match events on their phones, with all card state encoded directly in the URL hash using a seeded random number generator. A key technical challenge was answer validation for the quiz, solved by normalising Unicode apostrophe variants, collapsing Ukrainian-specific letters, and applying Levenshtein distance matching to handle typos and alternate club name spellings. The project was built across three weekends, prioritising shareability — if a file could not simply be sent to a friend, it was considered a failure.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Functional Testing Alone Cannot Ensure Safe Behavior in AI Applications

As AI and large language models become embedded in real-world applications like customer support and automation, developers face a testing gap that standard methods cannot fill. Functional tests verify that an application works as expected under normal conditions, but they often miss edge cases and unexpected model behaviors. AI systems can pass all functional checks and still produce harmful, biased, or unpredictable outputs in production. This has prompted growing interest in specialized approaches such as AI red teaming and LLM-specific security testing. Developers building AI-powered products are being urged to go beyond the happy path and adopt broader behavioral evaluation frameworks.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

BDD Frameworks in Kotlin: Choosing the Right Tool Based on Who Reads the Output

A developer with over 15 years of JVM acceptance testing experience has published a guide comparing BDD frameworks available for Kotlin, including Cucumber, JBehave, Kotest BehaviorSpec, Spek, JGiven, Serenity BDD, and Concordion. The author argues that framework selection should hinge on a single key question: who reads the test output and whether they are required to act on it. For teams where only developers consume test results, lightweight tools like Kotest or JUnit with descriptive test names are recommended, as adding a BDD framework introduces overhead without benefit. When non-technical stakeholders such as product owners or analysts need to review outcomes, a human-readable artefact becomes necessary, making tools like Cucumber or Serenity BDD more relevant. The author also challenges the common assumption that Cucumber is essential for non-developer collaboration, noting that acceptance criteria are typically written in project management tools like Jira rather than directly in feature files.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Starlette ASGI Flaw CVE-2026-48710 Enables Auth Bypass via Malformed Host Header

A medium-to-high severity vulnerability tracked as CVE-2026-48710 (BadHost) has been discovered in the Starlette ASGI framework, affecting versions 0.8.3 through 1.0.0. The flaw stems from Starlette reconstructing request URLs by concatenating unvalidated client-supplied Host headers, causing authorization middleware to evaluate an attacker-controlled path while the router serves the actual protected endpoint. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on September 2, 2026, citing evidence of active exploitation in the wild. Researchers at X41 D-Sec and Horizon3.ai demonstrated that the flaw can chain with a separate LiteLLM command-injection bug (CVE-2026-42271), enabling unauthenticated remote code execution and exposure of AI infrastructure credentials, with the combined chain rated CVSS 10.0. Users are advised to upgrade to Starlette version 1.0.1, which addresses the vulnerability by properly validating Host header values.

0 comments Read more at DEV Community
← NewerPage 1208 of 3226Older →