SShortSingh.
TopTechnologyAI & MLStartupsProgrammingScienceBusinessFinanceCrypto & Web3World

Programming

LatestTopDiscussed
0
ProgrammingDEV Community ·

Cheap AI code reviewers miss security bugs far more often than frontier models

A code review vendor benchmarked a low-cost LLM (Luna, ~$1.20/million tokens) against a frontier model (Astra) across 50 pull requests from projects including Keycloak, Grafana, and Sentry. Luna detected bugs at roughly 20 times lower cost per verified finding, and performed comparably on routine data and logic issues. However, Luna caught only 9 of 24 security bugs versus Astra's 19, and struggled significantly on Keycloak's identity and access management code, where it also produced false positives at a much higher rate. Two critical authorization flaws — a reusable recovery code and a permission override bug — were missed by Luna entirely, as both required reasoning about the broader permission model rather than local code patterns. The study's authors recommend using cheaper models as a triage layer for routine changes while routing authentication and authorization code to more capable models, regardless of per-token cost.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

C++ Map Operator[] Creates Ghost Entries, Slowing Lookups From 3ms to 0ms

A developer discovered that using the square bracket operator on a C++ unordered_map to check for key existence was silently inserting default-value entries on every failed lookup. This happened because C++ operator[] allocates a new heap node and inserts a zero-value entry when a missing key is accessed, polluting the map with junk data. The accumulated ghost entries caused CPU cache thrashing and triggered costly hash table rehashes during iteration. Switching to mp.find(), a strictly read-only operation that returns mp.end() on a miss without any allocation, dropped runtime from 3ms to 0ms. Developers are advised to use find() or, in C++20, mp.contains() when checking for key presence rather than relying on the bracket operator.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Developer shares 7-point checklist for safely reviewing AI coding agent output

A developer has published a practical checklist for reviewing AI coding agent output, addressing a growing bottleneck teams face as agents produce large volumes of code changes. The checklist covers seven key concerns, including viewing changes as diffs, knowing the agent's working directory, tracking commands run and network access, verifying credential sources, and ensuring reproducibility. The author learned the hard way after letting an agent work directly in a live codebase, which led to an unnoticed dependency change that only surfaced at deployment. Based on these lessons, they built an open-source tool called TaskHandoff, a self-hosted control plane that gives each task its own isolated workspace and delivers Git changes as reviewable branches. The project is licensed under Apache-2.0 and documented at docs.thandoff.com.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

XopProtector Aims to Balance Android App Security with Size and Performance

XopProtector is an open-source Android app protection project that prioritizes engineering quality alongside security, addressing concerns about APK size, startup speed, and build-time complexity. The project argues that effective protection must balance security with compatibility, runtime performance, and developer experience, rather than simply maximizing security features. Its architecture focuses on protecting code and the execution environment without significantly inflating package size, making it practical for apps distributed over mobile networks. XopProtector also aims to minimize startup latency by avoiding unnecessary processing each time an app launches, keeping the protection largely invisible to end users. Additionally, the tool offers local protection workflows, including Windows GUI and CLI options, to avoid the delays associated with cloud-based processing pipelines.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Tencent's T-Mem System Anticipates Future Context to Retrieve AI Memories

Researchers at Tencent PCG have developed T-Mem, a long-term memory system for AI agents that addresses a core limitation of existing solutions: the reliance on semantic similarity between stored memories and incoming queries. Instead of searching for similarity at retrieval time, T-Mem pre-saves contextual trigger scenarios at the moment a memory is written, enabling recall even when the current conversation shares no lexical or semantic overlap with the stored information. The system organizes memory across four quadrants combining retrieval direction and memory granularity, each with its own trigger mechanism. T-Mem achieved state-of-the-art scores on two benchmarks — 80.26% on LoCoMo and 74.81% on LoCoMo-Plus — with only a 5.45 percentage point drop on the harder benchmark where mainstream systems decline by 28–50 points. The work has been accepted to the EMNLP 2026 Main Conference and is already deployed in Tencent's QQ AI Partner project.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

DeepCybo's PhysBrain 1.5 Tops Open-Source Physical AI Rankings with 72.5 Score

Chinese AI firm DeepCybo released PhysBrain 1.5 on September 9, 2026, a physical foundation model designed to bridge the gap between language AI and real-world robotic action. The model achieved an average score of 72.5 across 28 public benchmarks, claiming the top spot among open-source physical AI models and trailing leading closed-source competitors by just under one point. PhysBrain 1.5 is built on a closed-loop architecture called Physical Loop, which enables robots to observe, reason, act, and self-correct based on environmental feedback. DeepCybo trained the model using Ego360, a proprietary human-interaction dataset derived from panoramic video capturing full-body movement and task-level voice data, rather than internet text. Both the 2B and 8B variants are released under an Apache 2.0 open-source license and attracted over 3,000 Hugging Face downloads within three days of launch.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

AllSpark's Open-Source Iris Search Agent Rivals Closed-Source Tools with Context Management

AllSpark Research has launched Iris, an open-source AI search agent available in two sizes — Iris-mini (35B total, 3B active parameters) and Iris-pro (397B total, 17B active parameters) — both built on a Mixture-of-Experts architecture with 256K context windows and released under the Apache 2.0 license. Iris achieves strong benchmark scores, including 88.6 on BrowseComp and 92.9 on DeepSearchQA for the pro model, competing closely with previously dominant closed-source search agents. A key finding from the research is that intelligent context management — rather than simply scaling up parameters — is the primary driver of performance, with the smaller Iris-mini benefiting more from context strategies than the larger model. The agents were trained using an alternating supervised fine-tuning and reinforcement learning process run against live web search, not static offline data. By releasing model weights, context management strategies, and data construction methods together, AllSpark aims to close a two-year gap between open- and closed-source search agent capabilities.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

How to Fix Emails Landing in Spam: Debugging SPF, DKIM, and DMARC Alignment

Emails landing in spam despite configured authentication often stem from a misalignment between the domain in the visible From header and the domains used by SPF or DKIM. DMARC passes only when at least one authenticated identifier — either the SPF envelope-from domain or the DKIM d= signing domain — organizationally matches the visible From domain. Two separate authentication passes using unrelated domains will still cause DMARC alignment to fail, a common source of confusion during DNS migrations. To diagnose issues accurately, administrators should inspect the full headers of a received message and check the Authentication-Results field rather than relying on setup dashboards. Alignment rules can be relaxed or strict depending on the aspf and adkim tags in the DMARC record, and these settings become especially critical when moving DNS zones or introducing subdomains.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Developer Tests Whether AI Agent Authorization Actually Binds to Final Execution

A developer building AgentGuard, an AI agent security tool, investigated whether authorization decisions genuinely bind the specific action that gets executed, rather than merely being associated with it. The core concern is that an authorized action — such as a refund of $100 — could be replaced at execution time with a different one, such as a refund of $1,000, without triggering a rejection. Independent adversarial testing by OpenWorkProof uncovered two high-severity vulnerabilities: one where authorization could be linked to inputs other than the exact execution parameters, and another where an arbitrary callable could be injected into the execution path. In response, the developer redesigned the system around immutable execution snapshots and capability-bound execution to prevent any material change between authorization and actual execution. The findings highlight a broader gap in AI agent security, where permission systems may approve actions without guaranteeing that the approved action is precisely what runs.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

AWS Security Groups vs NACLs: Key Differences Explained Simply

In AWS networking, both Security Groups and Network ACLs (NACLs) are used to control network traffic, but they operate at different levels. A Security Group acts as a firewall at the EC2 instance level, controlling which traffic is allowed to reach a specific virtual machine. A NACL, or Network Access Control List, works at the subnet level, filtering traffic for all resources within that subnet. For example, a Security Group on a web server might allow only HTTP (port 80), HTTPS (port 443), and SSH (port 22) traffic. Understanding this instance-versus-subnet distinction is considered the foundational concept for managing AWS VPC network security.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

C# Tutorial: Convert Excel to Markdown and Back Using Spire.XLS Library

A new developer tutorial on DEV Community demonstrates how to perform bidirectional conversion between Excel spreadsheets and Markdown tables using C#. The guide relies on the Spire.XLS for .NET library, which works independently without requiring Microsoft Office to be installed. Developers can convert Excel files to standard Markdown tables with just a few lines of code, and reverse the process to generate print-ready Excel files from Markdown input. The solution is compatible with .NET Framework 4.0 and above, as well as .NET Core 3.1 and later versions. Output Markdown files are designed to work seamlessly with platforms such as GitHub, Gitee, and Yuque.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

How to Build a Freemium WordPress Plugin That Passes WordPress.org Review

WordPress.org's Guideline 5 prohibits plugins that contain locked, disabled, or paywalled code within the free version submitted to its directory. The compliant approach requires the free plugin to be fully functional on its own, with no hidden pro features bundled inside it. Paid features must live in a completely separate plugin sold off-site, which hooks into extension points exposed by the free plugin when installed and licensed. Developers are also advised to run the official Plugin Check tool before submitting to catch common escaping, internationalisation, and header issues that typically trigger rejection. Additional pitfalls include advertising unbuilt features in readme files and using trademarked terms in plugin slugs, both of which can result in rejection during review.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

AI Coding Logs Are Turning Private Thought Processes Into Corporate Data

As AI coding tools become standard in workplaces, the conversation logs they generate are increasingly stored on company servers and visible to employers through admin dashboards. Unlike code repositories or time logs, these records capture the entire thinking process — what questions an employee asked, where they hesitated, and how they approached problems. Legal frameworks around works-for-hire and trade secrets mean that once such logs reside on company accounts or devices, de facto control effectively transfers to the employer. This raises concerns about misuse, including reducing nuanced cognitive work to performance metrics or extracting an employee's accumulated questioning techniques as proprietary knowledge. The shift marks a new frontier in workplace data, where the internal act of thinking has, for the first time, become externally recordable and replayable.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Why AI Acts as a Mirror for Human Thinking, Not Just a Smarter Search Engine

A developer writing code with AI since June 2025 observed that AI conversations fundamentally differ from search engines in how they engage the user's thinking. While search engines retrieve existing information without altering the user's thought process, AI conversations involve co-creation — clarifying vague ideas, challenging assumptions, and reorganizing reasoning. The author argues that the process of formulating thoughts into language for an AI inherently forces users to structure and examine their own logic. Rather than simply providing answers, AI acts as cognitive scaffolding, making the user's thinking process externally visible for the first time. This perspective forms the first part of a planned four-part series exploring the nature of human-AI interaction.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Developer Launches COPstark, an AI-Powered AWS Cloud Cost Optimization Tool

A developer has built COPstark, a cloud budget optimization tool designed to help businesses reduce their AWS infrastructure spending. The tool analyzes AWS environments and generates actionable cost-saving recommendations, while a savings monitor tracks the financial impact of implemented changes. COPstark also identifies potential savings through AWS Savings Plans and includes an AI-powered chatbot that explains the reasoning behind each recommendation. Built on a technical stack including AWS CDK, ECS, Docker, Lambda, and S3, the tool uses secure cross-account access to analyze customer environments without requiring extra infrastructure. The project gave its creator hands-on experience in cloud architecture, distributed systems, and integrating AI into real-world engineering workflows.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

TypeScript Guide Shows How to Calculate True Loan APR After Origination Fees

A technical tutorial published on DEV Community explains how to compute the real annual percentage rate (APR) of a loan when upfront or recurring fees alter the borrower's actual cash flows. The core insight is that a lender's advertised nominal rate can differ significantly from the effective rate once fees reduce the amount a borrower actually receives. The guide frames the problem as an internal rate of return (IRR) calculation, where the true APR is the discount rate that makes the net present value of all scheduled outflows equal to the funds actually disbursed. A TypeScript implementation is provided, covering annuity payment formulas, cash-flow schedule construction, and a bisection-based IRR solver. The author notes the code is intended for comparing disclosed loan cash flows and does not constitute financial or legal advice.

0 comments Read more at DEV Community
0
ProgrammingHacker News ·

New tool calculates how long a local LLM setup takes to pay for itself

A developer has built a web tool called 'Sunk Cost' to help users determine the break-even point of running large language models on local hardware versus paying for cloud-based API access. The tool takes inputs such as the machine type, the model being used, and daily token consumption to produce a payback timeline. It was created in response to common claims that buying personal hardware to run AI models locally is ultimately cheaper than renting compute by the token. The project focuses purely on cost savings and does not account for other reasons someone might prefer local inference, such as privacy or offline access. The developer has shared it on Hacker News and is actively seeking feedback to improve its usefulness.

0 comments Read more at Hacker News
0
ProgrammingDEV Community ·

Developer hits $1,310 Google Maps API bill in 48 hours after following Claude AI advice

A developer building a personal database of coffee shops in Mexico racked up a $1,310 bill in under 48 hours after using a script written by Anthropic's Claude AI to query the Google Maps Places API. Claude had advised that the project would comfortably stay within Google's free monthly credits, but the estimate proved incorrect. Unlike many other Google APIs, the Google Maps Platform has no default spending cap, meaning automated scripts can generate unlimited charges without real-time warnings. After weeks of escalation, Google approved a 75% refund of roughly $983, but declined to waive the remaining $327, calling it a final decision. The developer is now urging others to independently verify cloud API pricing and set hard budget limits before running any automated scripts.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

PigData Turns 500 Enterprise Scraping Projects Into Self-Serve Developer API

Japanese data extraction firm PigData has launched Scraping AI, a self-serve developer API built on lessons from over 500 enterprise scraping projects for clients including Amazon, Honda, and MUFG. The company identified recurring inefficiencies in its managed service model, where engineers rebuilt identical parsing logic and anti-bot routines from scratch for each client. To address this, PigData engineered a scalable Python-based pipeline using Django REST Framework, Celery, RabbitMQ, and PostgreSQL, capable of handling thousands of concurrent crawling jobs on shared infrastructure. The system features a versioned state-machine architecture that integrates modular crawlers, LLM-based extractors powered by OpenAI and Gemini, and BM25 plus vector ranking. The API was developed and released within six months, offering developers immediate access without the lengthy sales cycles typical of managed enterprise contracts.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

How Azure SQL Database, Managed Instance, and SQL VMs Fit into Azure Architecture

Azure SQL workloads can be deployed across three main options — Azure SQL Database, Azure SQL Managed Instance, and SQL Server on Azure Virtual Machines — each offering different levels of infrastructure control. Azure SQL Database operates as a fully managed PaaS service, where Microsoft handles patching, backups, upgrades, and failure recovery automatically. The Hyperscale tier takes this further by separating compute from storage using page servers, a log service, and replicas, enabling independent scaling and faster backup and restore. Security in Azure SQL is layered, spanning network controls, authentication, authorization, and data protection rather than being a single feature. These architectural concepts are central to Microsoft's DP-300 database administration certification, which covers all three Azure SQL deployment models alongside on-premises SQL Server.

0 comments Read more at DEV Community
← NewerPage 1245 of 3229Older →