SShortSingh.
TopTechnologyAI & MLStartupsProgrammingScienceBusinessFinanceCrypto & Web3World

Programming

LatestTopDiscussed
0
ProgrammingDEV Community ·

Why AI Safety Needs Infrastructure Control Planes, Not Just Text Guardrails

As autonomous AI agents gain the ability to invoke tools, query databases, modify files, and trigger external processes, traditional text-based safety guardrails are proving insufficient for comprehensive security. A team building the PolicyAware platform concluded that enforcement must govern identities, actions, connectors, and resources—not just validate prompts and responses. They re-engineered their approach around an AI infrastructure control plane that handles policy enforcement, MCP tool governance, risk classification, model routing, and audit evidence. Unlike conventional guardrail frameworks, the control plane inspects Model Context Protocol JSON-RPC requests before forwarding and can deny, approve, or conditionally allow actions based on role, tenant, region, and risk. The two approaches are not mutually exclusive; PolicyAware supports optional integration with existing tools like Presidio and NeMo Guardrails, treating deterministic policy as the final authority.

0 comments Read more at DEV Community
0
ProgrammingHacker News ·

Neo Emacs Project Reimagines the Classic Text Editor for Modern Use

Neo Emacs is a new project aiming to redesign and modernize the long-standing Emacs text editor. The initiative is hosted at neomacs.org and has begun attracting attention within the developer community. The project was shared on Hacker News, where it received 11 points and sparked a small discussion with 5 comments. Details about specific features or the development team behind the project were not disclosed in the submission. The effort appears to be an early-stage exploration of what a future-oriented version of Emacs could look like.

0 comments Read more at Hacker News
0
ProgrammingDEV Community ·

Why Treating Code Generation and Operations as One Process Prevents Silent Drift

Software engineer Anton, who is migrating a PHP monolith into Go microservices, argues that code generation and operational setup must happen simultaneously from a single declaration rather than sequentially. When environment variables, metrics dashboards, and deployment pipelines are configured manually after code is written, the platform's description of a system gradually diverges from the system itself. These mismatches — such as undocumented env vars, stale dashboard panels, or undeployed daemons — typically surface silently in production long after the gap appears. Anton's approach centres on a single service manifest from which all operational artefacts, including variable names and pipeline configs, are mechanically derived using a consistent naming convention. He warns that silent failures erode trust in documentation entirely, making the problem self-reinforcing over time.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

How One Engineer Eliminated Per-Service Deploy Pipelines Using a Single Manifest

Software engineer Anton, working on migrating a PHP monolith to Go microservices, describes how his team unified deployment across all services by centralising configuration in a single manifest file. A silent Go linker bug — where an invalid -X flag produces no error yet leaves binaries stamped with a default 'dev' version — corrupted audit trails and distributed traces without triggering any alerts. The issue was compounded because the flawed flag existed in both the Makefile and Dockerfile, meaning fixing only one source caused local and production builds to silently diverge. To prevent recurrence, the team built a verification step that compiles binaries with a known probe version string and fails the build if that string cannot be found in the output. The broader takeaway is that a single authoritative manifest, combined with automated checks over written rules, made consistent and reliable deployments possible across every service.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

90% of a Service's Metrics Require Zero Instrumentation Code, Analysis Shows

A software engineer analysed the full metrics output of a production service and found 67 total metric records in its snapshot. Of those, 59 came automatically from the platform runtime and only 6 were written by the service itself. Metrics covering liveness, readiness, build version, broker delivery, Postgres pool state, and Go runtime internals all appeared without a single line of custom instrumentation. The engineer stores metrics as a diffable snapshot file rather than relying on a live scrape endpoint, making changes trackable over time. The finding challenges the common assumption that meaningful observability requires deliberate instrumentation effort from developers.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Overly broad config hashing caused 15 units to invalidate from a 6-line edit

A software project used SHA-256 hashes of an entire shared configuration file to verify whether individual units were up to date. When a developer added just six lines describing one new component, all fifteen units were marked stale and required full re-runs, consuming nearly an hour of machine time. The root cause was a mismatch between what the hash actually guaranteed — that no byte in the file had changed — and what engineers assumed it meant: that only their unit's relevant inputs had changed. The fix involved redefining the pin to hash each unit's own configuration block plus genuinely shared sections, rather than the whole file. The episode highlights that hash granularity is a design contract, and a check that is technically correct but disproportionately costly can quietly erode engineering practices over time.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Salesforce Data Cloud Deployments Can Fail Even When Source and Target Look Identical

A developer working on a Salesforce Data Cloud deployment encountered repeated failures despite both source and target environments appearing structurally identical. Investigation revealed that while the same components existed in both environments, their configurations, relationships, and dependency chains were not fully aligned. Data Cloud's interconnected architecture — spanning connectors, data streams, data lake objects, mappings, and identity resolution — means a single misconfigured dependency can break the entire deployment pipeline. The developer adopted a layer-by-layer validation checklist, correcting mismatched relationships and mappings before each redeployment attempt. The key takeaway is that a successful deployment requires matching component configuration and dependencies, not just component presence.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

DNS Rebinding Flaw Found in SSRF Guards After Comment Flags Untested Gap

A developer at ShortSingh discovered a critical DNS rebinding vulnerability across five URL-fetching endpoints after revisiting an unanswered comment left weeks earlier on a post about a separate SSRF bug. The existing protection relied solely on a regex blocklist checked against the hostname string, but the validation and the actual fetch involved two separate DNS lookups, leaving a window for the second lookup to return a different — potentially internal — IP address. Testing against a live rebinding domain confirmed the flaw bypassed production defenses entirely. The fix involved using Cloudflare Workers' cf.resolveOverride option to resolve the hostname once, validate the returned IP, and pin the connection to that exact address, eliminating any attacker-influenced second lookup. The patched implementation successfully blocked rebinding attempts in repeated tests while continuing to allow legitimate external requests without disruption.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

How Mixture of Experts Architecture Evolved from 1991 Research to DeepSeek-V3

Mixture of Experts (MoE) is an AI architecture that activates only a small subset of a model's parameters for each token, dramatically reducing compute costs compared to traditional dense models. The concept dates back to a 1991 paper by Jacobs, Jordan, Nowlan, and Hinton, which introduced a gating network to route inputs across multiple smaller expert networks, though all experts still ran on every input, offering no compute savings. The critical breakthrough came in 2017 when Google Brain researchers introduced sparse gating in their paper on Sparsely-Gated Mixture-of-Experts, where only the top-scoring experts are selected and executed per token. This sparse routing mechanism forms the foundation of modern large language model MoE designs. DeepSeek-V3 exemplifies the approach at scale, carrying 671 billion total parameters while activating only around 37 billion per forward pass.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Oracle HCM Position Hierarchies: Structure, Setup, and HDL Loading Explained

Oracle HCM's Position Hierarchy feature defines reporting relationships between organizational roles rather than individual employees, keeping the structure stable even when staff leave or move. Unlike manager-based hierarchies, which shift as people change roles, position hierarchies remain intact regardless of who occupies each slot. Organizations use them for workforce planning, vacancy management, approval routing, and headcount tracking. Setting up the feature requires enabling Position Management in Oracle HCM and creating positions with defined parent-child relationships. For large-scale implementations, HCM Data Loader (HDL) is commonly used to bulk-load positions and their hierarchical relationships in sequence.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

What Five Background Removal APIs Actually Do With Your Users' Media

A technical review of five background removal APIs — Banuba Face AR SDK, Remove.bg, Photoroom, VideoBGRemover, and Veed on fal.ai — examined their data handling policies as documented on vendor pages on 8 September 2026. Four of the five are hosted services, meaning user media leaves the device and crosses a network before processing occurs; only Banuba's Face AR SDK processes footage on-device. Data retention practices vary significantly: VideoBGRemover publishes the most detailed erasure timeline, while Remove.bg and Photoroom leave key durations unstated. A notable security concern with fal.ai is that CDN-hosted files are publicly accessible to anyone with the link unless an access control list is explicitly applied. The review relied solely on vendors' own published documentation and did not involve independent testing, with the author cautioning that any figures used for build decisions should be obtained in writing directly from the vendor.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

PolicyAware Framework Aims to Cut Latency in Enterprise AI Agent Safety Controls

As enterprise AI systems evolve from simple retrieval-augmented generation to autonomous agents that call tools and modify external state, traditional text-filtering safety measures are no longer sufficient. PolicyAware, an open-source Python framework, introduces a control-plane approach that enforces deny-by-default policies, PII and secret handling, tool governance, model routing, and audit logging before any side effects occur. The framework version 0.4.4, built on Python 3.10+, keeps its core dependencies lightweight to maintain a local, deterministic enforcement path with minimal overhead. Unlike conventional guardrails that focus solely on prompt and output inspection, PolicyAware evaluates identity, tenant, region, risk tier, and action context to make nuanced decisions including conditional allows and human-approval gates. Developers are advised to benchmark median, p95, and p99 latency in their own environments rather than relying on generalized performance claims.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Developer Tests RAG System Robustness by Swapping Every Embedder, Generator, and Judge Model

A software developer ran a structured experiment to determine whether a retrieval-augmented generation (RAG) pipeline's performance holds up when every model component is replaced. The frozen pipeline used simple 200-word chunks, cosine similarity retrieval, and a shared prompt, while three embedders, five generators, and three AI judges were swapped as variables. The evaluation set was expanded from 10 to 100 questions spanning four distinct topics, including 20 'refusal traps' where correct answers are absent from the corpus to test whether models answer from documents or pretrained memory. Three separate AI judges — from Claude, GPT, and Gemini — scored all answers independently to detect whether any judge favored outputs from its own model family. The goal was not to identify a winning model but to verify that the system's conclusions remain valid regardless of which vendor's models are plugged in.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Developer Releases Open-Source CSS Library Themed Around Shadow the Hedgehog

A developer behind the Shadorux fan project has released SHADOW.CSS, a lightweight open-source CSS library inspired by the visual identity of the video game character Shadow the Hedgehog. The library features components such as themed buttons, badges, inputs, alerts, dividers, and gradient styles built around a black-and-crimson color palette with sharp, dramatic design elements. It is available via jsDelivr for direct use in HTML projects and requires no additional framework. The library is MIT licensed and hosted on GitHub, making it freely available for others to use in their own projects. SHADOW.CSS is an unofficial fan creation with no affiliation to SEGA or Sonic Team, and is intended to grow alongside the broader Shadorux web ecosystem.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Why Simple Battery Backup Math Fails and How to Model It Accurately

Standard battery runtime calculations rely on linear division, but real-world electrochemical and power electronics behavior causes those estimates to overstate actual backup time by 30% to 50%. Three key factors drive this gap: Peukert's Law, which describes how higher discharge currents reduce usable battery capacity non-linearly; inverter tare losses, where idle power draw of 15W to 55W persists regardless of connected load; and depth-of-discharge limits, beyond which lead-acid and lithium batteries suffer irreversible degradation. A DEV Community article translates these physical principles into a deterministic TypeScript calculation engine using strictly typed, immutable inputs. The engine models effective capacity using Peukert exponents specific to battery chemistry, ranging from 1.03 for LiFePO4 to 1.30 for flooded lead-acid cells. The approach is particularly relevant for low-load scenarios, such as overnight CPAP or router use, where inverter tare losses can account for more than half of total battery drain.

0 comments Read more at DEV Community
0
ProgrammingHacker News ·

Oracle Conducts New Round of Layoffs as Restructuring Costs Reach $2.8 Billion

Oracle has initiated a fresh wave of employee layoffs, with affected staff reportedly receiving termination notices via email early in the morning. The cuts are part of a broader corporate restructuring effort by the enterprise technology giant. The total cost of Oracle's restructuring initiative has reached approximately $2.8 billion. The layoffs reflect a continued trend of workforce reductions across the technology sector as large companies seek to streamline operations and manage costs.

0 comments Read more at Hacker News
0
ProgrammingDEV Community ·

Dev fixes memory-killing build step by replacing redundant rebuilds with record lookups

A software developer noticed their project's acceptance-check step was repeatedly killed by the OS out-of-memory killer four times over two days. Investigation revealed the step, named a 'read', was actually triggering a full recompile of all 15 project units just to extract pass/fail booleans — duplicating work already done by prior control runs. Each control run had already stored its result alongside the exact commit hash it ran against, making re-execution unnecessary. The fix replaced the costly rebuilds with a simple comparison of stored commit identifiers, adding a 'stale' counter to flag outdated records instead. The developer concluded that any observational step consuming resources disproportionate to mere data-gathering is likely re-deriving facts that already exist.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Solo founder builds OSPulse to catch supply-chain threats before CVEs are assigned

Rob, founder of small indie firm Fortitude Omnis Group Ltd, has introduced OSPulse, a software supply-chain security tool designed to detect risks before official vulnerability identifiers exist. Unlike mainstream tools from VC-backed competitors such as Snyk and Sonatype, OSPulse monitors maintainer churn, ownership changes, and commit-velocity drops across more than ten data feeds. A standout feature called PoisonBox runs every npm package install inside an isolated disposable microVM, using an eBPF kernel probe to record all processes, file access, and outbound connections without touching the host machine. Rob also disclosed a pricing bug in which the checkout displayed £249 per month while Stripe was configured to charge £2,988 as a lump sum, a discrepancy caught before any customer was billed and since resolved by tying all pricing to a single source of truth. The introduction was posted on developer community platform DEV as part of a self-introduction thread.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

How Data Modeling, Schemas, and Joins Shape Power BI Report Performance

A practical guide published on DEV Community explains core data modeling concepts in Microsoft Power BI, a business intelligence tool used to connect data sources and build reports and dashboards. The article compares three structural approaches — flat table, star schema, and snowflake schema — outlining the roles of fact and dimension tables in each design. It highlights why a well-structured data model matters, noting that poor design leads to slow performance, inflated file sizes, and inaccurate report figures. The guide also covers how relationships and filter direction operate within the data model, and how Power Query joins differ from model-level relationships. A recommended approach for structuring a typical BI solution is included, with star schema presented as a scalable and report-friendly option despite its data redundancy trade-offs.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

CVE-Based Scanners Miss the Fastest Supply-Chain Attacks, Analysts Warn

Security scanners that rely on CVE databases are structurally blind to supply-chain attacks because a CVE can only be assigned after a flaw is discovered, catalogued, and published — a process that takes time attackers do not wait for. High-profile incidents including the event-stream npm compromise in 2018, the ua-parser-js hijack in 2021, and the polyfill.io domain sale in 2024 all caused damage before any CVE existed. Even xz-utils, which did receive CVE-2024-3094, had visible human warning signs — a new contributor slowly gaining trust and a tarball diverging from its git source — nearly a year before the identifier was assigned. Analysts argue that meaningful early detection requires monitoring project-level signals such as maintainer turnover, sudden drops in commit activity, ownership transfers, and artefact-to-source mismatches. These indicators consistently appear before an advisory is written and do not depend on a vulnerability number to be actionable.

0 comments Read more at DEV Community
← NewerPage 1252 of 3229Older →