SShortSingh.
TopTechnologyAI & MLStartupsProgrammingScienceBusinessFinanceCrypto & Web3World

Programming

LatestTopDiscussed
0
ProgrammingDEV Community ·

DeepSeek V4-Pro Ignores Token Limits, Billing Users for Empty Responses

A developer building an AI-powered Liar's Dice game discovered that DeepSeek's V4-Pro model silently ignores token limit parameters, continuing to generate thousands of tokens regardless of the cap set. In tests conducted on August 14, 2026, three consecutive API calls with a 3,072-token budget each consumed the entire budget on internal reasoning, returning zero visible output while still charging the full cost. The API accepted unrecognized and even fabricated parameters without error, making it impossible to confirm whether any limit had taken effect. With reasoning enabled, costs ran 16.7 times higher than with it disabled, and a working disable command existed but was not consistently documented. The developer nearly misattributed the token-budget failure as a model-compliance failure, as empty responses triggered a fallback that logged the model as disobeying instructions in over 94% of game hands.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

React useFocus Hook Offers One-Line Focus State Tracking and Control

A new custom React hook called useFocus, part of the @reactuses/core library, lets developers track and control element focus state with a single line of code. The hook returns a live isFocused boolean and a setter function that can programmatically focus or blur any element, covering both observation and control in one API. It addresses known limitations of native browser tools like document.activeElement, which provides only a static snapshot, and autoFocus, which fires just once at mount. Hand-rolled focus listeners are prone to bugs such as missed late-mounting elements, incorrect initial state, and repetitive boilerplate across form fields. The hook handles these edge cases internally, including support for lazy element references that re-resolve as the DOM changes.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Publish Script's Duplicate Check Vulnerable to Race Condition Between Concurrent Runs

A developer maintaining a DEV.to auto-publishing script identified a time-of-check-to-time-of-use (TOCTOU) race condition in its idempotency guard, following two earlier fixes to the same function. The flaw means two simultaneous script invocations — each in a separate container — could both pass the duplicate-title check before either has posted, resulting in the same article being published twice. This scenario becomes plausible because the script's scheduled task runs twice daily and the repository has a documented history of long or hanging runs that could cause overlapping executions. Unlike the previous bugs, which involved a single check returning incomplete information, this issue arises when the state changes between two individually correct checks with no lock or reservation in between. The developer reproduced the race deterministically using two threads and a threading.Barrier against a fake server, since testing against a live shared DEV.to account across real containers was not feasible.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Developer finds --safe-mode flag left API keys fully exposed to subprocess calls

A developer discovered that adding the --safe-mode flag to Claude CLI subprocess calls in their project did not prevent sensitive API credentials from being inherited by child processes. The flag only controls config and plugin discovery, not environment variable inheritance, meaning both a GitHub token with full repository write access and a DEV.to API key were silently passed to every spawned subprocess. This occurred because Python's subprocess module copies the parent process's entire environment by default when no explicit env= argument is provided. The credentials had been loaded into os.environ at startup via a load_env() function, making them available process-wide despite the subprocess having no legitimate need for them. The developer confirmed the exposure through a minimal reproduction script that verified both keys were visible to a stand-in process whose sole task was generating a one-line commit message.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Developer builds FFT-based scanner after manual redaction missed username three times

A developer creating a desktop AI agent named Wisp recorded a demo that inadvertently exposed their system username in file path dialogs. Three manual attempts to blur the username using a static FFT delogo filter failed because macOS dialogs animate into position, causing the text to move before settling. To solve this, the developer used FFT-based template correlation in Python to track the moving text across frames and apply dynamic redaction boxes. A final verification scan across 2,225 frames was run on the finished file, which caught one additional leaked frame that visual inspection had missed. The experience led to the conclusion that redactions cannot be reliably verified by eye alone, and that any moving UI element requires frame-rate-matched tracking rather than fixed bounding boxes.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

How to Add Model Fallback in a Node.js App Using OpenAI-Compatible APIs

Developers building on OpenAI-compatible APIs can improve app resilience by implementing a model fallback system in Node.js using the official OpenAI JavaScript SDK. The approach tries a primary model first and automatically switches to a secondary model only when the initial request fails due to rate limits, server errors, or temporary unavailability. A simple loop iterates through a list of models, catching errors and logging warnings before moving to the next option. Experts caution against silently retrying authentication errors, as a 401 response typically signals an invalid or missing API key that must be fixed directly. JinzeAI, which offers an OpenAI-compatible endpoint for users outside mainland China, is currently in public beta and provides limited free test credit without requiring payment.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Developer shares technical fixes for importing custom .qbo files into QuickBooks

A developer building a browser-based tool to convert bank CSV files into QuickBooks-compatible .qbo format has documented several undocumented import requirements discovered through experimentation. The .qbo format is based on OFX 1.0.2, an SGML standard requiring a specific 9-line header, CRLF line endings, and only aggregate tags to be closed — not leaf tags. QuickBooks validates files against an internal bank registry and requires the INTU.BID field to be present, even if the surrounding block is omitted, otherwise rejecting the file with a vague error. The software deduplicates transactions using the FITID field, meaning randomly generated FITIDs can cause duplicate entries when date ranges overlap on re-import. The tool is free for single-file use, runs entirely in the browser without uploading data, and has so far only been tested on QuickBooks Desktop for Mac 2024.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Developer solves VS 2026 debugger detection using window title parsing

A developer building a Coding Activity Tracker needed to detect when Visual Studio was debugging an external process, but found that the standard Debugger.IsAttached method only works for the current process. Multiple alternative approaches — including WMI queries, process-tree walking, handle inspection, and CPU sampling — were tested and rejected due to unreliability or performance issues. The eventual solution relied on a simple observation: Visual Studio always displays the active project name in its window title during a debugging session. The tracker now reads that window title, extracts the project name, and checks whether a matching process is running to confirm debugging activity. The fix highlights how a straightforward platform behavior can outperform complex programmatic detection strategies.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Zero-Trust SSH Blueprint Uses FIDO2 Keys and Certificate Authority to Kill Static Keys

A technical blueprint published on DEV Community outlines a zero-trust SSH access model designed to replace traditional static public key management across server fleets. The approach combines FIDO2 hardware tokens, such as YubiKeys, with ed25519-sk key pairs that bind private key material to a physical device and require a PIN and touch to authenticate. A centralized, offline SSH Certificate Authority signs user access requests and issues short-lived certificates valid for only eight hours, eliminating the need to manually manage authorized_keys files on individual servers. This architecture reduces administrative overhead and shrinks the blast radius of compromised developer workstations by ensuring no long-lived credentials persist on target machines. Revoking or granting user access requires no changes on the servers themselves, as trust is managed entirely through the central CA.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Technical SEO Specialist Uses AI-Assisted Coding to Build Custom Web Tools

Hoang, a Technical SEO Specialist and self-described non-traditional developer, has introduced himself to the DEV Community platform. Without a formal software engineering background, he uses AI-assisted development — a practice he calls Vibe Coding — to build web applications, utility tools, and micro-platforms. His work spans Schema markup, Knowledge Graph optimization, custom PHP scripts, and Nginx server management. He joined DEV.to to document his journey, exchange ideas with experienced engineers, and discuss technical SEO best practices.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

CSS Anchor Positioning Lets Developers Build Tooltips Without JavaScript Hacks

CSS Anchor Positioning is a modern CSS feature that allows developers to position one element relative to another entirely in CSS, eliminating the need for JavaScript coordinate calculations. Traditionally, building tooltips required manual use of getBoundingClientRect(), resize event listeners, and sometimes third-party positioning libraries. With the new approach, a button can be assigned an anchor name and a tooltip can reference it directly using properties like top: anchor(bottom), telling the browser to place the tooltip just below the button. The feature also supports position fallbacks, so if a tooltip would overflow the viewport, the browser can automatically try alternative placements. While CSS handles positioning, JavaScript remains responsible for behavioral logic such as opening and closing tooltips, and developers must still address accessibility requirements like keyboard navigation and proper semantics.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Token Bucket vs Sliding Window: How to Build Rate Limiters That Hold Under Load

Rate limiting algorithms like token bucket and sliding window each have distinct failure modes that simple load tests often miss. The fixed window counter, a common first approach, can allow twice the intended request limit at window boundaries due to timing gaps. Token bucket implementations require monotonic clocks and thread-safe locking to prevent race conditions that silently over-permit requests. Unlike fixed or sliding window counters, token bucket natively supports variable request costs, making it more flexible for mixed endpoint traffic. In multi-instance deployments, per-process limiters fail to enforce global limits, requiring shared state via tools like Redis with atomic operations to remain effective.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

How to Build a Restartable Node.js Bulk Moderation Job with Cost Tracking

A structured approach to backfilling customer-support content catalogs recommends building a durable ledger as the core output of any Node.js bulk moderation job, rather than relying on parallel API calls or single large result files. The system ties every classification result to a tenant, policy version, and source item, making the process restartable if interrupted by crashes, rate limits, or deployments. Token usage — both input and output — should be recorded alongside each decision and aggregated by tenant and model to answer operational cost questions per client. Cost in currency must be derived from a versioned rate configuration applied at report time, not hardcoded into historical rows, so that rate changes do not distort past records. Engineers are also warned that a declining average token count may signal harmful truncation rather than cleaner data, and should be cross-checked against review rates and labeled evaluation samples.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

JavaScript Hoisting: How the Engine Moves Declarations Before Execution

Hoisting is a built-in JavaScript engine behavior that moves declarations to the top of their scope before code runs. This mechanism allows developers to reference functions or variables before the lines where they are actually defined. Function declarations are fully hoisted, meaning they can be called before their definition and will execute correctly. Variables declared with 'var' are also hoisted, but only their declaration is moved — not their value, so they return 'undefined' if accessed before assignment. Understanding hoisting helps developers avoid unexpected bugs related to variable and function declaration order.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Developers Build AI Code Security Scanner That Returns Results in Under 5 Seconds

A team has publicly shared the development of BugZ AI, a lightweight tool designed to scan code repositories and security links for vulnerabilities in under five seconds. The application is built using Next.js 15 with Tailwind CSS on the frontend, while Convex handles the backend database with real-time reactive updates. Authentication is managed via Clerk, and Capacitor is used to wrap the web app into a native Android application. The key technical challenge was stream handling — rather than waiting for a full AI response, the team used Convex real-time mutations paired with edge streaming to surface vulnerability checks progressively. The project is being developed in public and had reached 175 developer visits by its fourth day.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

What Google Merchant Center Actually Unlocks for Small Storefront Owners

A developer running a small vintage storefront discovered that Google Merchant Center is not a single destination but several distinct surfaces, each driven by a different mechanism. Free listings — not paid ads — are available to small shops and require only a correctly configured product feed to gain eligibility on Shopping-related placements. Separately, Product JSON-LD structured data on individual pages can independently generate rich results in ordinary Google Search, entirely without a Merchant Center account. A deeper audit revealed that Google had indexed only 5 of 436 site pages and had indexed almost none of the product images, pointing to a more fundamental visibility problem. The findings highlight that diagnosing Shopping tab issues often leads sellers to overlook both alternative organic surfaces and broader indexing gaps.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Cisco Talos Exposes JWR, a Chinese PhaaS That Steals Card Data via Encrypted WebSockets

Cisco Talos researchers have published an analysis of JWR, a sophisticated Chinese-language Phishing-as-a-Service framework capable of stealing credit card details and credentials in real time. The framework lures victims through SMS messages disguised as toll fees or delivery notifications, directing them to fake Shopify or WooCommerce checkout pages that closely mimic legitimate storefronts. JWR uses AES-CTR encrypted WebSockets to stream keystrokes to attacker-controlled servers before the victim even clicks submit, while attackers remotely control screen transitions using over 40 commands to prompt OTP entry, secondary card details, or banking app approvals. In environments where WebSockets are blocked, the framework falls back to HTTP long polling, ensuring persistent communication with the command-and-control server. Security teams are advised to monitor for suspicious SMS-linked domains, long-lived binary WebSocket connections, Web Workers, and the framework's distinctive REST API endpoints as detection signals.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

VMware vCenter CVE-2026-59310 Actively Exploited for Unauthenticated Remote Access

A critical vulnerability in VMware vCenter Server, tracked as CVE-2026-59310, is being actively exploited just five days after a patch was released. Attackers are targeting internet-exposed vCenter Syslog Servers using a directory traversal flaw to achieve unauthenticated remote code execution without any credentials. Once inside, they deploy a persistent cron job and an open-source reverse_ssh client to establish an outbound SSH connection back to an attacker-controlled command-and-control server, effectively bypassing inbound firewall rules. Broadcom has issued no workaround, making immediate patching the only remediation option. While vCenter serves as the central management plane for ESXi and virtual machines, no public evidence currently confirms that attackers have successfully leveraged this access to impact managed infrastructure.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Jewelbug Hackers Breach Government Webmail and Run Crypto Fraud on Shared Infrastructure

A threat actor tracked as Jewelbug has compromised government webmail systems by injecting malicious JavaScript into a shared hosting provider, affecting more than 15 webmail tenants, according to a Symantec Threat Hunter Team report published on August 13, 2026. The injected scripts steal session cookies via WebSocket connections and serve fake Adobe Flash update prompts to Windows users on targeted government domains. Victims who execute the fake installer receive the Antino malware, which abuses the Microsoft Graph API for command-and-control and deploys a rogue browser extension capable of stealing cookies, browsing history, screenshots, and clipboard data. On Linux systems and ASUS routers, the group deploys a Rust-based implant called ClientKing alongside a kernel rootkit and a credential-harvesting authentication module. Separately, the same XG-Web infrastructure is used to operate AI-generated fake cryptocurrency exchange pages impersonating platforms such as OKX and Binance, though the precise organisational link between the espionage and fraud operations has not been publicly confirmed.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Akira Ransomware Bypasses EDR via Safe Mode but Fails to Encrypt Files

The Akira ransomware group breached a corporate network on August 4, 2026, by exploiting a SonicWall SSL VPN that lacked multi-factor authentication, succeeding after numerous failed login attempts. Once inside, attackers enumerated Active Directory, compressed files from network shares using WinRAR, and exfiltrated the data to an attacker-controlled Amazon S3 bucket via s5cmd. They installed AnyDesk for persistent remote access and then rebooted the compromised systems into Safe Mode with Networking to disable endpoint detection and response tools, including Microsoft Defender. Although the Akira ransomware executable was launched in Safe Mode, the encryption process failed after 13 seconds due to a low virtual memory error. Data theft was confirmed as fully completed before the encryption attempt, meaning the breach resulted in exfiltration even without a successful ransomware deployment.

0 comments Read more at DEV Community
← NewerPage 145 of 1333Older →