SShortSingh.
TopTechnologyAI & MLStartupsProgrammingScienceBusinessFinanceCrypto & Web3World

Programming

LatestTopDiscussed
0
ProgrammingDEV Community ·

Product Portfolio Reviews That Sharpen Investment Decisions

A portfolio can appear fully occupied while still being poorly allocated, with mature products absorbing support effort and new initiatives lacking a credible growth path. Leaders who cannot compare strategy, capacity, cost, and outcomes struggle to justify what to fund or stop. The article argues that an effective review ties strategic goals to products and delivery work, applies consistent prioritization criteria, and makes capacity limits visible. It recommends starting from the specific investment decision at hand and distinguishes product portfolio management, which decides what to fund over a product's lifecycle, from project portfolio management, which governs delivery. The guidance also covers defining a comparable portfolio structure, using lifecycle stages to interpret performance, and applying weighted scoring while keeping judgment and uncertainty visible.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Critical Nextcloud Collabora flaw CVE-2026-110447 allows unauthenticated code execution

A security flaw tracked as CVE-2026-110447 has been reported in the CODE server component bundled with the Nextcloud Collabora integration, rated 9.2 in severity. It can be exploited without authentication to achieve remote code execution, and reports indicate attackers have used it to install web shells. Because the vulnerable code runs in a separate document server, simply disabling the Nextcloud app does not remove the risk. The fix is reported in CODE Server build 26.4.303, and administrators are advised to verify the running version and locate every deployed instance. Experts also recommend checking for web shell indicators and unusual outbound connections before rebuilding affected systems.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Six Common Silent Installation Errors for GBase Database and How to Resolve Them

Silent installation can automate GBase Database (GBase 8s) deployment, but a failed run can interrupt the process. The guide recommends first checking the response file, installation permissions, component dependencies, and available disk space when ids_install -i silent fails. A common cause is a missing or misconfigured license acceptance parameter, which can be set in the response file or passed directly to the installer. The installer also needs the response file to exist at the specified path and be readable by the installing user. Permission issues on the target directory, unmet dependencies for selected components, and insufficient disk space on the install or temporary filesystem can each cause failures as well.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Mapping pointer coordinates to a canvas drawing buffer when displayed size differs

When a canvas is shown at a different size than its drawing buffer, pointer events report viewport positions that must be converted before markers are drawn. The conversion subtracts the canvas's on-screen position and scales the result by the ratio of buffer size to displayed size. The approach assumes an unrotated, axis-aligned canvas without CSS border or padding, so decorative borders should go on a wrapper element instead. Additional steps are needed if the drawing context has a transform or if the image is letterboxed within the buffer. The article advises re-reading the bounding rectangle after layout changes and checking the mapping near multiple corners to catch scaling errors.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

R60ABD1 Radar Data Bridged to MQTT via ESP32-S3 Gateway

The R60ABD1 60 GHz sleep and breathing radar reports presence, breathing rate, and sleep data over UART using the SIP-S V1.0 protocol but has no built-in Wi-Fi or MQTT support. A guide shows how to connect it to an ESP32-S3-WROOM-1 development board, which acts as a gateway to parse the frames and optionally publish them to an MQTT broker. The wiring uses UART1 on GPIO17 and GPIO18 at 3.3 V TTL levels, so no level shifter is needed, and the radar is powered from the board's 5 V pin with a shared ground. The setup avoids GPIO19 and GPIO20, which are reserved for native USB. Parsing is implemented in ESP-IDF, with SIP-S frames checked for header, footer, and checksum before being dispatched by control class.

0 comments Read more at DEV Community
0
ProgrammingHacker News ·

Australian Court Rules in Epic v. Apple, Opening Alternative App Stores and Sideloading

The Federal Court of Australia has issued a judgment in the dispute between Epic Games and Apple. The ruling reportedly requires Apple to permit alternative app stores on iOS devices in Australia. It also addresses sideloading, which would let users install apps from outside the official App Store. Third-party payment options within apps are part of the court's orders. The full judgment is available on the Federal Court's website.

0 comments Read more at Hacker News
0
ProgrammingDEV Community ·

October 2026 KEV Wave Exposes Edge Device Lifecycle Gaps Beyond Patching

Between late September and mid-October 2026, CISA added a cluster of vulnerabilities in edge infrastructure from multiple vendors, including Citrix, F5, Cisco, Ivanti, Palo Alto, Atlassian, BeyondTrust and AhsayCBS, to its Known Exploited Vulnerabilities catalog. The article argues the clustering is structural: these products sit at trust boundaries, terminate untrusted sessions, hold credentials and are designed to be internet-reachable. It contends that tracking only whether an appliance is patched misses reachability, credential exposure, behavioral baselines and configuration integrity. The author recommends provisioning devices with restricted management access, inventorying held credentials, establishing outbound traffic baselines and snapshotting configurations before and after changes.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Railyard adds one-command self-hosted Plausible analytics

The railyard.run team had run its site without analytics, leaving traffic questions unanswered. They used the launch command in Railyard's CLI to deploy a self-hosted Plausible instance. After the first-run sign-up, they added the website and placed the generated tracking snippet on the site. The default app URL was sufficient for both the dashboard and the tracking script, without a custom domain. The article also warns that each launch creates a separate app, which can be removed with the apps:rm command.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Converting nested JSON to CSV in Python with pandas

A common pandas recipe for JSON-to-CSV conversion produces an unnamed index column and cells full of raw dictionary text when the data is nested. The article explains that the problem lies in the JSON's structure rather than the recipe itself. It lists eight common error symptoms with their causes and fixes, most of which need only a single parameter change. For nested data, it recommends pd.json_normalize with record_path and meta, and it shows how to inspect a file's keys to choose the right approach. It also warns that pandas 3.0 treats a literal JSON string as a file path, so the string must be wrapped in StringIO.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Blog Logs 4,040 AI Crawler Requests in 30 Days, But Few Tied to Citations

A personal blog with eight posts recorded about 4,040 requests from AI crawlers over the 30 days to 20 October 2026, according to Cloudflare's count. Google's crawlers sent the most traffic, followed by Anthropic, OpenAI, Apple and Microsoft. Roughly half of the successful requests were for collecting data to train AI models, while only 26 came from an AI assistant fetching a page after a user's query. The author found that the blog's sitemap was read more often than any single post, and that ChatGPT cited the site in none of 12 test answers. The author notes that Cloudflare's AI Crawl Control lets other site owners see similar data.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

PHP Releases Fixes for Two Critical RCE Flaws; Public Exploit Claims Only Partly Verified

PHP released versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 on October 21, 2026, to address two critical vulnerabilities, CVE-2026-109618 (OOM corruption) and CVE-2026-109619 (stale global state across requests), both scored 9.2 under CVSS v4.0. A researcher testing a publicly circulated proof-of-concept found it did not reproduce the claimed use-after-free or remote code execution in several test builds, and found the official patches address different root causes. However, a chain combining the session.upload_progress feature with an application-level file inclusion vulnerability did achieve unauthenticated code execution in the researcher's lab. The researcher concluded that upgrading is the complete fix for the core CVEs, while applications using such a chain may remain exposed after upgrading.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

UAE PDPL and GDPR: Key Differences Companies Must Address

Data protection has become a major concern for organizations as they expand across borders, prompting closer attention to differing regulations. The UAE introduced its Personal Data Protection Law (PDPL) to strengthen data protection in the region, while the EU's GDPR, in force since May 2018, governs personal data processing across the EU and EEA. The GDPR sets out principles such as accountability, consent, and data portability, with fines reaching up to 4% of global annual revenue or €20 million. The PDPL applies to any entity operating in the UAE that processes personal data, regardless of origin, so international firms there should understand it even if they mainly follow GDPR. The two laws differ in consent requirements, the range of data subject rights recognized, and breach notification timelines, which means UAE companies must prepare for these distinct obligations.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Rocket Pool Security Audit Flags Critical Reentrancy and Access-Control Risks

A security audit covering Rocket Pool, a staking protocol with roughly $1.28 billion in total value locked, examined its v1.3.0 contracts and L2 adapters between October 1 and 15, 2024. The review identified 10 findings, including one critical reentrancy issue in the minipool withdrawal path that could let an attacker drain a minipool's balance. Auditors also reported over-privileged admin functions that a compromised DAO executor could exploit. The protocol received an overall risk score of 7.4 out of 10, rated as high. The report recommends specific code-level remediations for each identified vulnerability.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Full-width email addresses slipped past signup checks; fix normalizes input with NFKC

A developer at RoamProxy found that a verification email bounced with a 422 error because the address used full-width characters, such as ｅｘａｍｐｌｅ.tech, instead of standard ASCII. The signup form and database accepted the address, so the mismatch only surfaced when the mail provider rejected it. The team now applies Unicode NFKC normalization at the input boundary to fold compatibility characters into plain ASCII, and rejects addresses that remain non-ASCII. The change covers both email signup and Google sign-in, since both pass through the same function. Non-ASCII addresses such as user@bücher.de are now rejected, because the mail provider cannot deliver to them anyway.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Why a client's first vulnerability scan sets the baseline for future reports

The first vulnerability scan for a new client differs from later ones because there is no prior report for comparison, the asset inventory may be incomplete, and results often look worse than expected. A one-page scope note helps prevent surprises by defining what is included and excluded, the scan window, which credentials will be used, and written approval from an authorized party. Authorization matters because unapproved scanning can breach hosting contracts or violate the law. Scanner authentication results should be checked before trusting any numbers, since failed logins can make a credentialed scan look misleadingly clean. The initial report should show coverage, group findings into a small set of actions, prioritize a first wave of fixes, and record baseline totals that future reports will be measured against.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Internal and External Vulnerability Scans Answer Different Security Questions

Security teams often confuse external and internal vulnerability scans, though each reveals distinct risks. External scans test a client's public-facing systems, such as firewalls, VPN gateways, email servers, and websites, to show what any internet user could reach. Internal scans run from inside the network and assess workstations, servers, and devices to determine how far an intruder could move after gaining access. External scans typically produce fewer but more severe findings, while internal scans yield many more results that should be prioritized by risk. Experts recommend keeping both results in separate report sections with clear scope statements, and running external scans at least monthly and internal credentialed scans monthly.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Documenting Unfixed Vulnerabilities Through Formal Risk Acceptance

Security professionals often face clients who decline to fix known vulnerabilities, for reasons such as legacy software, vendor patch limits, or costly downtime. The article argues that such decisions should be recorded through a formal risk acceptance document rather than left as unresolved findings that lose context over time. It recommends listing the affected systems, the reason a fix isn't feasible, the realistic consequences, and compensating controls, along with a named client decision owner and clear expiry and review dates. Acceptance usually involves cheaper protective measures like network segmentation, firewall restrictions, or added monitoring rather than doing nothing. Accepted risks should be tracked separately and reviewed periodically, with earlier reconsideration if threat indicators such as known exploitation or new exposure emerge.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Verifying Vulnerability Scan False Positives Without Overlooking Real Risk

Vulnerability scanners often flag issues that turn out to be inaccurate, such as an Apache alert on a server running nginx or a patch reported missing right after an update. Common causes include guessing software versions from banners, ignoring backported fixes on Red Hat, Debian and Ubuntu, leftover files from old installs, pending reboots, shared IP addresses, and overly generic checks. The article argues that some supposed false positives are actually true findings that simply differ from expectations, and should be handled with their own remediation steps. It recommends a consistent verification process: reviewing scanner evidence, confirming directly on the host, consulting vendor advisories, and classifying each result as confirmed, false positive with proof, or true but different. Each dismissed finding should be documented with its reason, evidence, and review date so it can be audited and rechecked later.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Testing Live Watchlist Events Reliably by Modeling Presence, Not Timing

The article argues that flaky tests for a live trading watchlist stem from treating event time, batching, and delivery as timing problems rather than state. It recommends making event time an explicit dependency, flushing batches using a defined watermark, and asserting symbol presence as a state transition instead of relying on fixed sleeps. The author notes that batching delays are intentional and that transport ordering from protocols like WebRTC does not define what counts as current in the application. A deterministic reducer that tracks each symbol's latest sequence and status can be tested with an in-memory clock, while the network layer is tested separately. The approach keeps the production batching rules intact while removing sources of noise from CI runs.

0 comments Read more at DEV Community
← NewerPage 160 of 2962Older →