SShortSingh.
TopTechnologyAI & MLStartupsProgrammingScienceBusinessFinanceCrypto & Web3World

Programming

LatestTopDiscussed
0
ProgrammingDEV Community ·

Installing Python packages can run malicious code; teams urged to pin hashes and delay new releases

A recent compromised LiteLLM release on PyPI reportedly stole credentials and planted a backdoor, highlighting that installing packages can execute code. The article explains that malicious code can run before import through setup.py in source distributions, through .pth files in site-packages that execute at interpreter startup, or via transitive dependencies. Attackers typically target environment variables, cloud and SSH credentials, and CI secrets before exfiltrating them. The suggested defenses include pinning exact artifact hashes, avoiding source distributions, applying a seven-day cooldown on new releases, and running pip-audit in CI.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

PHP2Shell flaws and stolen UpdraftCentral keys threaten PHP and WordPress sites

Emergency PHP patches on October 21 address two remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, which score 9.2 and can let unauthenticated attackers run code on web servers. Nearly all PHP versions back to 5.4 are reportedly affected, with Apache mod_php carrying the highest risk, and the bugs can also leak memory containing other users' credentials. Separately, attackers breached the developer of the UpdraftPlus WordPress backup plugin and are using stolen UpdraftCentral keys to install backdoor plugins that create hidden admin accounts. Administrators are advised to check PHP versions against fixed releases, restart services after patching, and review sites for unexpected plugins and users. Updating UpdraftPlus and removing the connection key are recommended as immediate cleanup steps.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Probabilistic graph neural networks aim to monitor aquaculture ponds under real-time policy limits

A developer built a sensor network across several fishponds in a cooperative near their city to track water quality. They found that per-sensor forecasting models missed cross-pond effects, since shared water channels let problems such as ammonia spikes spread between ponds. Treating the sensor layout as a graph, with ponds as nodes and hydrological connections as weighted edges, allowed the model to capture those dependencies. The work extends this to probabilistic inference and to enforcing regulatory constraints such as discharge limits and antibiotic restrictions in near-real time. The article describes the resulting architecture and lessons from testing it.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Why a 'nothing changed' report can silently hide real problems in incremental tools

A developer describes a rotation probe that checks which project memory files changed since the last run, and notes that the tool repeatedly reported 'nothing changed' while being wrong. The probe's bookmark used a naming scheme that didn't match the register, so ten of the projects were invisible to it while the output still looked like a normal run. A timestamp format mismatch caused the same silent failure, because zero newer files is indistinguishable from a healthy result. The author fixed the parsing so unreadable stamps raise an explicit error with exit code 2 instead of a clean empty list. The same comparison can also fail when a stamp lies ahead of the clock, leaving projects permanently reported as unchanged.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Overnight Azure Kernel Upgrade Stopped MongoDB From Starting on a VM

A team found their application down one morning with no deployments or configuration changes to blame. Investigation showed MongoDB refusing to start, with logs pointing to a known incompatibility between MongoDB 8.0.29 and Linux kernel 6.19 and newer. Azure had automatically upgraded the VM's kernel overnight during a maintenance window, moving it to a version that MongoDB explicitly blocks. Early attempts to fix the problem through file permissions and lock-file removal were unsuccessful. The root cause was identified as the kernel change, not data corruption or misconfiguration.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Qwen3 4B Outperforms 0.6B on Document QA Accuracy, but the Smaller Model Runs Faster on 6 GB GPU

A developer testing local retrieval-augmented generation on a laptop with a 6 GiB RTX 3060 compared two Qwen3 models run through Ollama. The 0.6B model generated text roughly three times faster than the 4B model, while using about a third of the peak GPU memory. On six synthetic document questions, the 4B model answered all correctly, whereas the 0.6B model passed four. The smaller model's failures included combining conditions incorrectly and returning malformed output for a case with missing information. The author notes that generation speed figures include reasoning tokens and do not reflect how quickly complete answers appear.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Turning a Product Name into an Offline Wake Word: Key Testing Considerations

A developer explores how smart products can recognize a custom wake word locally, without sending audio to the cloud. The article distinguishes between keyword spotting, suited to a few fixed phrases, and full speech recognition, needed for open-ended speech. It recommends testing candidate phrases with multiple speakers, varied distances, real hardware, background noise, and similar-sounding words. The author notes that browser-based screening is only a first filter and cannot guarantee performance in a real device. A standard ONNX or TFLite model is presented as a practical way to deploy across platforms, with cooldown logic and safe failure handling still required in the application.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Computer search closes 420 classes of a Kakeya-type configuration, leaving one case open

A research notebook on finite 2-groups with all involutions central reports progress on a number A(t) that would settle a family of such groups. The author's open-source work proves that one configuration, called (B5), is empty, meaning no anisotropic system with t = 7 and dimension 9 can contain an element of rank 3 in that configuration. The result rests on many SAT-solver answers saved without proof certificates, together with hand-written lemmas. With this step, the bound A(7) <= 8 reduces exactly to showing that a second configuration, (B6), is also empty, and 20 of its 68 classes remain unresolved. The notebook states that the work was researched and written with AI agents, and that no human mathematician has yet checked the proofs.

0 comments Read more at DEV Community
0
ProgrammingHacker News ·

mitmproxy adds --emudhra option in new commit

A commit to the mitmproxy GitHub repository has added a new command-line option called --emudhra. The change was shared on Hacker News, where it received 19 points and 3 comments. The available material includes only the commit link and discussion metadata, without a detailed description of the option's purpose or behavior. Further details would need to be confirmed by reviewing the commit itself or the project's documentation.

0 comments Read more at Hacker News
0
ProgrammingDEV Community ·

Postgres RAG chunking boundaries shape retrieval quality in knowledge-base bots

An internal knowledge-base bot showed degraded answer quality even though its services stayed up and queries succeeded. The trace revealed that the cited sources pointed to the correct handbook but the wrong passage, meaning the retrieval unit itself was flawed. Chunks that mix topics match weakly, while chunks that split a procedure across boundaries may omit the answer entirely. The guidance recommends structure-aware boundaries such as headings and complete procedures, paired with an evaluation set that checks whether the top results contain the supporting passage. Alerting should focus on sustained losses of answer-bearing chunks in retrieval results rather than on fluency of model output.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Experiment Finds AI Agents Struggle With Self-Managed Data Systems and Schema Design

A developer tested letting an AI autonomously manage a personal calendar and document folder, which worked for a while but degraded as the file count grew. In a second experiment, the AI was left to organize political data in a Neo4j graph database and S3-style storage, and it ended up modeling the graph like a relational database without using any relationships. The database also contained duplicate, inconsistent, and arbitrarily structured records. The author questions whether AI needs overly detailed instructions or whether specialized systems should be built instead of giving AI general tools. The piece references a paper suggesting agentic search can outperform traditional retrieval-augmented generation.

0 comments Read more at DEV Community
0
ProgrammingHacker News ·

Solo developer launches Markdown and raw HTML blogging platform scoring 99 on PageSpeed

A developer has released a new blogging platform after two years of solo development, driven by dissatisfaction with existing options. The platform aims to be extremely lightweight, with a sample blog reportedly scoring 99 to 100 on Google's PageSpeed Insights. Its creator says it avoids unnecessary JavaScript, lets bloggers place their own ads, supports managing multiple blogs, and offers an editor that supports semantic markup. The sample blog is set to noindex, which lowers its SEO score, and the developer announced the launch on Hacker News seeking feedback.

0 comments Read more at Hacker News
0
ProgrammingHacker News ·

Integer multiplication bound of K = 0.003 reportedly crossed in GitHub pull request

A pull request in the CrocSwap integer-mult-bounds repository on GitHub reports crossing a threshold of K = 0.003 for integer multiplication. The item was shared on Hacker News, where it has drawn 5 points and one comment. The source material provides only the link and engagement figures, so the technical details of the bound and the method used are not described here. Readers would need to consult the linked pull request for specifics on the result.

0 comments Read more at Hacker News
0
ProgrammingHacker News ·

Researchers say a recent PHP vulnerability has no easy exploit path

A post on eliastaylor.com argues that a particular PHP vulnerability does not currently have a simple, ready-made exploit. The piece was shared on Hacker News, where it gathered 43 points and 3 comments. The article itself is linked rather than reproduced, so the full technical reasoning is not available here. The discussion centers on how difficult it would be for attackers to weaponize the flaw in practice.

0 comments Read more at Hacker News
0
ProgrammingDEV Community ·

Flisk Splits Dockerfiles: Why Coding Agents Should Avoid Editing Them

Coding agents editing Dockerfiles can cause problems in larger projects, since they lack awareness of similar changes made across services. Flisk has two Dockerfiles, and its flisk up command builds only the generated one, which depends on local golden images that are not published. The plain Dockerfile written by flisk resource is only a starting point for builds outside Flisk and has not been verified as production-ready. Deployment-related files such as Helm charts are not generated by Flisk, so ports, images, and health paths can drift out of sync across them. The author recommends that agents focus on code inside containers rather than the surrounding configuration, and suggests bring-your-own Dockerfiles to narrow the gap between local and production builds.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Duplicate titles and meta descriptions on documentation sites hurt search results

Documentation sites often end up with many pages that share identical titles and meta descriptions, because new sections are copied from old ones and frameworks fill in missing front matter. Search engines expect a distinct, concise description for each page, and when many pages repeat one, they generate their own snippets, making results harder to tell apart. Common causes include pages opening with the same heading or admonition, versioned docs repeating every page, and site-wide descriptions applied wherever a page lacks its own. The article recommends setting unique title and description fields in each page's front matter and checking the built HTML to see what crawlers actually read. It also suggests command-line checks and site-audit tools to locate duplicates across a build or live site.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Malicious Bitwarden CLI and OVHcloud Incidents Highlight Risks of Trusted Developer Tools

In April 2026, a tampered version of the Bitwarden CLI was published to npm and remained available for roughly ninety minutes, during which it could read SSH keys, .env files, and cloud credentials from installing machines. In October, the official OVHcloud CLI repository was briefly compromised with a faulty build that was blocked after 94 minutes, following a customer report. The article argues that such trusted tools are hard for antivirus software to flag, since they run with the user's full file access. To limit this exposure, the author describes ghl-jail, an open-source Windows tool that restricts a command to a single project folder and blocks access to other files and, by default, the network. The author notes it reduces risk rather than guaranteeing protection against targeted attacks.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

HackAVP: jury to select finalists from 10 submissions before November pitches

The HackAVP hackathon in New Caledonia closed submissions on October 21, and its jury will pool scores on October 26 to choose the finalists. Each team was required to submit a dev.to article and a demo video showing the full chain from candidate profile to generated documents. Judging uses a 100-point grid covering the common base, technical quality, HR value and track-specific criteria. Two tracks compete: SaaS without limits, which allows any cloud service, and sovereign on-premise, which runs value and orchestration layers on hardware operated locally. Finalists will pitch and receive awards at the public announcement on November 5 at Tech'N Co.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Developer builds PhoneEar to play Mac audio through iPhone headphones

A developer who wanted to watch a show on their MacBook late at night without waking others built PhoneEar, an open-source tool. It routes the Mac's sound to play through whatever headphones are plugged into or paired with an iPhone. No iPhone app is required, as the tool runs in Safari on the Mac. During development, audio sounded about 9% too fast because macOS reported a 48,000 Hz sample rate while the MacBook speakers actually run at 44,100 Hz. The project's code is publicly available on GitHub for others to try, fork, or suggest improvements.

0 comments Read more at DEV Community
← NewerPage 215 of 3016Older →