0
ProgrammingHacker News ·
CSS: The bomb inside your inbox
Article URL: https://portswigger.net/research/css-the-bomb-inside-your-inbox Comments URL: https://news.ycombinator.com/item?id=49230066 Points: 5 # Comments: 0
Programming
0
ProgrammingDEV Community ·
How to Use Framer Motion in Next.js 15 Without Bloating Your Bundle
Framer Motion can be integrated into Next.js 15 to add subtle, polished animations without sacrificing server-side rendering benefits. Since Framer Motion relies on browser APIs, animated elements must be Client Components, but developers can limit the client boundary to small wrapper components rather than entire pages. Techniques such as staggered list animations, AnimatePresence for exit transitions, and the layout prop for smooth reordering help make UI state changes feel intentional rather than abrupt. Using a unique key prop with AnimatePresence signals Framer Motion to treat re-rendered elements as new, enabling proper enter and exit animations for dynamic content like status badges or live queues. These patterns prioritize consistency and restraint over flashy effects, which is what typically gives dashboards and product interfaces a refined feel.
0
ProgrammingHacker News ·
Revisiting Digital's Alpha 21264: The 1998 RISC Chip That Challenged Intel
The Alpha 21264 was a high-performance RISC processor developed by Digital Equipment Corporation and released in 1998. It was widely regarded as one of the most technically advanced CPUs of its era, competing directly against Intel's dominant x86 architecture. The chip gained attention for its exceptional speed and architectural innovations at a time when RISC processors were vying for mainstream adoption. A 1998 article from BYTE magazine, recently resurfaces on Hacker News, revisits the technical merits and historical significance of the Alpha 21264. The discussion highlights how the processor represented a peak moment for RISC computing before x86 architectures came to dominate the industry.
0
ProgrammingDEV Community ·
Token costs are the smallest part of running an AI agent, study finds
A technical analysis published on the Dev Community blog argues that API token fees are often the least significant expense when running large language model agents in production. The post identifies six cost axes that operators should track: token usage, latency, orchestration infrastructure, third-party tool-call fees, human-in-the-loop review time, and idle polling overhead. Because cloud providers only invoice for token consumption, the other five cost categories tend to go unbudgeted and untracked, spread invisibly across cloud bills, staff calendars, and latency dashboards. The author notes that human review time is typically one to two orders of magnitude more expensive per minute than compute, and that idle worker processes can cost more than active inference when throughput is low. A sample cost model accompanying the post lets teams substitute their own figures to identify which axis actually dominates their specific workload.
0
ProgrammingDEV Community ·
Swagger Is a Full API Toolset Built Around the OpenAPI Specification
Many developers associate Swagger solely with API documentation, but it is actually a broader ecosystem of tools built around the OpenAPI Specification (OAS). OpenAPI serves as the standard format for describing an API, while Swagger provides tools like Swagger UI, Swagger Editor, Swagger Codegen, and SwaggerHub that consume those definitions. These tools collectively support API design, interactive documentation, client and server code generation, team collaboration, and specification validation. A single OpenAPI definition can power an entire development workflow — from designing the API contract to publishing finished documentation. Backend developers are encouraged to go beyond building REST endpoints and learn to design, document, and communicate APIs professionally using the OpenAPI and Swagger toolset.
0
ProgrammingDEV Community ·
Developer Builds Free Calculator Suite to Estimate AI Coding Agent Costs
A developer has launched Coding Cost Lab, a free online calculator suite designed to help individuals and teams estimate the true cost of using AI coding agents. Unlike simple one-prompt cost estimates, the tool accounts for complex workflow factors such as repository context, agent turns, test generation, code review loops, and retry cycles. The platform includes dedicated calculators for popular tools like Claude Code, Codex, Cursor, and GitHub Copilot, as well as break-even analyses for API versus subscription plans. It allows users to adjust pricing assumptions manually, since provider rates and plan limits change frequently. The project also doubles as an SEO experiment, structured as a network of focused pages each addressing a specific AI coding cost question.
0
ProgrammingDEV Community ·
DevOps Engineer Explains How AI Speeds Up Troubleshooting Without Replacing Expertise
A DevOps engineer describes how AI tools have changed their workflow not by automating decisions, but by shortening the time between detecting a problem and forming a testable hypothesis. The engineer uses ChatGPT for communication and reasoning, Claude for coding and Kubernetes tasks, and an AWS DevOps Agent for infrastructure investigation. One practical use case involved using ChatGPT to polish a Slack summary after independently completing an EKS cost analysis, keeping the actual technical investigation human-led. The engineer also uses AI as a sounding board to surface overlooked factors before making infrastructure changes, such as instance downsizing. A key principle throughout is knowing when to trust AI output and being careful never to paste sensitive configuration data into any of these tools.
0
ProgrammingDEV Community ·
How Java Code Transforms from Source File to JVM Execution
When a Java program is run, it passes through multiple stages before any output is produced. The Java compiler (javac) first converts human-readable source code into platform-neutral bytecode stored in a .class file, rather than compiling directly to machine code. This bytecode is then picked up by the Java Virtual Machine (JVM), which loads it through a class loader, verifies its safety, and manages runtime memory. The JVM's interpreter and JIT compiler handle actual execution, translating bytecode into native instructions for the host platform. This architecture is the basis of Java's 'Write Once, Run Anywhere' principle, allowing the same .class file to run on Windows, Linux, macOS, or any system with a compatible JVM.
0
ProgrammingDEV Community ·
cidx v3.0.0 removes five features that silently misled users for months
Developer Aarav Shah released cidx v3.0.0, a major update to the open-source Go-based CI/CD runner, closing 55 issues across 70 commits in seven days. The release identified and removed five features that appeared functional but delivered incorrect or no behaviour, including a Docker build mode that never actually built anything and a config validation command that accepted typos as valid settings. A published Docker image was also found to have shipped without its binary for every prior release, as a misconfigured .dockerignore silently excluded the file without triggering any pipeline error. Four of the five breaking changes are described by the author not as quality defects but as honesty defects — cases where the tool actively confirmed success while doing nothing. The issues were uncovered through behavioural testing and manual verification rather than standard code review or automated checks.
0
ProgrammingDEV Community ·
Zero-click commerce means AI agents decide before your page ever loads
A developer operating a public catalog API observed an AI agent conduct over 500 searches, filter products, and exit without loading a single page or triggering any frontend analytics. This illustrates 'zero-click commerce,' where AI buying agents shortlist products by parsing structured data rather than browsing storefronts. Businesses that serve unstructured or human-oriented HTML risk being excluded entirely from an agent's candidate set, with no impression or bounce data to signal the miss. The author argues that serving lightweight, machine-readable product data — with explicit confidence flags and per-record timestamps for delta syncing — is now a competitive necessity. Recovering lost clicks is the wrong goal; ensuring structured, authoritative, real-time data is retrievable is what determines whether a store enters the decision at all.
0
ProgrammingDEV Community ·
Developer Cuts Next.js App Load Time by 47% With Three Optimization Fixes
A Next.js web application was loading in nearly 8 seconds on mobile connections, with a bloated JavaScript bundle of 1.85 megabytes causing the slowdown. The development team identified three core issues: loading all heavy libraries upfront regardless of user need, serving oversized images to mobile devices, and unnecessary component re-renders triggered by top-level state changes. They addressed these by splitting code into on-demand chunks, optimizing asset delivery, and reducing redundant rendering. The fixes cut the main bundle to under 980 kilobytes and halved the first meaningful render time from 4.2 to 2.1 seconds. The team recommends auditing performance early, shipping code only when needed, and prioritizing image optimization as the fastest path to speed gains.
0
ProgrammingDEV Community ·
How a Retry Bug Double-Charged a Customer $340 and Exposed a Systemic Flaw
A software team discovered a critical payment bug after a customer reported being billed $340 twice within four seconds for the same order. The root cause was a checkout service that automatically retried timed-out payment requests, not realizing the original charge had already succeeded on the processor's side. Further investigation revealed that multiple other endpoints — including refund issuance, subscription upgrades, and bulk invites — shared the same vulnerability. The team resolved the issue by implementing idempotency keys, which use a client-generated UUID to detect and block duplicate operations before they execute. Since deploying the fix across all four affected endpoints, duplicate-charge and duplicate-refund support tickets have been effectively eliminated.
0
ProgrammingDEV Community ·
How to Properly Mask Personal Data and Avoid Common GDPR Pitfalls
Personal data (PII) routinely leaks beyond core user databases into error logs, staging environments, analytics events, and even AI prompts, often because copying data is convenient and unchecked. A key distinction under GDPR separates masking, pseudonymization, and anonymization — each carrying different legal consequences. Pseudonymized data, where a reversible key still exists, remains personal data under GDPR and is still subject to retention, erasure, and breach rules. Static masking sanitizes data at rest and is critical for non-production environments, where cloning live production databases into staging is cited as the most common avoidable PII exposure. Dynamic masking, applied at read time, allows different user roles to see only the level of detail they require without altering the underlying stored data.
0
ProgrammingDEV Community ·
DeepSeek's Smaller Flash Model Beats Its Flagship Pro on Agent Benchmarks
DeepSeek released V4-Flash-0731 last week, a 284-billion-parameter model with only 13 billion activated parameters per token — far fewer than V4-Pro's 49 billion activated parameters. Despite no changes to its architecture, the updated Flash model now outperforms V4-Pro-Preview on several agent benchmarks, including Terminal-Bench and DeepSWE. DeepSeek attributes the performance gains entirely to additional post-training, with no increase in model size. Because inference costs scale with activated parameters, Flash runs at roughly a quarter of Pro's compute cost while delivering comparable or better results on agent tasks. The model is MIT-licensed with open weights on HuggingFace, though some benchmark figures have not yet been fully independently verified.
0
ProgrammingDEV Community ·
GGUF, GPTQ, AWQ: A Practical Guide to LLM Quantization Formats
Running large language models locally has become more accessible thanks to three quantization formats — GGUF, GPTQ, and AWQ — each suited to different hardware setups. GGUF, developed by the llama.cpp team, allows models to split workloads between GPU and system RAM, making it ideal for consumer laptops and Apple Silicon devices even with limited VRAM. GPTQ targets dedicated GPU environments, using a calibration dataset to compress model weights to 4-bit integers for fast inference, but requires all data to fit entirely within VRAM. AWQ, the newest of the three, improves on GPTQ's accuracy by identifying and preserving roughly 1% of critical model weights during quantization, making it well-suited for enterprise tasks like complex reasoning and code generation. Choosing the right format depends on available hardware — GGUF for flexibility, GPTQ for GPU-bound production APIs, and AWQ where accuracy is the top priority.
0
ProgrammingDEV Community ·
AWS Launches Dogwood to Enforce Sequence-Aware Policies for AI Agents
AWS released Dogwood this week, an open-source policy language licensed under Apache 2.0 that adds temporal, sequence-aware authorization for AI agents. It extends Cedar, AWS's existing stateless authorization language, which can only evaluate individual requests in isolation without knowledge of prior actions. Dogwood addresses this gap by tracking event histories, allowing policies to count in-flight requests, sum transferred values, and verify approvals across a time window before permitting an action. For example, an agent restricted to $5,000 per hour can be properly rate-limited even across concurrent requests that Cedar alone would each approve individually. The reference implementation is available on GitHub for exploration, while production use requires additional infrastructure such as trusted timestamps and durable trace storage; AWS is currently seeking language design feedback rather than code contributions.
0
ProgrammingDEV Community ·
Developer Ships AI Agent That Controls Android Phone via Natural Language After 21 Logs
A developer has completed and shipped an autonomous AI agent that controls an Android smartphone using natural language commands, concluding a project documented across 21 build logs spanning several months. The agent runs entirely offline and can interpret spoken or typed instructions to tap buttons, type text, switch apps, read the screen, and verify financial data. Built using Gemma 4, ADB, OCR, and a Flask web backend, the system achieved financial data verification accuracy of 94 percent by the final development phase. The project was developed intermittently alongside exam seasons and freelance work, with the developer publishing a full setup guide for others to run the agent on their own Android devices. Installation requires Termux via F-Droid, Ollama for local model inference, and enabling ADB developer options on any Android 7 or later device.
0
ProgrammingDEV Community ·
Developer builds open-source game to teach prompt injection by hacking a guarded AI
A developer has released injection-arena, a self-hostable game designed to teach prompt injection — a core security vulnerability in large language model applications — through hands-on practice. Players attempt to extract a hidden secret from a sandboxed AI agent across ten levels, each introducing a new layer of defense such as input filtering, roleplay blocking, and encoding guards. All grading is handled server-side to prevent cheating, with a canary token embedded in the system prompt serving as a precise signal for whether a prompt has been fully compromised. The game covers a range of real attack techniques including payload splitting, delimiter confusion, base64 encoding, and few-shot poisoning, mirroring the same methods used in its internal test suite. The project aims to build genuine intuition about LLM security risks in a way that reading about them alone cannot achieve.
0
ProgrammingDEV Community ·
FastAPI v1.2.0 Introduces Full Authentication Lifecycle Beyond Basic JWT Login
A developer building FastAPI Production API v1.2.0 has documented the design decisions behind a comprehensive authentication system that goes well beyond standard tutorial-level login flows. The implementation introduces scoped, single-use, hashed account-action tokens for email verification and password reset, ensuring neither can be replayed or misused across operations. Password resets now atomically revoke all active refresh-token sessions, while a token-family model groups rotated refresh tokens to support per-device session listing and revocation. Multi-factor authentication is handled through a two-step TOTP enrollment process with encrypted seed storage, alongside hashed recovery codes and replay protection via counter tracking. The release also incorporates OIDC login using the Authorization Code flow with PKCE, addressing common pitfalls such as unsafe email-based identity linking.
0
ProgrammingHacker News ·
Airy Launches as a Free, Fast Voice Content Creation Tool
A new tool called Airy has been introduced, positioning itself as a free and simple platform for voice content creation. The project was shared on Hacker News under the 'Show HN' category, which is typically used by developers to showcase their own work. The platform is accessible via airy.so, though detailed feature information was not provided in the post. The submission received modest early traction with 4 points and 2 comments at the time of reporting.