SShortSingh.

Programming

0
ProgrammingDEV Community ·

LLM Fabricated Detailed Chinese Website for Airtable That Has Never Existed

A developer running a benchmarking harness against six Chinese LLM APIs discovered that GLM confidently described a fully detailed official Chinese website for Airtable — including pricing, terms of service, and a localized privacy policy — that has never existed. The domain airtable.cn has been registered to a private individual since 2016 and returns a 502 error, yet the model cited it as the most important source for verifying the company's credibility. The hallucination was especially dangerous because it consisted of mundane, specific details — like a privacy policy URL — that most reviewers would never think to verify. The researcher's automated quality checks, which monitored error rates and answer-length distributions across 4,023 responses, flagged nothing unusual since the fabricated citation appeared in a single, well-formed answer among thousands. A follow-up WHOIS and curl check across eight brands took roughly ten minutes and revealed that several .cn domains for major software brands are held by private individuals rather than the companies themselves.

0
ProgrammingDEV Community ·

How Four Silent Data Bugs Hid in 37 Million Mining Records

A developer building a predictive maintenance model on 37 million telemetry records from an iron ore mine uncovered four data quality issues, none of which raised exceptions or failed any standard checks. The dataset, sourced from Vale's Programa Desenvolver challenge, included deliberate errors, though one bug affecting 237,443 rows was undocumented and only discovered when the full pipeline ran against all six months of data. The most widespread issue involved over 36 million rows where a column stored the literal text string 'NULL' instead of a true null value, causing missing-data checks to falsely report the column as fully populated. Other problems included UTF-8 encoding corruption affecting just 11 rows, Brazilian-style comma decimal separators in numeric fields, and additional 'NULL' strings in sensor-reading data. The author highlights that even large, seemingly representative data samples can conceal low-frequency bugs, making full-dataset validation essential before modeling.

0
ProgrammingDEV Community ·

Developer Tests Image APIs for Node.js: Docs, Contracts, and Hidden Token Costs

A developer evaluated multiple text-to-image APIs for a junior-friendly Node.js web application, prioritizing clean REST design, clear documentation, and predictable response formats over the number of available models. The test used a fixed set of 20 prompts across categories and validated JSON payloads before processing any image data, mapping results into a shared internal type. A key lesson emerged around cost estimation: one experiment consumed 1.7 million tokens instead of the projected 400,000 because retrieved context was silently duplicated across prompt variations in a notebook. The developer now tracks token usage separately for each pipeline stage — prompt rewriting, title generation, and alt text — to catch unexpected cost multipliers early. The overall recommendation is to choose the API with the clearest payload contract after testing with your own prompts, since generic benchmarks may not reflect a specific product's visual requirements.

0
ProgrammingDEV Community ·

Timeline Studio adds browser-based cinematic depth-of-field using WebGPU AI model

Open-source browser video editor Timeline Studio has introduced a Cinematic Depth feature that runs the Depth Anything V2 Small AI model locally via WebGPU, requiring no data to leave the user's device. Unlike standard background-blur tools that rely on person segmentation, the feature estimates continuous relative depth across an entire frame, enabling nuanced depth-of-field effects. Users can adjust focus distance, focus range, lens blur, and bokeh highlights through a dedicated Effects panel on both desktop and mobile. The system separates depth analysis from visual styling, meaning slider adjustments re-composite existing depth data without rerunning the model, improving performance. The Q4F16 model configuration was chosen to balance accuracy with browser constraints such as memory limits, WebGPU availability, and initialization latency.

0
ProgrammingDEV Community ·

Asimov's 1964 Predictions for 2014: How Many Came True?

In August 1964, science fiction writer and biochemist Isaac Asimov wrote a New York Times article imagining daily life in 2014, inspired by the New York World's Fair. He approached futurology as a scientific exercise in extrapolating existing technological and social trends rather than mere speculation. Several of his predictions proved remarkably accurate, including pocket screens for video calls and multimedia consumption, wireless battery-powered portable devices, and programmable home appliances — all of which map closely to smartphones, lithium-ion mobile computing, and IoT home technology. His concept of the 'positronic brain', an artificial neural network capable of reasoning and natural language, finds a striking parallel in today's large language models and deep learning systems. Like all futurists, Asimov also missed the mark in certain areas, where the physical limits of technology or the biases of his era pushed reality in an entirely different direction.

0
ProgrammingDEV Community ·

Chaca 2.2 brings test data generation to the browser with new SQL and error handling

Chaca, a TypeScript library for generating realistic relational test data, has released version 2.2 with full browser support across frameworks like React, Vue, and Svelte. The update introduces a transform API that serializes data entirely in memory — enabling file downloads without filesystem access — while the existing export method continues to work as before in Node.js. Two new SQL targets, SQLite and MySQL, have been added alongside the existing PostgreSQL support, each generating scripts with engine-native types and available via CLI. Error handling is now unified under a single Errors namespace, making exception management easier to discover and use. The release also fixes several long-standing bugs, including inclusive upper bounds in chaca.pick, broken Java code generation, and incorrect PostgreSQL string escaping.

0
ProgrammingDEV Community ·

GitOps Tutorial: How Argo CD Uses Git to Automatically Manage Kubernetes Clusters

A developer has published a hands-on guide explaining how to implement GitOps on a Kubernetes cluster using Argo CD, the open-source continuous delivery tool. The approach replaces manual kubectl commands by treating a Git repository as the single source of truth for cluster configuration. When Argo CD is configured with automated sync, self-healing, and pruning enabled, any manual change to the cluster — such as scaling a deployment or deleting a service — is automatically reversed within roughly 15 seconds to match the Git state. The setup was demonstrated on a modest 4GB Hetzner VPS already running other workloads, with Argo CD consuming around 500MB across seven pods. A key benefit highlighted is that every cluster change becomes a Git commit, effectively providing a built-in audit log, rollback mechanism, and change-review process at no extra engineering cost.

0
ProgrammingDEV Community ·

Open Source Powers Global Tech but Faces Sustainability and Ethics Challenges

Open source software has evolved from a countercultural movement into the dominant foundation of global technology infrastructure, underpinning everything from web servers to mobile operating systems. Its key strengths include transparent code auditing, freedom from vendor lock-in, and the collective intelligence of decentralized global developer communities. The model has also democratized access to enterprise-grade tools, allowing small startups to compete with large corporations using the same open infrastructure. However, the rapid growth of open source adoption has introduced serious tensions around sustainability, ethics, and the imbalance between corporations that profit from the ecosystem and the communities that build and maintain it. Analysts argue that an honest assessment of open source must acknowledge both its architectural and economic advantages and its deepening operational and ethical fault lines.

0
ProgrammingDEV Community ·

ChainDrop Worm Hijacks npm Packages to Steal Credentials and Self-Propagate

A critical supply chain attack dubbed 'ChainDrop,' part of the Shai-Hulud worm family, was disclosed by Aikido Security on August 4, 2026, affecting over 434 npm packages including keyv, flat-cache, and file-entry-cache, with combined downloads exceeding 2 billion per month. Attackers compromised GitHub accounts of package maintainers, pushed malicious files directly to repositories, and used legitimate GitHub Actions to publish tainted versions that carried valid provenance signatures. Once a user or CI system installs an affected package, a preinstall script silently downloads the Bun runtime and executes obfuscated malware that harvests credentials from npm, GitHub, AWS, Kubernetes, HashiCorp Vault, Stripe, Slack, and local environment files. Stolen tokens are then used to republish compromised versions to npm and commit malicious code to up to 50 GitHub branches, while hooks injected into VS Code and Claude Code settings ensure the attack re-executes when developers open affected repositories. Exfiltrated data is uploaded to a public GitHub repository, with a blockchain-resolved fallback domain serving as a secondary exfiltration endpoint.

0
ProgrammingDEV Community ·

Google ADK Flaw Let Low-Privilege AI Agent Trigger Privileged CI Workflows via Prompt Injection

Security firm Pillar Security disclosed on August 3, 2026, a high-severity attack chain targeting Google's open-source Agent Development Kit (ADK) for Python on GitHub. An external attacker could embed a prompt injection inside a pull request body, manipulating a low-privilege PR triage agent into posting a comment under a trusted collaborator's identity. Because Google's gemini-dispatch workflow granted trust based on the commenter's identity rather than the origin of the content, it automatically triggered high-privilege Gemini CI workflows with broad runner access. Through the resulting runner execution and a leaked GITHUB_TOKEN, an attacker could spoof reviews, approvals, labels, and review requests to make malicious code appear legitimately vetted to human maintainers. Google mitigated the vulnerabilities by late July 2026, and no active exploitation was confirmed.

0
ProgrammingDEV Community ·

Forescout Finds 15 Flaws in TP-Link Omada That Allow Full Fleet Takeover

Forescout's Vedere Labs disclosed 15 vulnerabilities in TP-Link's Omada Zero-Touch Provisioning system on August 4, 2026, tracked across multiple CVEs including CVE-2025-7850 and CVE-2025-9289 through 9293. Attackers can exploit predictable serial numbers and spoofed MAC addresses to win device adoption race conditions at roughly 1,000 devices per 17 requests per second. By chaining default credentials, hard-coded keys, and weak certificate validation, adversaries can hijack cloud controllers, steal site credentials, inject malicious scripts into the admin interface, and execute root commands on managed devices. The flaws also affect related TP-Link product lines including VIGI, Festa, Tapo, and Kasa, which share the same protocol and trust components. Forescout noted approximately 1,800 Omada controllers are currently exposed to the internet, and detection is difficult because the attack traffic closely resembles normal ZTP activity.

0
ProgrammingDEV Community ·

Palo Alto Networks AI Pipeline Finds Over 14,000 Vulnerabilities in Open-Source Code

Unit 42, the threat research arm of Palo Alto Networks, published findings on August 4, 2026, detailing an autonomous multi-agent AI pipeline designed to discover security vulnerabilities in open-source software. The system uncovered 14,090 potential issues, of which 14,005 were new candidates not previously documented in public records. Among the findings, 4,030 were rated High or Critical under the CVSS 3.1 scoring standard, with 5,600 flagged under CVSS 4.0. The pipeline chains multiple AI agents to handle tasks such as target selection, parallel vulnerability discovery, proof-of-concept generation, and isolated reproduction in sandboxed environments. Researchers emphasized that this is defensive security research with no real-world victims, though they noted the same capabilities could theoretically be repurposed by malicious actors.

0
ProgrammingDEV Community ·

Researchers Show AI Copilot Can Supercharge Email Fraud After Account Compromise

Cybersecurity firm Barracuda Networks published research on August 4, 2026, demonstrating how attackers can weaponize Microsoft 365 Copilot once they gain access to a regular employee's mailbox. In the lab simulation, the attacker used Copilot to rapidly map the organization, extract confidential email threads, and mimic the victim's writing style — all without deploying any malware. The attacker then lured the CEO into an adversary-in-the-middle phishing proxy, stole the authenticated session token, and accessed the CEO's mailbox to identify a live wire transfer of $247,500. Posing as the CEO, the attacker sent a convincing bank-account-change request to the finance team, with replies secretly forwarded to an external address and evidence deleted via Copilot. Because all emails originated from legitimate internal accounts, standard SPF, DKIM, and DMARC checks passed, though identity and mailbox audit logs could still detect the anomalous rule creation, bulk summarization, and deletion activity.

0
ProgrammingDEV Community ·

React useMeasure Hook Simplifies DOM Element Sizing via ResizeObserver

A new React hook called useMeasure, available from the @reactuses/core library, wraps the browser's ResizeObserver API into a single reusable line of code. Developers pass a ref to the hook and receive a live rect object that updates automatically whenever the target element changes size, whether due to window resizes, flexbox reflows, font swaps, or content changes. The hook handles observer setup and cleanup internally, disconnecting automatically on component unmount and eliminating common pitfalls like stale closures and manual disconnect calls. An optional stop function lets developers halt observations after capturing a one-time measurement, useful for entry animations or initial layout calculations. One key caveat noted is that the returned rect coordinates are relative to the element's own content box, not the viewport, so developers needing on-screen position data should use getBoundingClientRect instead.

0
ProgrammingDEV Community ·

n8n Announces In The Loop 2026 Conference in Berlin for October 13-14

Workflow automation platform n8n has announced its first major in-person conference, called In The Loop 2026, scheduled for October 13 and 14 at Wilhelm Studios in Berlin. The two-day event will focus on the company's product roadmap, long-term vision, and the broader direction of automation and AI. October 13 is a by-invitation Partner Day, while October 14 is an open Ecosystem Day expected to draw up to 1,200 attendees from the builder, engineering, and enterprise communities. The program will include talks, product demos, workshops, an expo floor, and a startup showcase, with a community Call for Topics open until August 20. No specific new features or release dates have been announced alongside the event.

0
ProgrammingDEV Community ·

Why Cache Hit Rate Is the Key Metric for LLM Agentic Workloads

Prefix caching in large language model (LLM) serving reuses previously computed key-value caches when a request repeats the same prompt prefix, avoiding costly recomputation. This mechanism is especially impactful for agentic workloads, such as coding agents like Claude Code or Cursor, where every iteration re-sends the full accumulated context to the server. Without effective caching, time-to-first-token grows with each step as the model recomputes an increasingly long context, slowing down the entire agent loop. Caching also reduces costs significantly, since prefill compute scales with context length and agentic sessions can easily exceed 100,000 tokens. The cache hit rate metric — measuring how often requests are served from cache rather than recomputed — is therefore one of the most informative benchmarks when evaluating LLM serving infrastructure for multi-turn or agentic use cases.

0
ProgrammingDEV Community ·

llmperf Archived: A Guide to Active LLM Benchmarking Alternatives

The ray-project/llmperf tool, once a leading open-source option for benchmarking OpenAI-compatible LLM endpoints, has been placed in archive mode and is no longer receiving updates or fixes. Its key limitations included per-request averaging of inter-token latency that masked decode-phase spikes, and Ray-based startup overhead that made quick endpoint checks cumbersome. Several actively maintained alternatives now fill different niches: aiperf and trtllm-bench offer GPU-level metrics, vllm-bench targets vLLM-specific testing, and GuideLLM provides visual dashboards. For teams needing a lightweight option, llmperf-rs is a single Rust binary that benchmarks any OpenAI-compatible endpoint with minimal setup and preserves raw inter-token latency values for accurate percentile reporting. The choice among tools largely depends on whether users need GPU-deep diagnostics, distributed load generation, or simply a fast, low-dependency endpoint check.

0
ProgrammingDEV Community ·

How to Create Strong, Attack-Resistant Passwords: A Practical Guide

Passwords remain the first line of digital defense, even as two-factor authentication grows in popularity, because attackers routinely exploit leaked databases and brute-force tools to crack weak credentials in seconds. Security experts recommend passwords of at least 12–16 characters, combining uppercase and lowercase letters, numbers, and symbols, while avoiding personal information or predictable patterns. Each online account should have a unique password, and length is considered more important than complexity alone — a long, random passphrase outperforms a short but symbol-heavy one. Tools such as 1Password, LastPass, and command-line generators can create unpredictable strings, while services like Have I Been Pwned allow users to check whether their passwords have appeared in known data breaches. Using a dedicated password manager secured with a strong master key and two-factor authentication is recommended as the most practical way to maintain robust, unique credentials across all accounts.

0
ProgrammingDEV Community ·

Developer Releases RapidReact VS Code Extension to Cut React/TypeScript Boilerplate

A developer has launched RapidReact, a Visual Studio Code extension designed to reduce repetitive boilerplate when writing React and TypeScript code. The extension converts common patterns into short, typed snippets using prefixes such as rr.state, rr.usefetch, and rr.tq.querypage. It covers frequently used libraries including TanStack Query, React Hook Form, Zod, and Axios, with all snippets written in a TypeScript-first approach. The extension is available on the VS Code Marketplace and is currently at version 0.1. The developer, who describes themselves as early in their career, is actively seeking community feedback via GitHub issues or comments.

0
ProgrammingDEV Community ·

Developer Builds Free AI Meal Planner Using ASP.NET Core and .NET 10

A developer has created Smart Meal Planner, a free AI-powered web application designed to help users generate personalized weekly meal plans based on their individual goals, dietary preferences, and lifestyle. The tool was built using ASP.NET Core and .NET 10, technologies the developer uses in their regular work. The project was motivated by the everyday challenge of decision fatigue around meal planning, where too many choices often lead people to manually search multiple websites and compile shopping lists themselves. Key design principles behind the application include simplicity, speed, and a user-first approach where the AI adapts to the user's goals rather than the other way around. The developer noted that the project reinforced a broader lesson: AI does not need to tackle enterprise-scale problems to deliver meaningful real-world value.

← NewerPage 30 of 1000Older →