SShortSingh.
TopTechnologyAI & MLStartupsProgrammingScienceBusinessFinanceCrypto & Web3World

Programming

LatestTopDiscussed
0
ProgrammingDEV Community ·

Telegram Stars refunds: how bots should handle the 21-day window before paying out

Bots that sell irreversible goods such as crypto or gift cards for Telegram Stars face losses when buyers request refunds or file chargebacks. Telegram's developer terms say Stars may take up to 21 days to become available, and chargebacks are deducted from the bot's balance. The recommended approach is to hold payouts through that window and detect refunds by polling getStarTransactions, since no chargeback webhook exists. Refunds can be matched to orders using the payload or the charge ID, with ambiguous matches left for manual review. Holds should also show users an exact release date so they do not look like a scam.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Inference Efficiency, Not GPU Count, Drives Large Model Performance

The AI industry has focused heavily on larger models and more GPUs, but the article argues that how efficiently those resources are used matters just as much. Serving a large language model involves scheduling requests, managing memory, coordinating devices, caching, and keeping costly hardware busy. Techniques such as disaggregated inference, mixture-of-experts parallelism, dynamic load balancing, and speculative decoding can substantially lower serving costs, and DeepSeek's approach is cited as an example. Inference splits into a compute-heavy prefill phase and a memory-bandwidth-limited decode phase, which can be separated onto different hardware pools for independent scaling and better utilization.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Three read-only checks to run on your computer before letting an AI assistant near your files

The article advises new users to begin with read-only tasks, such as examining disk usage, system health, and backup comparisons, before allowing an AI to make any changes. For each task it provides manual commands for Windows and macOS/Linux so readers can verify results themselves. It also explains how an AI assistant can perform the same checks through plain-language requests and return a summarized answer. The author notes practical pitfalls, such as scans taking minutes on large disks and macOS reporting only the small system volume. The piece emphasizes that any deletion should be a separate step taken only after explicit approval.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

SBOM generation for cloud workloads hinges on operating contracts, not just tools

The article argues that the costly failure in SBOM generation for modern cloud workloads is usually a missing operating contract rather than a missing tool. It stresses defining the owner, consumer, support boundary, change policy, and recovery objective before choosing implementation details. Recommended measures include control coverage, policy exceptions, credential lifetime, remediation latency, and provenance verification, with short-lived identity and signed provenance enforced as code. The piece advises rolling out controls to one representative service first, treating exceptions as expiring decisions, and keeping a small mandatory safety core around replaceable choices. It also warns against ceremonial approval gates and untested reference architectures.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Hacker breaches LiteLLM via unrevoked key and publishes malicious software update

An attacker exploited a master key that had been accidentally published in a public LiteLLM repository and never revoked, gaining access to the project's release pipeline. Using an administrator access key obtained through that breach, the intruder pushed a tampered version 1.107.0 to PyPI and container registries on October 21, 2026. The malicious release was designed to launch automatically when Python started, carrying a credential-stealing tool and a backdoor for Unix systems. Security researcher Lidor Machluf of Upwind detected the attack, and distribution platforms quarantined or removed the infected files within a few hours.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Fixing Broken Arabic Text in Browser-Generated PDFs Without a Server

Arabic text often breaks in PDFs created or copied in the browser, with letters disconnecting and words appearing reversed. The root causes include presentation-form glyphs stored in place of base Unicode characters, visual rather than logical glyph ordering, and split ligatures during extraction. The article outlines a three-step JavaScript repair: NFKC normalization, bidirectional run splitting with reordering of Arabic segments, and rejoining artificially split letters. It also recommends embedding Arabic fonts with proper ToUnicode mappings and performing shaping in a Web Worker so ATS parsers can read the text accurately. The author's CareerPDF suite implements these methods in client-side tools that run without uploading files to a server.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Exposed Flink dashboards can enable job submission; search counts are not exposure estimates

An analysis of ZoomEye search results for Apache Flink dashboards found tens of thousands of fingerprint matches, but the author argues these counts measure query design rather than how many dashboards are truly exposed. The Flink Web UI goes beyond read-only monitoring, allowing job submission, savepoint triggering, and access to job graphs, checkpoints, and configuration. Because port 8081 is only a default, deployments behind ingress controllers or with relabeled titles can evade the port and title-based searches. Scanner results also show what a service presents rather than whether it requires authentication, so matches cannot confirm access control. The main risk is job-level compromise, since an attacker who can submit a job can run code inside the cluster with access to its connected resources. Operators are advised to check their own public hosts for Flink fingerprints and verify whether the dashboard requires login.

0 comments Read more at DEV Community
0
ProgrammingHacker News ·

AI-Assisted Paper on Z-Library Cites Nonexistent TorrentFreak Article

A research paper about Z-Library, the shadow library platform, reportedly included a reference to a TorrentFreak article that does not exist. The fabricated citation has drawn attention to the risks of using AI tools to assist in academic writing. The issue was surfaced through a post on Hacker News linking to a TorrentFreak report on the matter. The article text itself was limited to the link and discussion metadata, so the full details of the paper and its authors are not available here.

0 comments Read more at Hacker News
0
ProgrammingHacker News ·

Node.js Publishes Blog Post on a Security Vulnerability

The Node.js project has published a post on its official blog addressing a security vulnerability. The item was shared on Hacker News, where it has received a small amount of attention. The available source material provides only the article link and basic engagement metrics, without details on the flaw's technical nature or severity. Readers seeking specifics would need to consult the original Node.js blog post directly.

0 comments Read more at Hacker News
0
ProgrammingDEV Community ·

Exposed CI build servers threaten credentials; Jenkins patches five Script Security sandbox escapes

Build servers such as JetBrains TeamCity and Jenkins hold deployment credentials, registry tokens, signing keys and repository write access, making them high-value targets. Internet scans on 23 October 2026 found 1,890 TeamCity instances on ZoomEye, with 792 served over TLS. On 16 September 2026, Jenkins disclosed five Script Security Plugin vulnerabilities, rated 8.8 or 7.5, that allow sandbox escapes by users permitted to run sandboxed scripts. Because such users can execute code on the controller if a sandbox gap exists, the article argues that limiting who holds pipeline-definition permissions and verifying plugin versions against advisories are key defenses. It also notes that incident reconstruction is hard by default, since build logs and agent output may not capture what the controller executed.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Team's Product Stalled at Two Daily Clicks, Prompting Shift to Post-Launch SEO Fixes

After their first product, Versely, received only about two Google clicks a day, the team focused on basic SEO repairs rather than launch-day promotion. They corrected canonical tags that were signaling search engines to ignore pages and rewrote titles to match real search queries. Over the following three months, Google impressions reportedly grew to 168,000. The team then packaged this approach into LaunchRanked, a tool offering a free weekly launch board, directory submission services, and AI visibility tracking. The post's author discloses they work on LaunchRanked.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Running many AI agents at once: the failure points that surface first

A dozen parallel agents sharing one codebase, database, and API budget create an operations problem more than a modeling one. The article expects collisions over shared files or rows, unchecked token spending from retry loops, and rate-limit errors that appear random when many agents hit them together. It also flags silent agent failures and drift when agents interpret a goal differently, and warns that reviewers can be overwhelmed as output outpaces human checking. The suggested remedies are isolated workspaces, per-agent budgets, queued and backed-off API calls, required status reports, and a single shared goal document. The author presents this as a checklist of anticipated problems rather than a measured study, and recommends scaling up only after a small setup runs reliably.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Five Email Scripts Freelancers Can Use to Decline Unpaid Scope Creep

Scope creep usually begins with small, informal requests from clients rather than one large change. The article argues that repeatedly agreeing to these add-ons can significantly reduce a freelancer's effective hourly rate. Instead of refusing outright, the author recommends offering a priced add-on or a later phase as an alternative. Five copy-ready email templates are provided for handling extra revisions, tying handoff to final payment, adjusting scope to fit a budget, and pausing projects with stalled assets. The piece also promotes the author's own calculator, a free cheat sheet, and paid resource packs.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

One pasted file can raise a chatbot API call from $0.006 to $2.03

A developer priced a typical support-bot request on Claude Sonnet 5.5 at about $0.006, but the same endpoint will accept a request costing $2.03 when a user pastes a large file. Costs are billed per token, and the worst case is set by the context window size multiplied by input prices, plus the output cap. Common triggers include users pasting log files, bugs repeatedly appending documents to prompts, and search steps passing whole files. Token counts also vary by content, with logs producing far more tokens than the usual four-characters-per-token estimate. The analysis found that the cost multiplier tracks the context window rather than the per-token price, so upgrading to a larger-window model can raise the worst-case cost even while lowering the price per token.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Why a top-level CEO agent helps with task breakdown but fails through rigid planning and loops

A DEV Community article examines the 'CEO agent' design, where one coordinating agent sets a goal, splits it into tasks, delegates them to specialists, and judges completion. The author notes its appeal in decomposing large work, but warns it can plan once and never revise, grade its own team's output, loop endlessly on failures, and obscure evidence behind summaries. The recommended fix is a thin coordinator that reads brief status reports, relies on independent checks for quality, enforces task, time, and retry caps, and escalates costly decisions to humans. The piece is a design discussion rather than a report on any specific deployment.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Why AI agent teams break at the handoffs, and how to design them

A common approach assigns AI agents distinct roles such as researcher, developer, reviewer, and coordinator, but the article argues that sustaining this over real work is hard. Most failures occur between agents rather than within them, especially when handoffs pass summaries instead of artefacts or omit context. The author recommends giving each role a single job with a defined, checkable output format. Permissions should be enforced through the tools agents can call, not just through instructions. A coordinator needs limits such as reassignment caps and time budgets, and should report evidence rather than summaries. Teams are advised to start with two roles and one reliable handoff before adding more agents.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

LCP چیست و چگونه می‌توان Largest Contentful Paint را بهبود داد؟

این مطلب توضیح می‌دهد که Largest Contentful Paint یکی از سه معیار اصلی Core Web Vitals است و زمان رندر شدن بزرگ‌ترین عنصر قابل‌مشاهده صفحه را می‌سنجد. هدف استاندارد این است که این معیار در صدک ۷۵ بازدیدهای واقعی، برای موبایل و دسکتاپ جداگانه، حداکثر ۲.۵ ثانیه باشد. نویسنده تأکید دارد که کاهش حجم تصویر همیشه راه‌حل نیست و علت تأخیر می‌تواند پاسخ دیرهنگام سرور، کشف دیرهنگام تصویر یا تأخیر در رندر توسط JavaScript باشد. برای تحلیل دقیق‌تر، پیشنهاد می‌شود عنصر LCP را با ابزارهایی مانند Lighthouse و Chrome DevTools شناسایی و زمان آن را به بخش‌های مختلف تقسیم کنید. سپس بر اساس علت واقعی تأخیر، راه‌حل متناسب را انتخاب کنید.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Developer verifies OpenAgentForum signed messages using only Node's built-in crypto module

An autonomous agent tested OpenAgentForum, a platform that claims authorship there is a cryptographic signature rather than a login session. Running a diagnostic tool showed the hub reachable, and a single command created an identity via a local key file with no form, email, captcha, or password. The author's first message was then read back from the hub, showing a per-agent sequence number, a shared hub-wide stored sequence, a SHA-256 checksum, and an Ed25519 signature over pipe-joined fields. Because these rely only on primitives that Node already ships, the author argues anyone can independently verify messages without trusting the platform. The article also reports the author found a bug that broke the envelopes.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Android AI app discloses it sends first-message text to a small model for chat titles

A developer of Kryzz AI, an open-source Android chat app, revised its privacy documentation to disclose an overlooked data flow. When a new chat starts, the app sends up to 1,500 characters of the first message to Gemini 2.5 Flash Lite through the user's OpenRouter key to generate a title. The request runs in parallel with the main answer and falls back to a local title if it fails. The developer said the extra request is not hidden infrastructure, but notes users who picked a provider for privacy reasons should know about it. The README now lists what stays on the device, what leaves it, and what is disabled, and the developer is considering a setting to turn auto-titles off.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

SlothJudge: Open-Source AI Tool Aims to Ease Competitive Programming Debugging

A developer has introduced SlothJudge, an AI-powered debugging assistant intended to help competitive programmers investigate failing C++ solutions. The tool builds on the creator's existing Online Judge project and is designed to suggest possible causes of failures, generate tricky edge cases, and propose minimal fixes. Its goal is to explain bugs rather than automatically supply complete solutions, keeping the programmer in control of the final implementation. The planned system uses a web frontend, a Node.js and Express backend, and Ollama to run Google's open-weight Gemma model locally. The article notes that the demonstration video, live deployment, and AI-specific repository are still placeholders awaiting completion.

0 comments Read more at DEV Community
← NewerPage 35 of 2880Older →