SShortSingh.
TopTechnologyAI & MLStartupsProgrammingScienceBusinessFinanceCrypto & Web3World

Programming

LatestTopDiscussed
0
ProgrammingDEV Community ·

Grafana SQL Expressions Flaw CVE-2024-9264 Lets Viewers Read and Write Files

A vulnerability tracked as CVE-2024-9264 affects Grafana's SQL Expressions feature in releases from 11.0.0 through 11.1.6, with a narrower range in the 11.2 line. When the feature is enabled and a DuckDB binary is discoverable on the server, a user with the lowest authenticated Viewer role can pass SQL to that binary. Because DuckDB supports file reading, writing, and extension loading, this can enable arbitrary file reads and, depending on the Grafana process's permissions, file writes. Vendor scoring rates the issue 9.9, though some third-party summaries list 9.4. Proof-of-concept code appeared soon after disclosure, and the article notes that files such as provisioning configs, database files, and secret mounts could expose credentials.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Two Agents, Two Worktrees: Separating Test Writing from Implementation in AI Coding

A DEV Community tutorial examines the problem that a single AI agent writing both code and tests produces tests that agree with its own implementation rather than with the specification. It describes existing approaches that split test writing and implementation into separate agents or contexts, such as subagent setups and prompt-based restrictions. The author proposes instead enforcing separation through git: one agent, Codex, writes tests from a spec alone on its own branch and worktree, and the commit is cherry-picked into a second worktree where Claude Code implements the code. Claude Code is blocked from editing test paths via a deny rule in its settings. A git diff can then show whether the tests were preserved unchanged.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

SlothScroll Uses Gemma to Digest Instagram Feeds Into a Daily Brief

A developer built SlothScroll, a morning digest that lets users avoid opening Instagram by summarizing the pages they follow. Each day a cloud browser visits those pages and Google's open-weight Gemma model writes a one-line gist for every post, assigns a topic, and filters out ads, reposts and giveaways. The result is a grouped web page and email edition highlighting the one to three posts worth reading, which takes about two minutes to review. The project runs on Browserbase, MongoDB Atlas and Render, and the developer described challenges including slow inference, which was reduced by setting minimal reasoning effort, and browser sessions timing out during full runs.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Discovery roadmap template: milestones, estimates and critical path

A software project roadmap written at the end of discovery is a table of milestones, each with dates, an effort range, dependencies and linked requirements, along with stated assumptions. It differs from a product roadmap, which covers strategic themes over quarters or years, while the discovery version stays concrete and covers the first release or two. The article recommends a seven-column table, with milestones named by the result they produce and tracked with a status column once building begins. Two checks help catch gaps: confirming every requirement maps to a milestone, and splitting any milestone that holds most of the effort. Finally, the critical path, the longest chain of dependent milestones, is identified because delays on it directly push back the release.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

SlothSort: Open-Source AI Tool Tidies Messy Folders Using a Local Gemma Model

A developer built SlothSort, a free tool that uses Google's open-weight Gemma 3 model, run locally through Ollama, to organize cluttered folders. The app reads file names and the opening lines of text files, then proposes folders and cleaner names for the user to review and approve before anything moves. It never deletes or overwrites files, logs each move so the last tidy-up can be undone, and keeps all data on the user's machine. In a test on 23 messy files, the tool took about three minutes to produce a plan on a laptop without a graphics card, compared with roughly 11 minutes of manual sorting. The developer noted it sometimes misfiled items, such as placing a boarding pass among invoices, because it cannot see the content of photos and PDFs.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

TGLoader 0.3.1 Skips Already-Downloaded Telegram Files on Repeat Runs

The article describes TGLoader, a free desktop app that archives media from Telegram channels to disk using the Telethon library and the user's own API credentials. Version 0.3.1 aims to fetch only new posts on later runs, though the author notes that only the read side of this incremental logic is fully wired, so the stored last-seen message ID is never saved. Duplicate prevention relies mainly on a per-channel metadata file that records completed downloads by Telegram's media ID, with a disk-size check as a fallback. Files are sorted into folders such as Pictures, Videos, Audio, Voice Messages, and Stickers based on the media attributes Telegram provides. The app runs on 64-bit Windows 10 or later and on Apple Silicon Macs.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

How to add JSON-LD structured data to Astro and Docusaurus sites

Structured data tells search engines what a page represents, such as an article with an author and date, or the organization behind a site, and Google recommends JSON-LD as the format for it. Developers should first check whether their framework already emits types like BreadcrumbList or BlogPosting, to avoid duplicate blocks. Hand-written JSON-LD often breaks on syntax errors, relative URLs, missing @context or @type fields, dates lacking time zones, or markup describing content not visible on the page. The article recommends auditing built HTML for missing blocks, testing templates with Google's Rich Results Test and the Schema Markup Validator, and monitoring Search Console after deployment. For large sites, it suggests an automated build step that generates valid, page-accurate markup.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Developer builds 59 free browser-based dev tools in vanilla JavaScript

A developer has created Antigravity Tools, a collection of 59 free utilities that run entirely in the browser. The project was built with no dependencies, no server, and no telemetry, so user data never leaves the machine. Tools rely on native browser APIs such as Web Crypto, Canvas, Web Audio, and IndexedDB rather than external libraries. The offerings include JWT decoding, key generation, PII masking, encoding and decoding, AI token cost estimation, JSON and cURL conversion, regex testing, and cron building. The author shares the project and the lessons learned along the way through a DEV Community post.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Gemma 4 pour une API de diagnostic de feuilles de maïs : un atelier pas à pas

Un tutoriel de DEV Community présente la construction en 45 minutes d'une petite API nommée AgriScan, qui reçoit la photo d'une feuille de maïs et renvoie un diagnostic au format JSON. Le projet suit un guide sur le développement assisté par IA, couvrant les fichiers de contexte, le rangement des prompts, la sortie structurée et les tests. La requête passe par FastAPI, puis par le modèle Gemma 4 de Google, appelé via l'API Gemini, avant que la réponse JSON ne soit renvoyée. L'article précise les prérequis : Python 3.11 ou plus récent, Git, une clé d'API Gemini gratuite et quelques photos de test. Le maïs n'est qu'un exemple, les lecteurs étant invités à remplacer ce cas par leur propre problème.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

München leads Germany's tech job listings, with Berlin second and remote roles scarce

München currently has the most open software developer jobs on XING with 275, followed by Berlin with 239, across the ten largest German job cities. Of 1,452 software developer jobs in those cities, 421 were posted or refreshed in the past seven days. Only about 10% of newly posted tech roles in the sample are fully remote, while roughly 53% are hybrid. Employers published a salary in just over a third of the ads, with the rest carrying only XING's estimated figures. The findings come from a report comparing XING and stellenanzeigen.de listings, which the author built using AI-assisted analysis.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

AI as Knowledge Infrastructure Raises Concerns Over Lost Source Traceability

An analysis published on DEV Community examines artificial intelligence as a new infrastructure for producing knowledge, shifting the task of verification from individuals to social epistemology. The author describes how AI systems merge scattered testimonies and sources into one smooth narrative. The central danger identified is the loss of epistemic provenance, meaning the ability to trace where an answer's evidence came from. This could produce a synthetic consensus that hides scientific uncertainty or disagreement among experts. The piece urges readers to separate semantic correctness from genuine cognitive value and to avoid overreliance on algorithmic synthesis of knowledge.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

EU customs product identifiers due 1 November 2026: many Shopify stores lack SKUs

From 1 November 2026, EU customs declarations for online consumer sales will require identifiers for each item, including a product code, a supplier code and a standard code such as a GTIN where available. For Shopify merchants, the variant SKU serves as the product code, so variants without a SKU or with duplicate SKUs are a problem. An analysis of public data from 1,071 live Shopify stores found that 50.3% of products had at least one variant without a SKU, and 79.6% of stores had at least one such product. Only 8.4% of stores printed a GTIN in their product structured data, though this figure is a lower bound because public feeds do not reveal barcodes. The author describes an Apify audit tool that can check SKU coverage across many stores in one run at low cost.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Germany's federal job board offers free JSON API; 821,306 open jobs reveal hiring patterns

The Bundesagentur für Arbeit's Jobsuche web app runs on a JSON API that can be called directly, and each response includes facet counts for the entire result set. The author queried it on 24 October 2026 and found 821,306 open jobs. Of these, about 2% were published in the past day, and roughly 26% are temporary agency postings. Five staffing or retail employers top the list of open postings, so analysts should filter agency listings before counting genuine hiring companies. About 27% of jobs state a pay figure, with wide variation by occupation.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Analysis questions whether a16z's Gen AI Top 100 exits signal real traffic decline

A DEV Community post argues that exits from a16z's Gen AI Top 100 list are often being misread as declining usage. The author compared the seventh edition with the sixth using web visits, mobile monthly active users, and first-revenue data. Many apparent exits were actually product renames, such as Freepik becoming Magnific, rather than true turnover. The author also suggests that drops among NSFW-focused apps may reflect changes in the list's methodology rather than falling demand. To test whether generator sites are gaining traction, the author pairs the roster with month-over-month visit trends.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Apache Tika PDF Parser Flaw Lets Crafted XFA Blocks Trigger External Entity Resolution

A critical vulnerability, tracked as CVE-2025-66516 and rated 10 on CVSS, affects Apache Tika's PDF parser. Crafted XFA content in an uploaded PDF can make the parser resolve an external XML entity, potentially reading local files or making outbound requests from the host. The flaw supersedes an earlier, narrower report, CVE-2025-54988, and affected versions depend on which module parses PDFs, so checking a single dependency is insufficient. A related record, CVE-2026-66755, covers releases below the later fix line in the core and alpha branches. Remediation advice includes upgrading all relevant artefacts, disabling external entity and remote schema resolution for XFA handling, sandboxing extraction without network egress, and stripping XFA payloads where workflows do not need them.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Testing iOS Push Notifications on a Real Device with APNs and Node.js

The iOS Simulator cannot catch production push problems because it never contacts Apple's servers, so a real device is needed for accurate testing. The guide explains how to enable the Push Notifications capability in Xcode and log the device token from the app. It warns that tokens from Xcode builds are sandbox tokens while TestFlight and App Store builds use production tokens, a common cause of push failures. It also describes creating an APNs .p8 authentication key in the Apple Developer account, noting that the key does not expire and that the environment choice cannot be changed later. Finally, it shows how to structure a JSON payload and send it through APNs using a short Node.js script with HTTP/2 and a signed JWT.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Developer ships hourly cron script instead of AI agent for review monitoring

A developer was asked to build an autonomous AI agent to monitor a founder's Google reviews around the clock. Instead, they built a simple cron job that runs hourly, sends each new review to a language model once for classification, and posts negative reviews to Slack. The author argues that the task has fixed inputs, a fixed schedule, and a fixed output, so no agent framework, memory, or reasoning loop is needed. The system consists of just two moving parts that are easy to read and debug, and it costs very little to run. The post suggests building a true agent only when a task requires branching decisions, tool selection, or memory across steps.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

LazyMate AI: Open-Source Productivity Assistant With Optional Local AI Models

A developer has released LazyMate AI, a lightweight open-source productivity website built with HTML, CSS, and JavaScript. It offers task management, note summarization, step-by-step action plans, and priority focus, with tasks saved in browser storage. An optional local AI mode connects to open-weight models such as Gemma through Ollama, so notes can be processed on the user's own computer rather than a hosted API. The project includes a demo mode using rule-based fallbacks, which the author notes are not AI-generated. The creator presents local processing as offering greater data control, model flexibility, and lower recurring costs, while acknowledging hardware and setup requirements.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Teams' most dependable staff often conceal their broken processes

Many teams rely on one reliable person to quietly handle recurring failures such as broken invoice imports, faulty monthly reports, and stalled customer orders. That person's competence often keeps the underlying process problem from being fixed, because the cost falls on one individual rather than being visible to the organization. The problem becomes obvious when that person is absent, since the workarounds were never documented and exist only in their head. The article recommends asking staff what they repeatedly fix that should not need fixing, which surfaces hidden maintenance costs that add up over time. Writing down each recurring fix, with its frequency and effort, makes the cost visible so it can be weighed against the expense of a proper repair.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

CISA Certification Focuses on Judging IT Controls Rather Than Building Systems

ISACA's Certified Information Systems Auditor (CISA) credential is aimed at IT professionals who evaluate whether systems were built and run correctly, a skill often rewarded with higher pay. The exam is scenario-based and grades judgment rather than technical configuration, covering five domains weighted from 12% to 26% each. It consists of 150 multiple-choice questions over four hours, with a passing score of 450 on a 200–800 scale. Test-takers are advised to prioritize independence, risk-based thinking, and business impact, and to recognize that compensating controls and audit follow-up matter. Exam fees vary and should be confirmed with ISACA at registration, where members generally pay less.

0 comments Read more at DEV Community
← NewerPage 42 of 2884Older →