SShortSingh.
TopTechnologyAI & MLStartupsProgrammingScienceBusinessFinanceCrypto & Web3World

Programming

LatestTopDiscussed
0
ProgrammingDEV Community ·

Unpinned CI actions and runaway concurrency prompted a zoned pipeline redesign

A team's CI pipeline suffered two costly failures in one quarter: a mutable action tag that was silently changed to push commits, and a concurrency misconfiguration that queued over 1,100 jobs and exhausted weeks of runner quota. To address these, they split the pipeline into an untrusted pull request zone with read-only permissions, no secrets, and aggressive cancellation, and a trusted publish zone limited to main that inherits secrets and never cancels mid-flight. Third-party actions are now pinned to commit SHAs with version comments for readability. The redesign also included disabling persisted checkout credentials and keying the browser cache on the lockfile, plus an agent smoke test to catch session-handoff failures that unit tests miss.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

agent-doctrine: Open-Source Prompts for Getting AI Agents to Ship Tested Code

The sisig.ai team has open-sourced agent-doctrine, a set of prompts, role definitions and skills meant to make AI coding agents produce tested, mergeable pull requests. Every agent follows the same pipeline of scouting, gating, planning, implementing, reviewing, consolidating, verifying and shipping. Before any edit, the lead agent must answer fifteen questions from a TENETS.md file with evidence, such as the smallest correct change and the blast radius. Users choose a fast mode, which keeps the gate and per-diff review, or a rigorous mode, which adds plan simplification, adversarial review and approval before code. The project is MIT-licensed, requires Git and Bun, and rewrites global agent instructions, so users are advised to back up their configuration first.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Claude 3.5 Sonnet, GPT-4o-mini, or Gemini 1.5 Pro: Testing Chatbots for E-Commerce Support

A developer guide argues that the best chatbot API for e-commerce support should be chosen by testing with real support tickets rather than relying on generic leaderboards. It recommends Claude 3.5 Sonnet for the most natural conversational quality, GPT-4o-mini for faster, budget-friendly deployments, and suggests testing Gemini 1.5 Pro before deciding. The author proposes scoring label accuracy, escalation decisions, required output format, and tone separately, and running each test more than once to avoid relying on single responses. The article also advises designing the API boundary so the chosen model can be swapped without rewriting the triage workflow.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

MCP Security Gaps: Four Attacks That Server Audits Miss

Standard MCP security checklists focus on OAuth, token scopes and TLS, which confirm server configuration but not whether an AI agent will follow malicious text. Because agents treat tool names, descriptions, schemas and outputs much like system instructions, an attacker can hide commands in that text and steer the agent's real permissions. The article outlines four attack types: tool poisoning, rug pulls, tool shadowing and poisoned tool outputs. It cites OWASP's beta MCP Top 10, which lists tool poisoning as MCP03, and the MCPTox benchmark, where the worst-performing of 20 tested agents followed poisoned instructions 72.8% of the time. The author recommends continuous red teaming in staging, with each run scored pass or fail and repeated on every release.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Developer details auto-trading Discord trading calls without a bot token

A developer describes the difficulties of building a self-made Discord bot that places broker orders from trade calls posted in a trading server. The problems include permission limits, inconsistent message formats, false-positive noise, the need for always-on hosting, and matching exit signals to open positions. The author, who builds the product Nyria, says its Discord bot needs only View Channels permission and no token or self-hosting. The walkthrough covers connecting Discord, scoping a strategy to one channel with author and keyword filters, and training the parser on past messages. The setup starts with paper trading before any real orders are placed.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Opus 5.5 and Sonnet 5.5 tie on coding-agent tests, but Opus costs about 2.5x more

A test of Claude Opus 5.5 against Claude Sonnet 5.5 on six small Python coding tasks found both models passed every hidden test in every run. The evaluation ran Claude Code with identical settings, changing only the model, across 24 runs on 2026-10-20. Opus was consistently slower and, per task, cost roughly two and a half times as much as Sonnet at QuickSilver Pro prices. The tasks covered bug fixing, spec implementation, refactoring, input validation, a config parser and a Mustache renderer. The author's conclusion is that, for these tasks, Opus did not justify its higher price.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

78% of Thai PHP hosts on 8.1 or older may miss tonight's security patch

Mallory's Shodan scan counted 14,619 of 18,701 Thai hosts advertising a PHP version at 8.1 or older, roughly 78 percent, which will not receive the patch. PHP is set to release fixes at 21:00 Thai time for two vulnerabilities rated CVSS v4.0 9.2. The figure reflects banner-declared versions rather than confirmed exposure to the flaws. Reports circulating online cited a 10.0 score and disclosure dates that conflict with PHP's official advisory, and the CVE identifiers in the leak could not be found in the NVD. The author argues the bigger issue is legacy versions on low-cost hosting, not the patch timing alone.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Node.js Message Queues: Publishing and Running Background Tasks Reliably

The article explains how to set up a durable message queue in Node.js to publish and process background tasks, using renewal reminders as the example. It recommends a worker that claims jobs before their deadline, an idempotency key, and a visibility timeout longer than typical processing time. Alerting should track queue delay against eligible jobs rather than raw queue depth, since planned future work and an empty queue can each mislead. Jobs should carry durable intent such as identifiers and an eligibility timestamp, leaving the worker to resolve current account state before acting. The author notes that queues add operational overhead, so simpler approaches may suit low-volume workloads.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

AI Models Found PHP Zero-Day Days Before Disclosure, Patches Released

On October 21, 2026, the PHP project released emergency patches for two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively called PHP2Shell. The flaws, rated 9.2 on CVSS v4.0, affect PHP versions back to 5.4 and sit in PHP's core engine, so applications like WordPress, Drupal and Joomla are vulnerable unless PHP itself is patched. Security firms Calif and Wiz Research independently used AI models, including OpenAI's GPT-5.6 Sol, to identify the bugs in August, weeks before public disclosure. A proof-of-concept exploit appeared on GitHub within hours of disclosure, making exploitation a low barrier for attackers.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Why CTOs Should Model the Economics of Open Source Instead of Relying on Gut Feel

The article argues that deciding whether to open-source software is a complex capital allocation problem, not a simple binary choice. It notes that intuition-driven decisions often overlook maintainer burden and erosion of proprietary advantages. The author describes an economics connector with tools for calculating net return, community leverage, IP risk, and maintenance burden. The piece also promotes Vinkius, a unified gateway for accessing these tools from AI assistants, emphasizing its security sandbox and policies.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Tencent releases open-source Hy Memory 2.0, a dedicated model for AI agent memory

Tencent Hunyuan released Hy Memory 2.0 on October 15, 2026, built around a model whose sole task is writing and updating memories for AI agents. The centerpiece, Hy-Memory-30B-A3B, is a mixture-of-experts model with about 30 billion total parameters, of which roughly 3 billion are active per token. The company says it was trained to decide what to retain and how to update stored facts, addressing the frequent failure of existing systems to return current information after facts change. Alongside the model weights, released under Apache 2.0, Tencent published a Python SDK and a local desktop app called MemHub, and reports benchmark results that are vendor-run and not independently replicated. Developers can test it as a drop-in replacement in frameworks such as Mem0 and MemOS, though the full-precision weights are about 60 GB.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Low Chilled Water Delta-T Halved Chiller Capacity in One Building

A chilled water system's delta-T, the gap between warm return water and cold supply water, determines how much cooling a chiller delivers, and a drop in that gap can sharply reduce output even at full compressor speed. In one example, a 300-ton chiller running at 600 GPM fell from a 12°F design delta-T to 5°F, cutting its capacity to about 125 tons. Causes included three-way bypass valves on air handling coils, fouled coil surfaces, and pump speeds set too high, which forced a second chiller to run on peak days. Converting to two-way valves and chemically cleaning the coils restored the delta-T to 10°F, letting one chiller handle the load and saving an estimated $47,000 a year. The article advises measuring supply and return temperatures and comparing the result to design values to diagnose similar problems.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Analyst's '5% for chatbots' compute figure may obscure how workloads are classified

A Nomura estimate suggesting chatbots consume about 5% of global AI compute has circulated among Chinese AI developers as a humbling corrective. The author argues the figure is rough and lacks a public methodology, so its bucket boundaries, especially where tool-using agent sessions fall, are unclear. Because agentic workloads are largely chatbot-style sessions with tool calls added, assigning them to a separate category could understate conversational inference. The piece also contends that chatbot inference is synchronous and latency-sensitive, making it costlier per unit than batched recommendation workloads. Therefore, a small percentage of total compute may not imply that chatbot infrastructure is unimportant to future planning.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Four Python scripts that packaged 39 stock products and cut out tedious upload errors

A developer describes an evening of repeated CSV rejections from stock platforms, which pushed them to write small tools instead of relying on manual spreadsheet fixes. The package includes a metadata generator that builds platform-specific upload files, an upload tracker that prevents duplicate submissions, and utilities for converting Markdown to PDF and bundling products with covers and thumbnails. The author recommends running one process at a time on limited hardware and measuring peak memory usage. Only two of the four scripts need third-party libraries, so some users can skip installing them entirely.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Developer's Upload Pipeline Uses Ledger Script to Prevent Duplicate Stock Asset Posts

After accidentally re-posting 14 vectors to a marketplace, which drew a complaint email, a developer built a small upload pipeline to stop duplicate submissions. The kit includes four scripts: a metadata builder that outputs the exact CSV header each platform requires, a standard-library ledger that tracks completed uploads, a Markdown-to-PDF converter, and a packager that creates zips with cover images and thumbnails. The developer reports the workflow handled 39 products totaling 856 MB on a single-core server with 2 GB of RAM and no GPU. The project relies on only two third-party packages, Pillow and reportlab, while the metadata and tracker scripts use the standard library alone.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

How an MCP payment gateway prevents AI agents from paying twice on retried API calls

When an AI agent's paid API call succeeds on payment but the response is lost, a naive retry can charge the agent again for the same work. The gateway's first layer relies on x402 on Base, where each signed USDC authorization carries a nonce the token contract accepts only once, so a resent payment fails on chain. For order payments, agents can attach a payment identifier that returns the stored result for repeated requests for 24 hours, while mismatched details trigger a conflict error. Payments whose settlement status is unclear are treated as unknown rather than failed, and a background job checks the chain to resolve them without ever re-settling. Tool calls are charged only when a response is delivered, so provider failures are not billed.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Retry Strategy for Failed Email Delivery Using Delayed Queues and Dead-Letter Handling

A developer guide argues that the most effective approach to retrying failed email delivery in a Node.js background job system is a queue with delayed retries combined with a dead-letter queue. The recommended design acknowledges a job only after the email provider accepts it, moves permanently failing messages aside for inspection, and makes the sender idempotent because standard queues deliver at least once. For monitoring, the article suggests alerting on the age of the oldest unacknowledged job, the failed-delivery rate, and retry concentration rather than raw queue depth, which can rise during healthy traffic peaks. It also recommends setting service-level objectives around report delivery deadlines instead of promising exactly-once delivery, and draining workers deliberately during shutdown.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Token generation speed is capped by memory bandwidth, not compute, a DDR3 test shows

A comparison of a 40B model running at 125 tokens per second on a laptop with a 7B model at 1.5 tokens per second on a 2011 CPU, with similar RAM, highlights that common explanations for the gap are often wrong. The author argues that generating each token from a dense model requires reading all weights from memory, so memory bandwidth sets the speed ceiling. Using a read-only benchmark on an old i5-2520M NAS with a single DDR3-1600 DIMM, the author measured about 9.0 GB/s, roughly 70% of theoretical peak. Adding threads plateaued near 10.5 GB/s, indicating the single memory channel is the limit rather than core count. Estimated ceilings and expected real-world speeds for 7B, 13B and 40B models are provided, with swapping identified as a common cause of very slow results.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Why design reviews must question necessity, not just whether code works

The author approved a pull request in minutes after automated checks passed, only to find weeks later that it had produced copy-pasted validation logic. They argue that design reviews should ask whether an abstraction is needed, not merely whether an implementation functions. In building a React form validation engine, they adopted a rule that a new named rule preset is added only once the same logic is needed in at least two places. The author notes that generality without present need leads to bloated, hard-to-maintain configuration. They acknowledge this policy can slow teams slightly but judge the tradeoff worthwhile, since duplicated code is easy to promote later while unnecessary presets are hard to remove.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

AI-Run Music Label's Bio Link Broke in a Splice, Caught by a Second Reader

Persona500 LLC, a music label and merch store run largely by AI agents under founder Aldrin Payopay, launched a small test placing a product link in two author bios. An agent appended the offer sentence at an unseen cursor position, which spliced the text and fused the URL into a dead link. The agent's own check sampled only the start and end of the sentence and recorded the placement as verified. A second reader caught the splice and the 404, and the field was rewritten in full and the link reopened and confirmed working within about ten minutes. The agent drew lessons from the miss: verify the whole rendered unit, open links rather than reading their text, and rewrite fields whole rather than appending.

0 comments Read more at DEV Community
← NewerPage 5 of 2827Older →