Programming

OpenNVR Lets Developers Build AI-Powered Apps Around Security Camera Feeds

OpenNVR is an open-source, self-hosted platform that reimagines security cameras as programmable sensors rather than simple recording devices. The project features an AI adapter architecture, allowing developers to plug in different models for tasks such as object detection, license plate recognition, and scene understanding without locking the system to a single AI provider. An accompanying App SDK enables developers to build custom workflows that respond intelligently to real-world events captured by cameras. Because video processing and AI inference remain within the user's own infrastructure, the platform is particularly suited for privacy-conscious computer vision and edge AI experimentation. The project is available on GitHub and its official site at opennvr.org.

JavaScript Closures Explained: Scope, State, and Why Developers Should Care

JavaScript closures allow inner functions to retain access to variables from the scope in which they were created, even after the outer function has completed execution. This behavior stems from lexical scoping and enables functions to preserve their surrounding environment rather than copying individual variables. Closures are widely used in callbacks, event handlers, factory functions, and asynchronous code throughout modern JavaScript. A practical application is encapsulating private state, where methods exposed by a function can modify an internal variable without ever exposing it directly. Understanding closures helps developers write cleaner, more predictable code and makes common JavaScript patterns easier to design and debug.

Rate-Limit Failed Logins Without Locking Out Victims

Liquid syntax error: Unknown tag 'endraw'

Token Bucket vs Sliding Window: How APIs Choose the Right Rate Limiting Algorithm

Rate limiting controls how many requests a client can make within a set period, protecting backend capacity, shared resources, and even the clients themselves. The basic fixed-window counter has a well-known flaw: clients can double up requests across window boundaries, effectively bypassing the stated limit. The token bucket algorithm addresses this by maintaining a pool of tokens refilled at a steady rate, allowing short bursts from idle clients while smoothing overall traffic flow. Sliding window counters take a different approach, measuring requests over a rolling time period rather than fixed calendar intervals, which eliminates the boundary-exploit problem at the cost of slightly more complex implementation. Choosing between the two depends on the use case: token bucket suits backend protection with bursty traffic, while sliding window better fits scenarios requiring strict, auditable request counts.

How FlowBoard Used an AI Agent to Cut 3-Day Backlog Reviews Down to 1 Hour

FlowBoard, a product management tool, developed an AI-assisted workflow to tackle its growing idea backlog, which had accumulated 140 unreviewed submissions — some over 18 months old. The system uses an MCP server to let AI assistants like Claude read and interact with the board, scoring each idea, flagging duplicates, and drafting rejection or acceptance rationale one at a time. Crucially, the agent pauses after each recommendation and waits for human approval before posting anything, ensuring no automated messages are sent to submitters without oversight. The team deliberately kept humans in the loop because rejecting an idea is a direct message to a real user, and unsupervised errors could alienate key customers. A customisable Markdown rubric guides the agent's judgement with company-specific priorities, and the team refines it whenever they disagree with a recommendation — reducing a three-day task to roughly one hour.

Why AI Agents Need Workflow-Level Idempotency to Prevent Duplicate Actions

AI agents are more prone to creating duplicate real-world actions than traditional apps because they operate under uncertainty and retry by default after timeouts, worker restarts, or planner loops. Unlike a human who consciously decides whether to resend a request, an agent receiving an ambiguous HTTP failure often cannot determine if the original action — such as a payment or email — was already completed. Effective idempotency for AI agents requires a layered approach combining stable operation IDs, API-level idempotency keys, and read-before-write checks, rather than relying on any single control. Event deduplication is also critical after writes, as webhook replays and queue redeliveries can reopen closed work if processed event IDs are not stored. Common failure points in production include TTL gaps, regenerated keys, weak audit logs, and missing compensating actions for partial successes.

Developer Shares Daily AI Coding Workflow Using Cursor, Claude, and Voice Input

A software developer working primarily with Angular applications has outlined a set of AI-assisted coding habits built around the Cursor editor and multiple AI models. The workflow includes installing Angular-specific agent skills to guide code generation toward framework best practices and consistent output. The developer uses voice dictation for prompting agents, finding it faster and less error-prone than typing detailed instructions. A two-model review process is also employed, where a lighter model like Grok handles initial implementation and Claude Opus evaluates the result for simplicity and necessity. While the approach improves efficiency for many tasks, the developer notes it works less reliably on complex features where an early directional choice can require significant cleanup later.

How to Fix Stripe Webhook Signature Failures When Replaying Dead-Letter Queue Events

Stripe webhook signature verification includes a 300-second replay protection window, which causes legitimate dead-letter queue replays to fail if the event is held longer than five minutes. The SDK checks both cryptographic authenticity and timestamp freshness, making delayed replays indistinguishable from malicious replay attacks. Common workarounds — such as skipping verification on retried events or extending the tolerance window to 72 hours — introduce serious security vulnerabilities that can be exploited to forge billing events. The recommended fix is a two-stage architecture that separates ingress verification from internal delivery: an ingress proxy verifies the original Stripe signature immediately and stores the payload durably, then re-signs it with a fresh timestamp before forwarding to downstream handlers. This approach preserves full replay protection while allowing delayed retries to pass standard signature verification without any code changes in the application layer.

MCP, Apify, or Custom Agents: A Developer's Guide to Choosing the Right LLM Tool

Developer Marek Cziba outlines the key differences between three approaches teams use to give LLMs the ability to act: MCP servers, Apify actors, and custom agents. MCP (Model Context Protocol) is best suited for exposing deterministic, single-call capabilities to multiple AI clients through one standardised integration. Apify, a hosted cloud platform, is the stronger choice for large-scale web scraping tasks where proxy networks, browser automation, and bot-detection handling are required without building that infrastructure in-house. Custom agents — developer-owned code loops that call LLMs and execute logic iteratively — are recommended when workflows involve multi-step decisions, stateful business rules, or complex orchestration that neither MCP nor Apify supports natively. Cziba stresses that the three tools are not interchangeable, and selecting the wrong one can cost weeks of rework, while the right choice can deliver a working product in days.

This rating is better aligned with results i actually get on real codebases than others.

Practice Python in Your Browser Without Any Local Setup or Installs

Many beginners waste time on installation and configuration before writing a single line of Python code, according to a guide published on DEV Community. The article argues that consistent, small practice exercises with immediate feedback are more effective for learning than lengthy tutorial courses. It recommends a daily 30-minute routine broken into warm-up, focused problem-solving, and review phases, progressing from variables and conditionals to functions and data structures. The author has built PySchool.ai, a browser-based platform featuring a built-in Python editor, visible tests, and an AI tutor that provides hints rather than full answers. The platform is accessible on any device without admin rights, and several beginner modules are available free without logging in.

X++ Code Sample Shows How to Automate GRN Import in Microsoft Dynamics 365

A developer on DEV Community has shared an X++ code snippet demonstrating how to programmatically generate a Goods Receipt Note (GRN) in Microsoft Dynamics 365 Finance and Operations. The solution uses a custom service class, AT_GRNImportService, with a generateGRN method that accepts a purchase order ID as input. The code automates the posting of a packing slip by building parameter tables and lines, then invoking the PurchFormLetter framework to complete the posting. Each purchase line is processed in a loop, with a receive quantity set before the form letter is executed. The snippet is intended as a reusable utility for developers looking to import or automate GRN processing via code rather than manual UI interaction.

A single wildcard redirect rule can silently kill your best-ranking pages

When websites migrate content, developers often use wildcard redirect rules to handle hundreds of old URLs in one line, but this shortcut can unintentionally capture live, high-performing pages. A 301 redirect signals to Google that a move is permanent, causing it to drop the old URL from its index and transfer its ranking to the destination page within weeks. Because the redirect technically succeeds and returns a valid response, standard monitoring tools show no errors, making the problem invisible until traffic or sales drop noticeably. The core issue is that wildcard patterns match URLs by shape alone, not by whether the target page is still active or valuable. Developers are advised to write more precise redirect rules and use command-line tools to verify which URLs a rule captures before deploying it to a live site.

F-Droid 2.0 Launches Amid Google's New Android Sideloading Verification Rules

F-Droid 2.0, a ground-up rewrite of the popular open-source Android app store, was released on September 24, 2026, after over a year of development and 14 public test releases. The new client transitions to Kotlin and Jetpack Compose, introducing a streamlined three-tab interface, automatic background updates, expanded app categories, and a minimum Android 7 requirement. The release underwent an independent security audit by the Open Technology Fund's Security Lab in partnership with Convocation. However, starting September 30, 2026, Google will enforce developer identity verification mandates in Brazil, Indonesia, Singapore, and Thailand, requiring all apps on certified Android devices to be linked to a verified developer regardless of how they were installed. The policy poses a significant challenge to F-Droid's sideloading model, placing the project's technical modernization in direct tension with tightening platform-level controls.

Five Common Unity Mistakes With OnEnable and OnDisable Methods

Unity developers frequently misuse the OnEnable() and OnDisable() lifecycle methods, leading to subtle but serious bugs in their projects. A key error is subscribing to events in OnEnable() without unsubscribing in OnDisable(), which can cause duplicate callbacks and unintended memory retention. Developers also mistakenly treat OnEnable() as a one-time initializer, when it actually fires every time a component becomes active, potentially repeating costly operations like data loading. Disabling a GameObject does not destroy it, so clearing critical state in OnDisable() can break functionality if the object is later reactivated. One-time setup logic should instead be placed in Awake() or Start(), reserving OnEnable() and OnDisable() strictly for managing active-state behaviour such as event subscriptions and listeners.

AI Speeds Up Coding But Delivery Bottlenecks Still Slow Software Releases

AI tools can generate code rapidly, but faster writing does not automatically translate into faster software delivery, as reviews, failing tests, and unclear requirements still cause delays. A feature may look complete while critical business questions — such as discount stacking rules or tax calculation order — remain unresolved, and AI can embed wrong assumptions into both code and tests simultaneously. Review queues worsen when teams produce more code without expanding review capacity, making smaller, incremental changes easier to inspect and ship than large generated batches. Defining precise acceptance criteria before generating code reduces rework, and testing edge cases — like expired inputs or rapid duplicate submissions — catches issues that happy-path tests miss. Metrics worth tracking are not lines of code produced but how long changes take to reach production, how often they require rework, and what breaks after release.

DFIR Engineer Builds Open-Source Cloud-Native Forensics Pipeline on GCP BigQuery

A digital forensics and incident response (DFIR) engineer has developed Veloxamen, a lightweight, automated forensics pipeline built on Google Cloud Platform. The tool ingests and processes forensic artifacts, transforming them into a structured, queryable timeline within BigQuery, after the developer found AWS and OpenSearch-based alternatives cumbersome. Currently focused on Windows artifacts, Veloxamen is designed with an extensible architecture and plans to incorporate microservices, Looker Studio dashboards, and Vertex AI-powered anomaly detection. The project has been open-sourced on GitHub and is now available to the global DFIR and cloud security community for feedback and contributions.

How Redis Powers Distributed API Rate Limiting and Idempotency at Scale

High-throughput public APIs require two core guarantees: protection against traffic spikes and ensuring duplicate client requests execute only once. Naive fixed-window rate limiters expose platforms to boundary burst vulnerabilities, where clients can effectively double their allowed request volume at reset intervals. Redis sorted sets combined with atomic Lua scripts enable sliding-window rate limiting that evaluates request volume in O(log N + M) time, eliminating these edge cases. For idempotency, Redis lock keys cache response payloads for 24 hours, preventing duplicate operations while allowing retries on application errors. Engineers are cautioned to address memory overhead, enforce key expiration policies, and maintain NTP clock synchronization across distributed Redis nodes to avoid common production pitfalls.

Developers Build Open-Access Knowledge Graph Mapping 130+ Zen Buddhist Classics

A team of developers has launched ChanZong Knowledge Base (chanzong.space), an open-access digital humanities platform indexing over 130 canonical Zen Buddhist scriptures, 500+ philosophical concepts, and hundreds of historical lineages. The platform was built using Next.js 14 and D3.js v7 to address common shortcomings of traditional digitized archives, such as fragmented texts and poor contextual linking. To handle 3,000+ interconnected entities visually, the team engineered a custom force-directed graph with anti-jitter algorithms that stabilize the physics simulation within approximately three seconds. The platform also features an automated dual-track static site generation pipeline serving both Simplified and Traditional Chinese audiences through separate URL routes, improving SEO and accessibility for scholars across mainland China, Taiwan, Hong Kong, and the wider sinology community.

How AI Personalization in Retail Works — And Why Developers Must Build It

A developer-focused guide published on DEV Community explains how AI-driven personalization helps e-commerce platforms show shoppers relevant products based on purchase history, browsing behavior, and context. According to McKinsey's 2021 Next in Personalization report, 71% of consumers expect personalized interactions, and 76% express frustration when they do not receive them. Faster-growing companies also generate roughly 40% more revenue from personalization than slower-growing peers, though the report notes this is a correlation rather than proof of causation. The guide outlines three core recommendation approaches — collaborative filtering, content-based filtering, and hybrid models — tracing collaborative filtering's retail roots to a landmark 2003 Amazon paper by Linden, Smith, and York. It also walks developers through building a working recommendation engine in Python and highlights common failure points in production systems.