SShortSingh.

Programming

0
ProgrammingDEV Community ·

How Proper Schema Design Makes Developer Changelog Retrieval Reliable

A developer incident revealed how poorly structured changelog schemas can cause AI-generated answers to silently blend information from different software releases, producing plausible but misleading citations. The root cause was missing release and section identity fields in retrieved chunks, meaning the language model had no signal that advice spanned version boundaries. The proposed fix centers on a staged retrieval architecture where every chunk carries explicit provenance — including event ID, project, release, source URL, and timestamps — duplicated directly into metadata to avoid costly joins at query time. A provider-neutral retrieval interface and a crawl manifest tracking expected event IDs help operators detect deletions and quarantine specific releases without disrupting an entire project's data. The core principle is to treat each changelog update as a stable, identifiable event rather than unstructured prose, making the schema the first line of defense before any model-level fixes are attempted.

0
ProgrammingDEV Community ·

Storm-3068 Exploited Password Reset to Steal Kubernetes Credentials via Azure DevOps

Microsoft Defender Experts have documented a critical attack by threat group Storm-3068, in which attackers hijacked a user account by completing a self-service password reset (SSPR) and registering an attacker-controlled device in Microsoft Intune. The actor then removed the legitimate user's MFA method and substituted their own, securing persistent control over the compromised identity. Using valid credentials, Storm-3068 accessed Azure DevOps, enumerated repositories, pipelines, and connected resources, then executed a pipeline authorized to reach more than 50 resources to extract kubeconfig files containing Kubernetes ServiceAccount tokens. Seven kubeconfig files were reportedly added to an existing repository, with the stolen tokens enabling potential authentication to Kubernetes APIs. The attackers also deployed the Atera remote management agent and ran the Chisel tunneling tool in an attempt to establish a persistent external reverse proxy, though the full extent of successful tunnel connections has not been publicly confirmed.

0
ProgrammingDEV Community ·

Causality Cage: Open-Source Tool Pinpoints Minimal Root Cause of Browser Bugs

A developer has released Causality Cage, an open-source CLI tool that automatically identifies the minimal set of conditions causing a browser bug by replaying failing and passing sessions in Chromium. The tool toggles variables such as API responses, localStorage, cookies, and latency using hierarchical delta debugging to isolate the true cause. It outputs a standalone HTML report with an interactive causal graph, allowing users to neutralize individual factors and observe their effect on the failure. When tested against a known bug in the RealWorld React app, the tool returned a full causal chain in 19 experiments within 25 seconds. The project runs entirely locally with no LLM calls, is available on npm under the MIT license, and its creator is actively seeking feedback on cases where it produces incorrect or unhelpful results.

0
ProgrammingDEV Community ·

AIBARS Dashboard Tracks Fastest-Growing AI Open-Source Projects on GitHub

A developer built a tracking site called AIBARS to monitor the most-starred and fastest-growing open-source AI projects on GitHub in one place. As of September 30, 2026, openclaw leads with roughly 390,000 stars, while deepseek-harness tops the fastest-growing list with over 3,400 new stars. Agent tooling projects dominate both rankings, signaling a broader industry shift from AI models toward the infrastructure built around them. The site also features daily AI news, model rankings, over 100 AI tools, and free learning resources across six languages. AIBARS is publicly accessible and has been under active development for more than a year.

0
ProgrammingDEV Community ·

OpenAI Launches 'Dots': Persistent AI Agents That Work Around the Clock for Users

OpenAI introduced 'dots' on September 29, 2026, describing them as always-on AI agents built into ChatGPT and powered by GPT-6 Astra. Each dot is assigned its own cloud computer and browser, allowing it to operate continuously on a user's behalf across more than 4,000 connected apps. Unlike standard chat assistants, dots retain context over time, learn a user's preferences and work style, and can handle multiple tasks simultaneously without requiring step-by-step supervision. Users begin with a single personal dot, with OpenAI indicating that multi-dot team configurations are planned for the future. The announcement highlighted proactive capabilities, including an early tester whose dot independently identified an unpaid invoice and prepared it for the user's approval before submission.

0
ProgrammingDEV Community ·

Kelp DAO Sues LayerZero Over $292M rsETH Exploit Tied to North Korea-Linked Hackers

Kelp DAO, operating under parent company Evercrest Technologies, filed a civil lawsuit in British Columbia's Supreme Court against LayerZero Labs and co-founder Bryan Pellegrino over a $292 million exploit of its rsETH liquid restaking token in April 2026. Attackers, attributed to North Korea-linked group TraderTraitor, used social engineering to compromise LayerZero developer credentials and manipulate internal RPC nodes, allowing them to forge a cross-chain message that bypassed bridge verification. This enabled the minting of 116,500 unbacked rsETH tokens on Ethereum — about 18% of total supply — making it the largest single DeFi exploit of 2026. Kelp DAO alleges LayerZero was negligent and concealed flaws in its technology, with a key vulnerability being the bridge's single-verifier configuration that left no independent check against fraudulent attestations. LayerZero's Pellegrino has publicly denied the claims, calling the lawsuit meritless and stating he will contest it in Vancouver.

0
ProgrammingDEV Community ·

Why Signing Both JAR and Container Image Matters for Pipeline Security

A software team building a CI/CD pipeline discovered that signing only the JAR artifact left a critical gap, since the container image — not the JAR — is what actually runs in production. To close this gap, they extended artifact signing to cover the container image as well, making each handoff in the build chain independently verifiable. The signing key is strictly restricted to the pipeline runner's role, ensuring no developer or local build can produce a valid signed artifact. The team consistently rejects requests for manual signing workarounds, arguing that allowing human signatures would reduce every signature's guarantee from 'came from the pipeline' to 'probably came from the pipeline'. Their conclusion is that artifact signing is a narrower security property than often claimed, and its value depends entirely on who can access the signing key and schedule jobs on the build runner.

0
ProgrammingDEV Community ·

EF Core 11 introduces dotnet-ef.json to set repository-level CLI defaults

EF Core 11 introduces support for a .config/dotnet-ef.json file that lets teams define default values for frequently repeated dotnet ef command-line options such as --project, --startup-project, --framework, and --context. The tool walks up the directory tree from the current working directory and applies the nearest matching config file, with explicit command-line arguments always taking precedence. This addresses a longstanding pain point in multi-project solutions where mismatched or missing arguments across CI scripts, READMEs, and developer machines could cause migration files to land in the wrong project. Relative paths in the config file are resolved against the directory containing the .config folder, not the working directory. Only the nearest config file is used, with no merging across directory levels.

0
ProgrammingDEV Community ·

Solid-Vue JS Brings File-Based API Routing to Vue and Vite Projects

A developer has released Solid-Vue JS, a meta-framework built on Vue, Vite, and the h3 server library, designed to eliminate repetitive backend setup for small Vue projects. The framework was inspired by frustrations encountered while building a mini ERP application, including version conflicts, manual routing configuration, and the overhead of larger frameworks like Nuxt. Its core feature is file-based API routing, where placing a file in the server/api directory automatically creates an API endpoint, keeping frontend and backend code within a single project. Solid-Vue JS ships as three npm packages covering the core framework, project scaffolding, and a CLI for adding integrations such as Tailwind CSS and icon libraries. Currently in beta, the framework supports one-command deployment to Cloudflare Workers and its packages are available on npm, with documentation live at docs.solid-vue.tech.

0
ProgrammingDEV Community ·

Developer Builds AI Support Agent With Persistent Memory Across Conversations

A developer has created a customer support AI agent that retains context from past interactions, addressing a key limitation of conventional stateless support bots. Most LLM-based support agents handle only the current conversation, forcing customers to repeat information each time they return. The new system uses a tool called Hindsight to store structured memories — including reported issues, troubleshooting steps, preferences, and prior commitments — linked to individual customers. Hindsight offers three core operations: retaining information from conversations, recalling relevant past context, and synthesizing responses based on memory. The approach aims to make support interactions more coherent and cost-efficient by retrieving only relevant history rather than passing entire conversation logs back to the model.

0
ProgrammingDEV Community ·

Developer Builds AI Agent TRACE to Track Product Problem History Over Time

A developer has built an AI agent called TRACE — short for Tracking Reactions, Actions, Consequences & Evolution — designed to help product teams remember the full history of customer problems. Unlike standard AI tools that treat each piece of feedback in isolation, TRACE treats recurring issues as persistent entities with a lifecycle. The system maps a problem from initial customer feedback through product decisions, interventions, and outcomes, storing that history for future reference. This allows teams to quickly determine whether a current issue has appeared before and what was previously attempted to resolve it. The project is publicly available on GitHub, with a live demo hosted on Vercel.

0
ProgrammingDEV Community ·

Developer Builds Python-Based IEC 61850 GOOSE Substation Protection Simulator

A power engineering graduate has built an end-to-end Python pipeline simulating IEC 61850's GOOSE protocol, which allows substation protection devices to communicate over a network instead of traditional hardwired connections. The project comprises three components: a publisher-subscriber relay-breaker pair exchanging GOOSE trip messages, fault simulation logic using pandapower that automatically triggers trip signals when fault current exceeds a threshold, and a live Streamlit monitoring dashboard displaying relay status, event logs, and fault graphs. GOOSE messaging in real IEC 61850 networks operates in under 4 milliseconds, making it suited for time-critical protection events. The developer noted that simulating fault currents before triggering protection logic provided practical insight into relay coordination that textbooks alone cannot convey. As power grids increasingly integrate renewables and automation, IEC 61850-based protection systems are becoming industry standard, making hands-on experience with the protocol increasingly valuable.

0
ProgrammingDEV Community ·

Mano-P Lets Mac Users Run a Local GUI Agent Without Cloud or API Keys

Mano-P is an open-source GUI agent for Apple Silicon Macs that automates screen interactions — such as clicking buttons and filling forms — using a vision-language model running entirely on-device. The agent operates in a loop: it captures a screenshot, reasons about the next action, executes it, and repeats until the task is done. It uses the Cider SDK for MLX 8-bit quantization, which speeds up inference by quantizing both model weights and activations, unlike most tools that only quantize weights. Installation requires an Apple M4 chip or newer, at least 32GB of RAM, and macOS permissions for Screen Recording and Accessibility. The setup is managed via a CLI tool called mano-cua, installable through Homebrew, and the quantized 4B model uses roughly 4.3GB of memory at peak.

0
ProgrammingDEV Community ·

How to Design a Secure SMS OTP and Airline Alert Backend with Rate Limiting

A software architecture guide outlines best practices for building SMS OTP login systems, email receipts, and airline disruption alerts with proper rate limiting and idempotency controls. For OTP security, it recommends storing hashed codes with expiry timers, capping verification attempts, and separating user cooldowns from transport-level retries, in line with NIST SP 800-63B guidelines. Payment receipts should be tied to versioned events using a business idempotency key, ensuring that replaying an event does not generate duplicate messages. Airline alert notifications should run on a separate queue to prevent schedule-change bursts from blocking login flows. The guide also warns against storing email templates in delivery dashboards, favoring repository-owned templates that keep wording, escaping, and migration logic under a single reviewable boundary.

0
ProgrammingDEV Community ·

Why Low False Positive Rates Matter as Much as Detection in Self-Hosted WAFs

Web Application Firewalls (WAFs) are commonly evaluated on attack detection rates, but false positive rate (FPR) — how often legitimate traffic is wrongly blocked — is equally critical for real-world deployments. A high FPR can disrupt customer logins, break partner API integrations, and cause alert fatigue that leads teams to weaken security rules over time. Traditional signature-based WAFs are prone to higher false positives because they match requests against fixed patterns, sometimes flagging unusual but valid inputs. Semantic detection engines, such as the one used by the self-hosted WAF SafeLine, aim to assess request intent rather than just pattern-match strings, which its published benchmarks suggest can reduce FPR to as low as 0.07%. Experts recommend evaluating any WAF against live traffic, reviewing detailed block logs, and treating vendor benchmarks as a starting point rather than a definitive measure.

0
ProgrammingDEV Community ·

Datool Launches as Open-Source AI Tracing and Evaluation Tool via MCP

Datool is a newly launched open-source platform designed as an alternative to Langfuse for tracing and evaluating AI applications. The tool helps developers identify bad AI outputs, save them as test cases, and measure whether subsequent changes actually improve results. Key features include trace inspection, versioned prompts, dataset management, custom scorers in JavaScript or Python, and evaluation run comparisons. Datool integrates with development workflows through a CLI and MCP interface, and is self-hosted under the Apache 2.0 license. The project is available on GitHub and is seeking feedback from AI developers on how they currently handle production failures and regression testing.

0
ProgrammingDEV Community ·

Six design principles that make gaming tier list sites trustworthy for users and AI

Multi-game stats platform SeeMeta has outlined a set of data transparency practices it applies across tier lists for games including TFT, League of Legends, and Deadlock. Each page displays the relevant patch, match sample size, and data window directly beneath the title, allowing users and AI systems to immediately assess freshness and credibility. Titles incorporate patch numbers and dates to match search intent, while short methodology sections explain how rankings are calculated and how low-sample data is handled. The site uses stable, crawlable URLs for every game, role, and locale — covering 15 languages — and publishes a stated daily update cadence as a verifiable freshness signal. Related tools such as odds calculators and talent builders are linked from each tier list, keeping follow-up questions answered within the same platform.

0
ProgrammingDEV Community ·

How WiFi QR codes handle special characters, hex SSIDs, and error correction

WiFi QR codes follow an informal convention originated by ZXing, not an official standard, which means edge cases can cause silent failures across different devices. Passwords containing characters like semicolons or colons must be escaped with a backslash, or naive string parsers will misread the credentials. SSIDs made entirely of hexadecimal characters — such as '5060' or 'deadbeef' — must be wrapped in double quotes to prevent readers from interpreting them as raw hex bytes. Error correction level H, while offering greater damage tolerance, significantly increases QR code density and can make printed codes harder to scan from a distance. For most wall-mounted network signs, lower error correction levels are sufficient, and password length only meaningfully increases code size beyond roughly 12 characters.

0
ProgrammingDEV Community ·

How to Tell Good Bots from Bad Ones and Block Abuse Without Hurting Traffic

Not all automated web traffic is harmful — search engine crawlers and monitoring tools serve legitimate purposes, but scrapers, credential stuffers, and DDoS clients pose real threats to web services. Malicious bots typically reveal themselves through high request volumes, repetitive endpoint targeting, spoofed or missing headers, and unnaturally consistent timing patterns. A practical mitigation strategy involves allowlisting known good crawlers, rate limiting suspicious clients, issuing challenges like CAPTCHAs for uncertain cases, and outright blocking sources with clear abuse signatures. Self-hosted web application firewalls, such as the open-source SafeLine, can be deployed as a reverse proxy to apply these controls at the network edge before requests reach the application. The goal is precise filtering — stopping abusive automation while ensuring real users and trusted bots continue to pass through unaffected.

0
ProgrammingDEV Community ·

18% of Small Businesses in San Bernardino County Lack Mobile-Friendly Websites

A scan of 27,741 small-business websites listed in San Bernardino County, California found that nearly 40% of domains were unreachable due to being dead, parked, or timed out. Of the 16,723 sites that responded, 18.5% had no viewport meta tag, the standard indicator of a mobile-optimized layout. Almost all non-mobile sites appeared to be hand-built with no content management system, with legacy tools like Microsoft FrontPage among the few generators detected. By contrast, modern platforms such as WordPress and Wix virtually eliminated the mobile layout problem for businesses using them. The scan, conducted by California-based firm Weio using open-source tools and public places data, also found that around 7.9% of live sites lacked working HTTPS and roughly 22% published an email address directly on the page.

← NewerPage 792 of 3168Older →