SShortSingh.
TopTechnologyAI & MLStartupsProgrammingScienceBusinessFinanceCrypto & Web3World

Programming

LatestTopDiscussed
0
ProgrammingDEV Community ·

Hidden Cloud Gaps Like Forgotten Servers and Excess Permissions Invite Attackers

An article warns that companies investing in cloud infrastructure and security tools can still be exposed by overlooked weaknesses such as forgotten servers, exposed databases, or accounts with excessive permissions. It explains that attackers actively search for easily discoverable flaws, including exposed services, outdated software, and misconfigurations. Because cloud environments change constantly, each new resource or permission update can create risks that security teams may not notice right away. The piece notes that under the shared responsibility model, providers secure the underlying infrastructure while customers remain responsible for their applications, data, identities, and configurations. It outlines seven warning signs, along with recommended actions such as maintaining an up-to-date asset inventory and restricting unnecessary public access.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

New API filter isolates remote jobs employers explicitly labelled as remote

A developer guide describes a Python script that searches job listings through the Job Opportunities API. The tool can restrict results to roles where the employer itself published the word "remote" rather than having it inferred from job text. Each result includes a field_sources marker indicating whether a value was published or inferred. The author shares sample output and says results link directly to employers' application pages. The post also suggests running the script on a schedule and filtering for published salary information.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Seven headings for writing a job description for an AI system

A guide proposes describing an AI system as a job on one screen, covering seven headings: trigger, input, source of truth, output, destination, never, and exception owner. The author argues that a vague question like whether AI can handle invoices is not buildable, whereas a defined recurring job with a start, inputs, results and a destination can be handed over. An invented example of a returns spreadsheet, fed from a returns inbox, illustrates how each heading is filled in. The author identifies the source-of-truth heading as the most decisive for whether a system works in practice, since conflicting data sources often break systems. Any heading left empty signals an unresolved decision that should be settled before building begins.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Compromised ConnectWise Cloud Backup Secret Gave Attackers Access to 300+ Microsoft 365 Tenants

ConnectWise Cloud Backup, a hosted service formerly sold as SkyKick that copies Microsoft 365 mail, files and Teams data for managed service providers, had an application secret stolen and used to sign in to customer tenants as the backup service. Huntress confirmed unauthorized sign-ins in 162 tenants on October 16, 2026, and later counted nearly 1,000 Entra tenants with sign-in activity from the attacker's address, more than 300 of them successful. Some service principals for ConnectWise Cloud Management applications also assigned themselves directory roles, mostly Exchange Administrator, and in one tenant an application granted itself Global Administrator. Because the attackers authenticated with the application's own secret rather than a user login, multi-factor authentication did not apply, and ConnectWise has shut down application access while stating it sees no sign partner backup data was compromised. Containment requires auditing every secret on each affected enterprise application, since credentials added by the attackers remain valid even after the applications are disabled.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Dagster and dbt: Do You Need Both?

A common question is whether teams using Dagster also need dbt, since both draw lineage graphs, schedule work, and run tests. The author explains they are different kinds of tools: dbt is a SQL transformation framework that orders and tests SQL models but does not schedule itself, while Dagster is an orchestrator that handles scheduling, retries, partitions, and arbitrary Python. The overlap lies in lineage and testing, but Dagster's graph covers the whole pipeline, including Python loading and model training. dbt remains valuable when transformations are mainly SQL in one warehouse, when analysts write models, or when portability across orchestrators matters. The author's own production pipeline runs on Dagster without dbt, which suits teams where transformations are mostly Python and one engineer manages everything.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Cheap LLM API routes reported inflated input token counts for a fixed prompt

A daily check sent the same roughly 90-token prompt to 107 model routes across four hosts on 2026-10-12. Many routes reported input counts in the thousands, with some GPT routes near 4,469 tokens and two GLM routes at 14,111. The author suggests hosts may be prepending hidden system prompts that the customer is billed for on each request. No host is named, and the author notes other explanations are possible. Developers can test their own providers with a one-token request and compare the reported prompt_tokens against a baseline.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Browser-Based Tool Merges iPhone Photos into One PDF Without Uploads

A developer describes building a tool that combines a batch of phone photos, often HEIC files, into a single PDF entirely within the browser. The tool checks each file's actual format rather than trusting its extension and converts HEIC images to JPEG while stripping location metadata for privacy. Users can reorder pages via drag-and-drop or arrow buttons, with the reordering logic kept as simple, pure data handling. Pages can be sized to real paper formats such as A4 with each page oriented to match its photo, or sized to the image itself. Files that fail to load are flagged individually so the rest of the job can still finish.

0 comments Read more at DEV Community
0
ProgrammingHacker News ·

Investor-owned utilities charge about 23% more for electricity than public providers

A new analysis finds that investor-owned electric utilities charge customers roughly 23% more than public providers. The comparison contrasts privately held utilities with publicly owned alternatives. The source material is a link to an insights report, with limited detail beyond the headline figure. The findings add to ongoing debate over how ownership structure affects consumer electricity prices.

0 comments Read more at Hacker News
0
ProgrammingHacker News ·

Google's Android developer verification rules could restrict sideloading on phones within 70 days

A campaign site called Keep Android Open warns that Google is about to tighten control over Android phones. Under new developer verification requirements, apps may need to come from verified developers before they can be installed. Critics argue this would limit users' ability to install software from outside official app stores, a practice known as sideloading. The post gained attention on Hacker News, where it drew a modest discussion. The source material provides only a brief link and summary, so the exact rollout details and timeline remain limited to the campaign's claims.

0 comments Read more at Hacker News
0
ProgrammingHacker News ·

Shitter: New Nitter Fork Released on Codeberg

A new project called Shitter, described as a fork of the Nitter front-end for Twitter, has been shared on Codeberg. Nitter is an alternative interface that lets users view the platform without JavaScript or an account. The announcement appeared on Hacker News, where it gathered 10 points and 5 comments. The source material provides little detail beyond the project link and discussion metrics, so its specific features and goals are not described here.

0 comments Read more at Hacker News
0
ProgrammingDEV Community ·

DREX: Brazil's central bank digital currency faces privacy questions

The Central Bank of Brazil is developing DREX, a digital currency built on a permissioned Ethereum-based network called Hyperledger Besu. Unlike decentralized cryptocurrencies, it is run by authorized banks and institutions, with the central bank retaining oversight of the system. Pilot tests revealed that, without extra safeguards, transactions could be visible to network participants, and researchers reportedly exposed balances and transfers during one trial. The bank is evaluating privacy technologies such as zero-knowledge proofs and anonymous transfer protocols, though full privacy is seen as incompatible with anti-money-laundering rules. Implementation is underway, with expansion expected through 2025 and 2026.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

OpenClaw's heartbeat feature: cheap local checks first, LLMs only when needed

OpenClaw, formerly known as Moltbot and Clawdbot, has gained traction for its local automation that monitors a machine, spots drift, and acts early. Its heartbeat feature runs periodic ticks through a layered pipeline, starting with inexpensive deterministic checks such as process status, file state, queue depth, and API health. Model escalation happens only when those checks leave real ambiguity, which reduces cost and unpredictability. The article presents the heartbeat as a control-plane primitive for agent infrastructure, organized as a five-stage loop with strict probe schemas, TTL-based caching, and a health state machine using hysteresis. The guidance is aimed at developers building their own agent systems who want predictable behavior and fewer unnecessary model calls.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Origin Data Lab Examines Stereo Camera Calibration Limits for Physical AI Data

Origin Data Lab has been evaluating the geometric consistency and calibration limitations of its stereo capture workflow, which is used for Physical AI and robotics data. The company's Technical Field Note #04 argues that a single average error value cannot fully describe calibration quality, and that the distribution of epipolar errors can reveal residual misalignment. It also highlights that calibration parameters must match the actual capture setup, since changes in resolution, cropping, or camera mode can affect their validity. Further points include evaluating errors across field angles and using appropriate projection models for wide-angle and fisheye lenses. The note concludes that reliable real-world datasets must be measured, verified, and documented rather than simply collected.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Armory Castle exploits BeyondTrust Remote Support flaw CVE-2026-102764 in appliances

Google's threat intelligence group and Mandiant report that a suspected China-nexus actor tracked as Armory Castle has exploited CVE-2026-102764 in BeyondTrust Remote Support appliances since late August 2026. BeyondTrust rates the authentication bypass 9.3 and says it affects Remote Support 26.2.3 and earlier versions. The vendor patched SaaS customers on 8 October 2026 and disclosed the flaw on 15 October, while self-hosted appliances require manual patching unless automatic updates are enabled. According to Mandiant, the attacker used the flaw for initial access, escalated to root, deployed a webshell, and extracted stored credentials to reach downstream systems. Researchers also note that search-engine fingerprint coverage for the product is incomplete, so exposure counts can be misleading in either direction.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Oizom Open-Sources On-Prem Manager to Simplify Deploying Air Quality Software on Client Servers

Oizom, an IoT company behind the Envizom air quality monitoring platform, found that many government clients require on-premise installs for data security reasons. Its small team struggled to scale Docker Compose-based deployments, since every client needed different configurations, integrations and high-availability or disaster recovery setups. To address this, the company built On-Prem Manager, a tool with a cloud console for managing images, templates, variables and secrets, and a per-server agent that applies configuration changes, handles backups and rollbacks. The project has been released as open source under the Apache-2.0 license.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

OnyxPDF Offers 50 PDF and Image Tools That Run Entirely in the Browser

A developer has built OnyxPDF, a collection of 50 tools, 32 for PDFs and 18 for images, that process files locally without uploading them to any server. The author argues that cloud uploads in typical online PDF services are unnecessary, since modern browsers using WebAssembly and Web Workers have enough capability to handle these tasks. Features include merging, splitting, compressing, OCR in seven languages, true redaction, document signing, and AES-256 encryption, with heavy processing kept off the main thread to avoid UI freezes. Image background removal is also performed on-device using a bundled segmentation model rather than a remote API. The tools are free and require no account.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Temporal, BullMQ, or AWS Step Functions: Choosing a Durable Workflow Tool in 2026

Durable workflow problems such as refunds that never finish or jobs that restart after a crash are handled by three main tool families in 2026. Temporal is a language-agnostic engine that builds retries, timeouts, and crash recovery into its model, making it suited to serious services. BullMQ is a lightweight Redis-backed queue for Node that works well for basic background jobs, but leaves durability and exactly-once guarantees to the developer. AWS Step Functions offers a managed, JSON-defined state machine with no servers to run, though it brings higher costs and AWS vendor lock-in. The article's comparison favors Temporal for long-running, crash-sensitive processes and BullMQ for simple job queues, while Step Functions suits teams already committed to AWS.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

15 CCNA 200-301 Exam Traps That Trip Up Candidates in 2026

A guide outlines 15 common misconceptions that Cisco's CCNA 200-301 exam uses to catch unprepared candidates across all six domains. It covers Layer 2 topics such as spanning tree root bridge election, where the lowest Bridge ID wins rather than the highest priority. It also explains the difference between CDP and LLDP, port roles versus port states, and why EtherChannel fails when member interface settings do not match. Routing traps include OSPF's default reference bandwidth making Gigabit and Fast Ethernet links appear equal, and DR/BDR election favoring the highest priority. The guide stresses that understanding why wrong answers are wrong matters as much as knowing the correct ones.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

GitHub Actions max-parallel setting queues all matrix jobs upfront, triggering wasteful runner launches

A GitHub Community discussion (#209687) reported that GitHub Actions creates and queues every matrix job at run start when strategy.max-parallel is set, even though the limit means only some can execute at once. Each queued event prompts autoscalers such as terraform-aws-github-runner or Actions Runner Controller to launch a runner, so many runners sit idle until scale-down terminates them. The payload does not distinguish jobs waiting for capacity from jobs blocked by max-parallel, so autoscalers cannot tell the difference. The discussion also found that matrix jobs calling reusable workflows are created and queued one at a time, which avoids the problem. This suggests sequential queuing is possible, though it is unclear whether the difference is intentional.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

GitHub Adds Option to Count Draft Pull Requests Toward Repository PR Limits

GitHub has introduced an optional setting letting maintainers count draft pull requests toward their repository's pull request limits. The change responds to a loophole where contributors opened many drafts to get around limits introduced in June 2026. Drafts were found to trigger notifications, consume CI/CD resources, and add to review backlogs even though they were not ready for review. The setting is found under Repository settings, then Moderation, then Interaction Limits, and is off by default so projects that rely on drafts can keep their current workflow. Early adopters also noted that GitHub's official documentation lagged behind the feature, still stating that drafts do not count toward limits.

0 comments Read more at DEV Community
← NewerPage 82 of 2911Older →