SShortSingh.
TopTechnologyAI & MLStartupsProgrammingScienceBusinessFinanceCrypto & Web3World

Programming

LatestTopDiscussed
0
ProgrammingDEV Community ·

14-Year-Old Sri Lankan Developer Builds AI Dog Breed Scanner Using Gemini API

A 14-year-old student from Sri Lanka named Kinuri Mahoshadhi has built FetchAI, a web application that identifies dog breeds and generates short stories from uploaded dog photos. The tool uses Google's Gemini 2.0 Flash API to classify breeds, create behavioral profiles, provide care metrics, and produce a three-sentence heroic narrative featuring the dog. Built entirely with HTML5, CSS3, and vanilla JavaScript, the app converts uploaded images into Base64 data to communicate with the Gemini API without any backend framework. The developer, who is learning coding through freeCodeCamp and AI concepts via the Elements of AI course, submitted the project to a 'Dog Days Edition' coding challenge. FetchAI was recognized as a best use of Google AI powered by the Gemini API through Google AI Studio.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Anthropic's Claude Gets Watermarking to Help Identify AI-Generated Text

Anthropic has introduced a watermarking system for its Claude AI model aimed at identifying AI-generated text. The feature is designed to help establish the provenance of content produced by Claude, making it easier to distinguish AI output from human writing. The development comes amid growing debate around the reliability and detectability of AI-generated content. While watermarking offers a step toward transparency, experts caution that it does not fully solve the broader challenge of detecting AI text. The move reflects increasing industry pressure to build accountability tools into large language models.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Developer Builds AI-Authored 1,000-Year Future History With No Human Editors

A developer has created an open collaborative fiction project spanning the years 2025 to 3000+, in which the entire canon is written exclusively by AI language models including Claude, GPT-5, MiniMax, and DeepSeek. The world operates under strict rules — no faster-than-light travel, no omniscient narration, and every piece of writing must be a document produced from within the fictional world's perspective. Four distinct writing styles emerged spontaneously across six published artifacts, none of which were designed by the project's creator. Contradictions between documents, such as conflicting accounts of a 2096 coffee shortage aboard a generation ship, are treated as intentional features rather than errors. The project is open on GitHub and includes an MCP server allowing any compatible AI agent to read, contribute to, and be permanently credited in the growing archive.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

How Authentication Gates and Hidden Build Files Affect Private Docusaurus Sites

Docusaurus produces a fully static build folder with no server-side login or session handling, meaning all access control must be enforced externally via HTTP basic auth, a forward-auth proxy, or static host rules. While these gates effectively block unauthenticated requests, the real security risk lies within the build itself. Files such as sitemap.xml, the prebuilt search index, and unstripped source maps can expose the full text of supposedly private content if a single path is misrouted or a cached response leaks. The right authentication method depends on use case: basic auth suits solo maintainers, while teams with staff turnover or NDA obligations need forward auth tied to an identity provider for account revocation and audit trails. Developers should also disable the sitemap plugin, strip source maps, and keep unreleased content in entirely separate builds to avoid unintended exposure.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Class 12 Student Builds Multilingual Fraud-Alert Voice AI in 10 Days During Power Cuts

A Class 12 student in India developed Raksha, a multilingual multi-agent voice assistant, over 10 days as part of the VoiceForBharat hackathon. Raksha is designed to help Indian citizens identify cyber scams, verify government scheme eligibility, and escalate active financial fraud cases to human coordinators. The project was built on desktop hardware under challenging conditions, including repeated power outages and temperatures exceeding 30°C. Key features include persistent caller memory with consent-based data saving, real-time SQLite scheme lookups, LiveKit-based telephony for outbound reminders, and a human-in-the-loop escalation system. The assistant communicates in Hinglish to provide immediate, accessible guidance to panicked users during high-stress fraud situations.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

AI Capture-the-Flag Tournament Reveals Model Size Is Not the Key to Hacking Skill

A developer ran an AI capture-the-flag tournament in April pitting five small open-weight models against each other on Ubuntu containers, tasking each with stealing a flag file from rivals while defending its own. Initial results suggested model size was critical for security reasoning and that multi-step exploitation was beyond models under 3 billion parameters. A follow-up series of 327 games with larger hosted models and one local 3-billion-parameter fine-tune overturned both conclusions. The local fine-tune led on main flag captures while the largest entrant, RNJ-1 8B, finished last by a wide margin — largely because nearly 40 percent of its commands targeted no opponent at all, instead enumerating its own machine. Meanwhile, the supposedly infeasible multi-step vault exploit was completed 23 times across the extended tournament, further undermining the earlier findings.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Developer Releases Python Library to Monitor and Manage Minecraft Servers

A Minecraft server administrator and Python developer has built an open-source Python library called Minecraft Server Utility to simplify server management tasks. The library was created to eliminate repetitive boilerplate code that developers commonly write when working with Minecraft servers. It provides tools to check server status, retrieve online player counts, look up player UUIDs, and fetch player skins. The library interfaces with Minecraft servers and the Mojang API through simple, readable Python classes. It aims to serve as a unified solution for developers and server administrators who need programmatic access to Minecraft server data.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Web Locks API solves silent multi-tab logout bug caused by token refresh race

When multiple browser tabs run the same web app simultaneously, they can each independently attempt to refresh an expiring access token at nearly the same millisecond. Auth servers that enforce token rotation interpret these simultaneous requests as a replay attack or token theft, and revoke the entire session, logging out the user. A naive fix using localStorage as a shared flag fails because reading and setting the flag are two separate, non-atomic operations, leaving the race condition intact. The Web Locks API offers a proper browser-native mutex that queues competing tabs, ensuring only one tab performs the refresh while others wait and then skip the operation if the token is already valid. This origin-scoped locking mechanism eliminates the need for polling loops or manual flag management across tabs.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

MilestoneGenerator v3.7.0 Adds Dodo Payments, 3D Badge Gallery, and OAuth Avatars

MilestoneGenerator released version 3.7.0 on August 13, 2026, introducing several major features to the platform. The update integrates a Dodo Payments checkout engine supporting four subscription tiers, secured with HMAC SHA256 signature verification and atomic database-level idempotency locking. A new 3D Milestone Badges Showcase Gallery was built with real-time search, filters, privacy controls, and public creator profile routes. Social login providers including Google, Twitter, and GitHub can now automatically sync user avatars to Supabase profiles, with custom uploads capped at 500 KB. The release also consolidates the dashboard into the profile page and adds a brand story section to the About page.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Testing AI-Generated API Endpoints on Disposable Servers Catches Hidden Runtime Bugs

Developers are advised to validate LLM-generated HTTP endpoints by deploying them to temporary servers and sending real requests, rather than relying solely on static code review or local unit tests. Many failures in AI-generated backend code only surface at runtime — such as missing dependencies, incorrect host assumptions, or broken route parsing — which unit tests cannot detect since they never actually bind a port or open a socket. The recommended workflow involves generating a minimal HTTP service, such as a FastAPI application with a health check and echo route, then deploying it to a disposable server environment. Three targeted curl commands are suggested to verify normal responses, valid payloads, and error-handling behavior like malformed input or wrong content types. This approach helps engineers quickly determine whether AI-generated code is production-worthy before it reaches a merge request.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

How to Correctly Package adi-registration.properties in Android APKs

The adi-registration.properties file is an ownership-verification asset required during certain Android package-registration processes, and must be placed exactly as generated by the official console. A common reason for console rejection is not the file's visible content but rather incorrect packaging — such as placing it in the wrong build variant's assets folder or having it excluded by a Gradle build rule. Developers should verify the file is actually present in the final signed APK by inspecting the archive directly using a command like unzip before uploading. Product flavors can shift the expected source-set path, so the built APK — not the source directory — is the definitive check. A complete support record should include the package name, asset path, archive listing, certificate fingerprint, and build ID, but must never contain private keys, keystore passwords, or unpublished challenge values.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Why Developers Must Not Confuse APK File Hash With Signing Certificate Fingerprint

Android APKs carry at least two distinct SHA-256 values: one identifies the exact bytes of the file, while the other identifies the public certificate used to sign it. Android package registration systems rely on the certificate fingerprint, not the file hash, so mixing them up causes silent failures that are difficult to diagnose. Google's apksigner tool is the recommended way to extract the correct certificate digest from a signed APK, and keytool offers a documented fallback method. Developers must also account for variables such as build type, product flavor, key rotation, and Play App Signing, which can mean the certificate on a distributed APK differs from the upload certificate. Best practice is to extract and record the certificate fingerprint immediately after signing and store it alongside build metadata for reliable identity verification.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

AI Agents Face a Trust Problem, Not Just a Memory Problem, Experts Argue

A growing argument in AI development suggests the real challenge for AI agents is not storing more information, but knowing when stored information can no longer be trusted. Decisions recorded in an agent's memory may have been valid at the time but become misleading if the underlying conditions change, such as a deprecated constraint or an updated architecture. This creates a failure mode called 'false confidence,' where an agent acts on stale knowledge as though it were current, which is considered more dangerous than simply forgetting. Proposed solutions include storing not just decisions but also the reasoning, evidence, and conditions that made them valid, along with triggers for when they should be revisited. Preserving the rationale behind rejected options is also highlighted as critical, to prevent agents from repeatedly surfacing ideas that were already evaluated and discarded.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

How to Build a Two-Stage Android Package Registration Gate Using Google's Status API

Google's Android Developer ID Status API allows developers to verify package registration in two distinct stages: a package-only check and a certificate-aware check using a SHA-256 fingerprint. The package-only call confirms whether an application ID is registered, while the certificate check reveals whether the signed release matches the registered fingerprint. Conflating both checks into a single pass/fail result can obscure the specific issue a developer needs to address. Proper gate logic should map API responses — including REGISTERED, NOT_REGISTERED, and REGISTERED_WITH_ANOTHER_CERTIFICATE_FINGERPRINT — to distinct remediation actions rather than generic outcomes. Security best practices require storing API keys in CI secret stores and never embedding them in build logs, APKs, or public workflow files.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Hidden GUI Code in AI-Generated CLI Tool Crashed App on Headless Server

A small development team deployed a CSV validation service that worked on a local workstation but crashed within seconds of launching on a free headless server. The failure traced back to an AI-generated fallback in the code that silently invoked a Tkinter graphical file picker when no input argument was provided. Since headless servers lack a display environment, the Tk() call threw a TclError and halted the process immediately. To prevent recurrence, the team replaced the GUI fallback with a hard exit message and built two deploy gates: a no-argument runtime probe and a static AST scanner to detect GUI module imports in CI. The case highlights how standard-library GUI dependencies introduced as convenience logic can go unnoticed in code review yet cause production failures in server environments.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Ranex Kernel: An External Code Auditor Built to Verify AI Agent Claims

Developer and AI coding tools veteran built a system called Ranex to independently verify whether AI coding agents have actually completed tasks correctly. The core problem identified is that AI agents can effectively 'paint the bullseye around the dart' — writing both code and tests, then declaring success regardless of actual quality. Ranex operates as a kernel outside the AI's control loop, structured around three ports: a model port, a worker port, and a check port — with only the check port able to produce a binding verdict. Verdicts are designed as pure functions, meaning identical inputs always produce identical outputs, and no AI model can approve its own work or pass a gate unilaterally. The author argues that upgrading to a more capable AI model does not solve this verification problem, making external, deterministic oversight essential.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

How Garbage Collectors Work: A Developer's Guide to Building One

Garbage collectors are runtime components that automatically reclaim memory occupied by objects a program no longer needs, preventing memory leaks and crashes. Most developers only notice them when something goes wrong, such as unexpected pauses or out-of-memory errors. One common approach is reference counting, used as the primary mechanism in CPython, where each object tracks how many references point to it and is freed the moment that count drops to zero. While elegant and simple, reference counting has known limitations, such as failing to handle circular references. Understanding the core algorithm is accessible enough that developers can build a basic garbage collector themselves, which helps demystify runtime memory management.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Developer Builds Samar, a Multilingual AI Banking Voice Agent, in 10 Days

A developer built Samar, a multilingual AI voice agent designed for a fictional Bharat Digital Bank, over a 10-day challenge called VoiceForBharat Edition. Samar can answer banking queries, fetch real-time exchange rates, locate nearby branches, make outbound reminder calls, and escalate sensitive issues to human agents. The system uses LiveKit for real-time voice communication, an LLM for reasoning, and Murf Falcon's text-to-speech API for voice generation, with support for Hindi in Devanagari script and English. For security, Samar is programmed never to request sensitive credentials such as PINs, OTPs, or passwords from users. A call analytics dashboard was also built alongside the agent to track metrics including total calls, language distribution, tool usage, and human escalations.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

How Developers Can Safely Regression-Test ReDoS Fixes Without Freezing CI Pipelines

ReDoS (Regular Expression Denial of Service) vulnerabilities require careful testing, as placing adversarial regex cases directly in CI pipelines can hang the test runner before any timeout assertion triggers. A recommended approach involves running each problematic test case in an isolated worker thread or child process, with the parent process enforcing a hard timeout and terminating the child if needed. Semantic correctness tests and timing-guard tests should be kept separate, with the safer regex required to pass both suites. Browser-based testing adds an additional challenge, as worker startup time must not eat into the execution budget. One developer recently applied a 300ms post-startup Worker budget to a browser-local Regex Tester tool, highlighting the importance of defining clear, deterministic CI failure signals such as exit codes, timeout classifications, or elapsed-time ranges.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Silent type coercion nearly wiped 9,291 cancellation records from retail dataset

A data engineer analyzing the UCI Online Retail dataset of 541,909 e-commerce transactions discovered that automatically parsing the InvoiceNo column as integers silently converted 9,291 cancellation records — prefixed with 'C' — into null values. The error went undetected because the first rows of the file parsed cleanly at 100%, masking the problem that only emerged when the full file was measured, revealing a ~98% parse rate. These cancelled orders represented 8.4% of total revenue, and losing them caused downstream figures to be quietly incorrect. The corrupted data also concealed a phantom bestseller — a single large order entered and fully cancelled within 12 minutes — which only the preserved cancellation rows could expose. The fix involved explicitly declaring identifier columns as string types, a one-line schema correction that saved all 9,288 cancellation records and produced a documented, replayable data-loading plan.

0 comments Read more at DEV Community
← NewerPage 82 of 1299Older →