SShortSingh.
TopTechnologyAI & MLStartupsProgrammingScienceBusinessFinanceCrypto & Web3World

Programming

LatestTopDiscussed
0
ProgrammingDEV Community ·

How Node.js Healthtech Apps Should Handle Email and SMS Delivery Timeouts

A technical guide for healthtech developers outlines a safer approach to handling email and SMS notification timeouts in Node.js systems. The core principle is that a request timeout signals the caller stopped waiting — not that the message failed or succeeded — making blind retries or failure labels both risky. Developers are advised to store an external message ID when available, maintain a bounded polling schedule, and track delivery through a structured status vocabulary including states like submission_unknown and review_required. Template content should remain owned by the application to preserve content-governance and audit trails, while delivery adapters handle transport-specific rendering and status translation. Suppression of problematic recipient addresses should be treated as a separate, idempotent decision rather than conflated with delivery outcome.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Migrating from Modern Events Calendar: Key Database Quirks Developers Must Know

Modern Events Calendar Lite was permanently removed from WordPress.org on May 11, 2022, for a guideline violation, though many sites continue running it via the developer's own distribution. Each event is stored as a custom post type called 'mec-events', with scheduling data held in post meta fields rather than the plugin's derived database tables. Developers migrating away from the plugin face several data pitfalls, including weekly repeat intervals stored in days instead of weeks, occurrence counts saved as one less than the user-entered value, and ISO-formatted weekday numbers that differ from PHP and JavaScript conventions. Advanced monthly repeat rules are stored as compact tokens such as 'Sun.1' or 'Fri.l', while location or organizer ID 1 is a placeholder meaning 'hide it' and should not be imported as a real venue. Auditing raw post meta with direct database queries is recommended before attempting any migration to avoid silently incorrect dates or repeat schedules.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

SentinelMind AI Agent Uses Persistent Memory to Cut Security Incident Resolution Time

A team built SentinelMind, an AI-powered incident response agent, as part of the HackwithHyderabad 3.0 hackathon. Unlike conventional security tools, SentinelMind uses a persistent memory layer called Hindsight to store details of every past incident, including the fix applied and time taken to resolve it. When a new alert arrives, the agent first searches its memory for similar past incidents and surfaces relevant solutions rather than starting from scratch. The team's Memory Impact dashboard showed resolution times dropping from over 40 minutes for early incidents to under 15 minutes once sufficient memory had accumulated. A key architectural decision was to have the LLM only explain figures derived from stored records, preventing the model from fabricating statistics and making the system more reliable.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Azure Resources Wiped in 7 Minutes as Storm-3168 Exploits Compromised Service Principals

Microsoft Security Research documented a critical cloud attack by threat group Storm-3168, in which two compromised Azure service principals carried out coordinated reconnaissance and destruction within a single victim tenant. One service principal conducted over 300 read operations across roughly 15.5 hours, while a second rapidly enumerated virtual machines and resource groups in approximately five seconds. About 16 hours after initial reconnaissance, the second principal deleted multiple storage accounts, a Key Vault, a Function App, and an App Service plan in a destructive sequence lasting around seven minutes. Approximately 30 minutes after the deletions, the attacker re-enumerated storage accounts and successfully issued over 30 ListKeys requests to harvest access credentials. Attempts to disable Site Recovery and backup protection locks were also observed, though those specific actions failed.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

How to Strip GPS EXIF Data Before Publishing Images in Node.js Express Apps

A developer guide outlines a secure image publishing pipeline for Node.js Express applications that strips GPS and EXIF metadata before any upload becomes publicly accessible. The approach uses Sharp for re-encoding uploads as fresh JPEG or WebP files, ensuring metadata is not carried over from the original. After re-encoding, the output bytes are parsed and verified using the exifr library, and the publish job is rejected if any GPS location fields are still detected. The original upload is kept access-controlled as evidence, while only the verified, metadata-free derivative is stored and published. The method also enforces an 8 MB request size limit and includes unit tests covering phone photos with GPS tags, orientation-tagged screenshots, and images with no EXIF data.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Docker Model Runner vs Ollama: Workflow Fit Matters More Than Speed

A technical comparison of Docker Model Runner and Ollama found no clear speed winner, as both tools commonly rely on llama.cpp as their underlying inference engine. Aggregate benchmark data from April 2025 showed near-identical throughput — around 24 tokens per second — for both platforms, but reviewers declined to rank them due to unverifiable hardware and test conditions. Ollama is noted for its quick setup and simplicity, while Docker Model Runner targets teams that want model management integrated into Docker CLI and Docker Desktop workflows. The key differentiators identified were Docker-native workflow compatibility, model lifecycle control, and validated GPU support rather than raw generation speed. Reviewers recommended that teams base their choice on infrastructure fit and operational consistency across developer machines.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Developer ends 3-month zero-revenue streak by blurring AI summary results

A solo developer behind FreeAudioToText, a privacy-focused audio transcription platform, struggled for three months to generate any paid conversions on its premium AI summarization feature despite steady user traffic. The core transcription service was free, but an AI tool that extracted meeting notes and action items sat at $0 in monthly recurring revenue. Rather than scrapping the paid tier, the developer applied a CSS blur effect to render actual AI summaries visible but unreadable, letting users see the structure and length of results without accessing the content. This 'curiosity gap' approach replaced an abstract 'Unlock AI Summary' button with tangible, partially obscured output, prompting users to pay to reveal the answer they could already see. The first paid Stripe transactions arrived within a day of the change, ending the three-month sales drought.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Kiteworks Advises Precautionary Shutdown After Federal Threat Intelligence on Critical Flaw

Kiteworks issued a precautionary shutdown advisory to all customers in late September 2025 after receiving credible threat intelligence from US federal authorities suggesting a threat actor might target certain Kiteworks systems. The critical vulnerability was subsequently identified as limited to the Advanced Forms feature, affecting fewer than 50 organizations — under one percent of the customer base. No confirmed compromises or active exploitation have been reported in either Kiteworks or customer environments, and technical details of the flaw have not been publicly disclosed. The general shutdown advisory, which involved an approximately nine-hour service outage, was lifted on September 27. However, customers running Advanced Forms in self-hosted environments were instructed to contact Kiteworks support individually before resuming operations.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Bitget Loses $387.5M After Wallet Backend Breach and Transaction Data Manipulation

Cryptocurrency exchange Bitget confirmed that approximately $387.5 million in digital assets was fraudulently transferred from its hot and warm wallets following a critical backend system compromise. Attackers manipulated transaction data to trigger legitimate authorization processes, enabling transfers across multiple blockchains including Ethereum-compatible chains, XRP Ledger, Zcash, and TRON. The specific initial access vectors and technical details of the signing system involved have not been publicly disclosed. Bitget has since frozen some of the stolen assets with the help of industry partners, and cybersecurity firms Mandiant and SlowMist are assisting with the ongoing investigation. North Korean threat actors have been identified by Bitget as candidates behind the attack, though this attribution has not been independently confirmed.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Developer builds Elixir Pix payment library, validates it with a real one-cent transaction

A developer built pix_brcode, an open-source Elixir library for generating and parsing Brazil's Pix instant payment QR codes, after finding no maintained equivalent on Hex, Elixir's package manager. Pix, launched by Brazil's Central Bank in 2020, is a free, real-time payment system widely used across the country, with codes based on the EMVCo TLV (Tag-Length-Value) format plus a CRC16 checksum. The library was built over a weekend and deliberately avoids external dependencies, including a hand-written CRC16 implementation to keep the package self-contained. To handle money accurately, the library accepts amounts as integer cents or exact strings rather than floating-point numbers, avoiding classic precision errors. The developer verified the library works in production by successfully completing a real R$0.01 Pix transaction, uncovering and fixing a bug that only surfaced when an actual bank was involved.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Developer Ditches Git After 15 Years for Jujutsu VCS in AI Coding Era

A software developer who used Git for 15 years switched to Jujutsu (jj), a newer version control system, in early 2026 after finding Git's staging-area workflow increasingly cumbersome alongside AI coding tools like Claude Code. Unlike Git's three-state model requiring separate staging and committing steps, Jujutsu treats the working directory itself as a live commit, eliminating the need for manual staging or stash management. The shift was partly driven by a wave of introductory articles about Jujutsu circulating among Japanese developers around January 2026, prompting the author to trial it on an active project. After roughly a month of adjustment, the developer adopted Jujutsu for all repositories, including non-code writing such as blog posts and book manuscripts. The author cites reduced cognitive overhead and the ability to undo any operation as the key reasons for having no desire to return to Git.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Django Nova Goes Public: Key Engineering Lessons from Deploying novademo.tech

Developer Siddharth launched a public demo of Django Nova at novademo.tech, a library that integrates Django models with Pydantic schemas, query planning, and caching. The deployment surfaced several real-world issues, including a misconfigured Nginx layer that returned 404 despite healthy backend containers, illustrating how a passing health check only validates the layer it directly reaches. On the code side, the author found that values returned by Django's field.clean() must be explicitly reassigned to the model instance before model-level validation runs, and that write paths like QuerySet.update() and bulk_create() bypass Nova's validation sequence entirely. The project also uncovered problems with callable defaults evaluating too early, file object serialization, and relations being touched outside the selected schema's scope. The author clarifies that sharing a Pydantic schema does not guarantee every database write passes through it, and that database constraints and regression tests remain essential alongside static type checking.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Kestra Authentication Bypass Bug Actively Exploited, CISA Adds to KEV Catalog

A critical OS command injection vulnerability in Kestra, an event-driven workflow orchestration platform, has been added to CISA's Known Exploited Vulnerabilities catalog following evidence of real-world attacks. Tracked as CVE-2026-49869 and rated 10.0 in severity, the flaw stems from an authentication filter that matched request paths by suffix rather than exact route, allowing unauthenticated users to create and execute arbitrary workflows. Kestra released patches in versions 1.0.45 and 1.3.21 on June 2–3, 2026, but CISA's KEV listing only came on September 2, 2026 — three months later. The delay highlights a common gap where a patch exists but risk persists due to incomplete asset inventories, unrebult containers, or undetected prior compromise. Organizations running affected versions are urged to update immediately, audit workflow definitions for unauthorized entries, and review execution and network logs for signs of exploitation.

0 comments Read more at DEV Community
0
ProgrammingHacker News ·

How AI Is Shifting Power Back to Non-Technical Professionals

A blog post published on maroun-baydoun.com explores how artificial intelligence is changing the balance of power between technical and non-technical workers. The piece argues that AI tools are enabling people without coding or engineering backgrounds to accomplish tasks that once required specialist skills. This shift is being described as a form of empowerment for non-techies who were previously dependent on developers and technical teams. The article suggests that as AI lowers the barrier to entry for complex work, traditional gatekeeping by technical professionals may diminish.

0 comments Read more at Hacker News
0
ProgrammingHacker News ·

Humanos Launches Platform Aimed at Building a Human Operating System

A new platform called Humanos has launched with the goal of helping users build what it describes as a 'Human Operating System.' The project was shared on Hacker News, where it attracted minimal early engagement with 4 points and 3 comments. The platform is accessible at tryhumanos.com, suggesting it is in an early or experimental stage. Details about its specific features and target audience remain limited based on available information.

0 comments Read more at Hacker News
0
ProgrammingDEV Community ·

Study of 8,022 MLB Pitch Pairs Finds Whiff Rate More Repeatable Than Run Value

A data analyst examined Baseball Savant pitch statistics from 2017 to 2025 to determine how consistently five pitch-level metrics carry over from one MLB season to the next. Using 8,022 pitcher-and-pitch-type pairs with at least 100 pitches in both seasons, the study measured year-over-year correlations for usage rate, whiff rate, xwOBA allowed, hard-hit rate, and run value per 100 pitches. Whiff rate proved the most stable quality metric, with correlations ranging from 0.53 to 0.74 depending on sample size, while run value was the least repeatable, peaking at just 0.35 even for pitches thrown 800 or more times. All five metrics showed stronger correlations as pitch counts increased, consistent with the expectation that larger samples reduce statistical noise. The findings suggest that a single season of run value is a weak predictor of future performance, whereas whiff rate offers a more reliable signal of a pitch's true quality.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Why a Locally Working Backend Is Not Automatically Production-Ready

A backend application that runs flawlessly on a developer's local machine may still fail in production, where the environment is no longer controlled or predictable. Local setups typically have pre-configured variables, stable databases, and forgiving conditions that production systems do not guarantee. Critical gaps include missing environment variable validation, risky database migrations that can break live data, and process managers that report a server as running even when it cannot serve requests. Production systems also require meaningful health check endpoints and structured logging, since console logs become nearly useless when errors occur with no one watching the terminal. Addressing these gaps before deployment — through incremental migrations, startup validation, and proper observability — is what separates a working prototype from a reliable production service.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Cloudflare Launches cf CLI and Open-Sources Forge SDK Generator for AI-Ready Workflows

Cloudflare has released cf, a command-line tool that covers its entire API surface and supports TypeScript configuration-as-code, making it usable both by human operators and AI agents. Alongside the CLI, the company open-sourced Forge, its internal SDK generator that automatically produces typed TypeScript code from OpenAPI specifications. Because the CLI is generated rather than hand-written, it stays in sync with API changes without requiring manual updates to documentation or flag definitions. The design reflects a growing trend in infrastructure tooling, where CLIs are being built with AI agents as first-class users alongside humans. Cloudflare's approach prioritizes complete API coverage and programmatic usability over a curated, beginner-friendly command set.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

HexStrike AI Brings 150+ Offensive Security Tools to AI Agents, Raising Sandbox Concerns

HexStrike AI is an open-source MCP server that connects large language models like Claude and GPT to over 150 offensive security tools, including exploitation frameworks, vulnerability scanners, and password attack utilities. The project has gained significant traction on GitHub, accumulating more than 12,000 stars and ranking among the top trending Python repositories. By acting as a bridge between AI agents and these tools, the server enables autonomous penetration testing but introduces serious questions about containment and misuse. Key architectural challenges include preventing tools from attacking infrastructure beyond their intended targets, with proposed safeguards ranging from per-invocation Docker containers to proxy-based network allowlists. The lack of mandatory human approval in the MCP protocol further complicates oversight, prompting debate around permission models and audit trails for high-risk tool invocations.

0 comments Read more at DEV Community
← NewerPage 827 of 3171Older →