0
ProgrammingHacker News ·
Is this the new cyber normal?
Article URL: https://drew.silcock.dev/blog/is-this-the-new-cyber-normal/ Comments URL: https://news.ycombinator.com/item?id=50207115 Points: 3 # Comments: 0
Programming
0
ProgrammingHacker News ·
Blog Post Argues Retirement Is Unnecessary as Utopia Nears
A blog post by Jim Nielsen, shared on Hacker News, puts forward the idea that people may not need to retire because a utopian future is approaching. The piece appears to frame technological or societal progress as making traditional retirement less essential. The post drew 28 points and 6 comments on the discussion platform. The provided material includes only the headline, link, and engagement figures, so the specific arguments made in the article cannot be fully confirmed from this text alone.
0
ProgrammingDEV Community ·
Why 'use client' Does Not Make Your Whole App Client-Side in Next.js
A common worry is that wrapping a layout in a client-component theme provider converts the entire app into client-side React. The article explains that 'use client' marks a boundary following the import graph, not the rendered tree. Children passed as props from a Server Component stay on the server, so pages keep their server-side data fetching and ship no extra JavaScript. Importing a server component inside a client file, however, pulls it into the client bundle and can break builds or add weight. The recommended practice is to place 'use client' on the smallest interactive piece rather than entire pages.
0
ProgrammingDEV Community ·
G2 review data ranks Adobe Acrobat, Foxit, PDFelement and pdfFiller for everyday PDF work
A developer analyzed G2's verified reviews of more than 20 PDF editors to identify which tools handle routine tasks like editing, converting, merging and signing. Adobe Acrobat and Foxit PDF Editor rank highest overall for in-place editing, OCR, security and e-signatures, though Acrobat is criticized for its price and Foxit for formatting inconsistencies. Wondershare PDFelement is presented as a lower-cost general-purpose option praised for OCR and batch processing but weaker on large, graphics-heavy files. pdfFiller, at $8 per month, is recommended for form-focused and signature workflows since it runs in the browser, though it is less suited to deep editing. The article advises testing budget tools on difficult files before committing to a purchase.
0
ProgrammingDEV Community ·
Slothstart: A Local Gemma Agent That Drafts the First Steps of Stalled Tasks
Slothstart is a command-line tool that reads a user's tasks.md file and overnight generates starter material for the task that has waited longest. It classifies each task as a draft, outline, project skeleton, or checklist, then produces only the opening step, leaving the rest for the user to complete. The tool runs an open-weight Gemma model locally through Ollama or llama.cpp, so task data never leaves the machine and works without a network connection. It includes a thermal check that pauses processing when a fanless laptop gets warm, and outputs are saved as plain files in a starters/ folder. The author's implementation details and findings are still marked as placeholders in the original post.
0
ProgrammingDEV Community ·
Mapping POPIA Section 19 Safeguards to ISO 27001:2022 Controls
Security teams in South Africa often need practical ways to turn POPIA Section 19 into implementable and testable controls. This guide proposes using ISO/IEC 27001:2022's risk-based ISMS to support that effort, while cautioning that certification alone does not establish legal compliance. It begins with Section 19(2)(a) by recommending an inventory of systems holding personal information, followed by a risk assessment covering threats such as compromised credentials, misconfigured storage, and ransomware. The mapping then links Section 19(2)(b) safeguards to ISO Annex A controls, with the organisation expected to select and document controls in its Statement of Applicability. Verification under Section 19(2)(c) is supported through ISO monitoring, audit, and management review clauses, alongside incident management guidance and the separate POPIA Section 22 notification duties.
0
ProgrammingDEV Community ·
Pakistani Software Engineering Student Shares Doubts About Career Amid AI Growth
A Pakistan-based Bachelor of Software Engineering student introduces herself in a first post on the DEV Community platform. She is pursuing a career in full stack development and is currently studying JavaScript, which she describes as extensive. Her post raises concern about whether the industry still needs new entrants, given the rapid capabilities of AI. She also mentions personal interests such as gaming, noting that one game does not run on her laptop. She says she plans to share her achievements, projects, challenges, and confusions and invites feedback from the community.
0
ProgrammingDEV Community ·
Author proposes 'iAdentité' framework to define AI agents as documented working identities
The author introduces the term 'iAdentité' to describe a durable, documented working identity for AI systems, created because the label 'AI agent' says little about how to collaborate with one. An iAdentité provides continuity and a recognizable communication style, but it explicitly does not confer decision-making authority, permissions, or independent judgment. The article places it within a broader sequence of layers running from identity through role, project context, and expected contribution to the current mission. It also distinguishes three types: Robotic iAgents as durable operational members, Original VoiAces as temporary narrative voices, and ViArtual Personas as fictional interaction modes that suspend operational work while active.
0
ProgrammingDEV Community ·
Study finds NVIDIA OpenShell's audit export empty; developer builds independent evidence ledger
An independent evaluation of NVIDIA's OpenShell, a sandbox runtime for AI agents, found that its blocking worked but its evidence trail did not. A blocked DNS query left no record, and the OCSF audit export produced zero records in test runs. The author responded by building Agent Seatbelt, a vendor-neutral policy and evidence layer that sits above existing agent runtimes. It uses externally run policy decisions and an append-only, hash-chained ledger that can be verified offline. In testing on a real runner, the layer reconciled 13 of 13 actions against independent ground truth.
0
ProgrammingDEV Community ·
Sharing Claude Code permissions across a team with a committed settings.json
Individual developers' Claude Code approval habits do not scale across a team, leaving new hires unsure which prompts matter. The recommended fix is a shared permissions file committed to the repository, with a local settings file for personal exceptions and optional managed settings for rules no one can override. A starter configuration allows routine safe commands like tests and lint, asks before risky actions such as pushing, and denies access to secrets. Rules from different files are merged, and deny rules are checked first, so a team deny cannot be overridden by a local allow. The article also notes that permission rules are not a complete security boundary, since the same command can be run in ways that bypass text matching.
0
ProgrammingDEV Community ·
MCP-Powered QA Agents: Evaluation Criteria and Five Companies to Explore
The article examines how AI agents using Model Context Protocol can run software tests, stressing that controlled actions and verifiable conclusions matter as much as the underlying model. In the described architecture, an MCP server exposes approved testing operations such as Playwright browser tests and API checks, and enforces permissions so authorization stays in application code rather than prompts. It recommends separating observed failures from hypotheses, allowing an "unknown" diagnosis when evidence is thin, logging tool activity, and requiring human approval for sensitive actions. The piece also lists five firms offering relevant QA services or platforms: GeekyAnts, Accenture, IBM, TCS, and Capgemini (via Sogeti), while noting that inclusion does not imply equivalent capabilities. It suggests pilots in bounded environments with known failures, measuring diagnosis accuracy, time to actionable findings, and cost.
0
ProgrammingDEV Community ·
Getting API access to DeepSeek, GLM or Kimi when phone and card verification block signup
Many developers struggle not with the AI models themselves but with registering for them, which can fail at phone verification, identity checks, or card payment declines. These obstacles often occur together, especially for users outside a provider's home market or those holding foreign or prepaid cards. The article suggests trying access routes in order, starting with the provider directly and moving toward cloud hosts, gateways, and self-hosting, rather than defaulting to the costliest option. It recommends checking minimum top-ups, prepaid versus subscription billing, true OpenAI compatibility, refund handling, and balance expiry before paying. It also offers a gateway example in which switching requires only changing the base URL and API key, with one-time credit packs starting at $9.90 and no auto-renewal.
0
ProgrammingDEV Community ·
Five Practical Steps to Get More Out of a Hackathon, Even Without a Win
The article traces hackathons back to a 1999 OpenBSD gathering and notes how the format has grown into a popular way to spark innovation through intense, short build sessions. It argues that some participants leave with rich experiences but no prizes, while others become so focused on winning that they miss what makes these events valuable. The author, a Hackathon Community Manager at Major League Hacking, shares five steps to avoid coming away empty-handed, with winning defined more broadly than a trophy. The advice centers on talking with other attendees, organizers, and MLH representatives, who can offer resources and connections. It also encourages observing how other teams approach problems and attending demos to learn from a wider range of work.
0
ProgrammingDEV Community ·
Scan of 100 Lovable-built apps finds widespread missing security headers and weak GDPR compliance
A developer behind the Vespez scanning tool checked 100 apps from Lovable's public showcase for security and GDPR issues. Fourteen of the apps were already offline within weeks of being published, leaving 86 that received full scores. Nearly all lacked a Content-Security-Policy header, and most could be embedded by other sites, a gap the author attributes to platform defaults rather than individual choices. Average GDPR scores came in at 38 out of 100, with no app achieving a clean result, and one app exposed a live API key in its public JavaScript. The author notes the scan is a non-legal assessment of a non-random sample, so low scores indicate likely issues rather than confirmed violations.
0
ProgrammingHacker News ·
Dutch government had hacked into Jared Kushner's phone
Article URL: https://twitter.com/jaredkushner/status/2113376217415958767 Comments URL: https://news.ycombinator.com/item?id=50206914 Points: 5 # Comments: 0
0
ProgrammingHacker News ·
Essay Explores Job Loss and a Surge in Cortisone Interest
A personal essay published on tilschuenemann.de connects job loss with a growing fascination around cortisone. The piece was shared on Hacker News, where it received 5 points and no comments at the time of capture. The source text provided is limited to metadata, so the author's specific arguments and details cannot be confirmed here. Readers wanting the full reasoning should consult the original article directly.
0
ProgrammingDEV Community ·
Developer localizes a Django app into seven languages, including RTL support
A solo developer translated a large Django application into English plus six other languages: Arabic, Chinese, Spanish, French, Russian, and Bengali. The write-up explains the motivation, which centers on making free project management learning content accessible to non-English speakers and expanding the site's indexable pages. The app's translations for the six non-English languages are AI-assisted drafts, and the app labels them as beta. The article describes handling interface strings with gettext while storing long-form lessons as per-language Markdown files with English fallback. It also covers technical hurdles such as right-to-left layout using CSS logical properties and the language-tag mismatch between zh-hans and zh.
0
ProgrammingDEV Community ·
Sloth Brief: a local model turns scattered notes into a short restart checklist
Sloth Brief is an open-source tool that condenses a set of accumulated text notes into a brief, source-linked action list. It runs the Qwen2.5-0.5B-Instruct model locally via Hugging Face Transformers, so no paid API or cloud upload of notes is needed. The model writes one concise summary per note, and Python assigns source numbers from the notes actually supplied, though the author warns that summaries still need checking against the originals. Input files are never edited, and the demo of two synthetic notes passes eight automated tests that cover limits and file handling but not model accuracy. The author notes that no productivity gains have been measured, and that the prototype was built with Codex assistance.
0
ProgrammingDEV Community ·
EU launches AI Act Service Desk offering multilingual expert answers for businesses
The European Commission has opened the AI Act Service Desk and a companion Single Information Platform to help companies understand how the EU AI Act affects them. Businesses can submit questions to experts working with the EU AI Office in any official EU language, after signing in with EU Login. The Service Desk handles specific inquiries, while the Single Information Platform offers self-service tools such as a Compliance Checker and an AI Act Explorer. The platform is currently available in English, French and German, with the rest of the EU languages expected in early 2026. The Commission suggests that companies prepare focused questions tied to particular AI systems and their roles to get the most useful guidance.
0
ProgrammingDEV Community ·
Arista warns of exploited SQL injection flaw in VeloCloud Orchestrator, CVE-2026-114625
Arista has published advisory SA-0199 confirming that attackers are already exploiting CVE-2026-114625, a SQL injection flaw in the VeloCloud Orchestrator, the management system for VeloCloud SD-WAN edges, which carries a CVSS score of 9.9. The flaw lets a crafted request alter the SQL statement the application runs, so a low-privilege account such as Enterprise Read Only can perform actions reserved for the operator-level superuser role. Exploitation requires network access to the VCO web interface, which Arista says is exposed by default and cannot be disabled, plus a valid login. Arista has patched its hosted and dedicated orchestrators, and it lists fixed releases for the 5.2, 6.1 and 6.4 trains, noting that the 7.0 train and VeloCloud Gateway and Edge are not affected. Customers on unsupported releases have been directed to Arista's Technical Assistance Center, and the advisory does not say when exploitation began or what attackers did afterward.