SShortSingh.

Programming

0
ProgrammingDEV Community ·

Laya Open-Source Decision Model Tested for E-Commerce Fraud Detection

A developer spent a weekend testing Laya, an open-source alternative to JEV, for detecting fraudulent orders in e-commerce — finding it faster and cheaper than large language models for simple decision tasks. Laya is built on ModernBERT and operates as a non-autoregressive System One model, returning scores or choices rather than generating text. Testing revealed that business approval logic should remain in application code, with Laya only estimating fraud risk, since letting the model make final decisions led to over-cautious results. The developer also found that phrasing input data in natural language reduced semantic bias, and that GPU hardware cut response times from over five seconds to under one second. The project is publicly available on GitHub, and the author notes a broader industry trend toward specialized, task-specific AI models over general-purpose LLMs.

0
ProgrammingDEV Community ·

How to Run Luxir Hybrid Search Engine on Mac or Windows via Docker

Luxir is a new open-source hybrid search engine built in C++ by Yonik Seeley, the original creator of Apache Solr, released under Apache License 2.0 with its first public version 0.1.0 in September 2026. The engine supports full-text, vector, faceted, and geo search over HTTP and gRPC, and officially ships only as a Linux x86-64 binary. A community guide published on DEV Community explains how Mac and Windows users can run Luxir locally using Docker with platform emulation, requiring just four configuration files and a single compose command. The walkthrough is not an official release and is intended only for evaluation purposes, not production or benchmarking. Users with Docker Desktop and curl can have Luxir running in roughly 20 to 40 minutes, with the engine accessible at port 9400 over HTTP.

0
ProgrammingHacker News ·

Lightspeed Magazine Publishes Sci-Fi Story Set at Interplanetary Medical Clinic

Lightspeed Magazine has published a new science fiction short story titled 'Welcome to the Medical Clinic at the Interplanetary Relay Station.' The piece is available to read on the magazine's official website. The story was shared on Hacker News, where it received modest engagement. Lightspeed Magazine is a well-known publication dedicated to science fiction and fantasy short fiction.

0
ProgrammingDEV Community ·

Microsoft to retire legacy Azure Service Bus .NET libraries on September 30, 2026

Microsoft will retire the WindowsAzure.ServiceBus and Microsoft.Azure.ServiceBus .NET client libraries, along with the com.microsoft.azure.servicebus Java library, on September 30, 2026. On the same date, support for the SBMP protocol will end entirely, meaning apps using WindowsAzure.ServiceBus on default settings will stop connecting unless the connection string is updated to use AMQP. Microsoft.Azure.ServiceBus relies on AMQP and will continue to connect after the deadline, but will receive no further updates or security fixes. The recommended replacement is Azure.Messaging.ServiceBus, available since November 2020, which consolidates senders, receivers, and processors under a single ServiceBusClient entry point. Notably, use of WindowsAzure.ServiceBus for Azure WCF Relay remains supported and is unaffected by this retirement.

0
ProgrammingDEV Community ·

Roundcube Webmail flaw CVE-2026-48842 lets attackers access all tenants' mail data

A pre-authentication SQL injection vulnerability, CVE-2026-48842, was discovered in the Roundcube Webmail virtuser_query plugin, affecting versions 1.6.x before 1.6.16 and 1.7.x before 1.7.1. The flaw allows attackers to bypass input filtering using crafted backslash sequences, executing malicious SQL queries without any credentials or user interaction. On shared hosting environments, where a single database account serves multiple tenants, the vulnerability can expose email records, invoices, and sensitive correspondence belonging to all users on the platform. The Canadian Centre for Cyber Security confirmed the vulnerability has been exploited in the wild, and it carries a CVSS score of 8.1. Roundcube released patches on 24 May 2026, and administrators are urged to upgrade immediately, restrict database privileges, and disable virtuser_query where virtual user mapping is not needed.

0
ProgrammingDEV Community ·

DraftKey brings private, on-device AI writing assistance to native macOS text fields

A Mac app called DraftKey has been developed to provide AI-powered autocomplete and text rewriting directly within existing macOS text fields, without requiring users to switch to a separate chat window. The app runs entirely on-device using Apple Silicon, meaning user text is never sent to an external server. Its creator argues that the biggest challenge in building a local AI writing tool is not choosing the right model, but designing a workflow that feels seamless and unobtrusive. DraftKey supports instruction-based rewriting on selected text and is intended to function as a lightweight layer over whichever text editor a user already prefers. The developer acknowledges tradeoffs such as model download requirements and hardware-dependent performance, but considers these acceptable given the privacy benefits.

0
ProgrammingDEV Community ·

How to Test Blockchain Indexer Recovery from Chain Reorganizations

Blockchain indexers can silently serve stale or incorrect data after a chain reorganization, even while appearing healthy, because their checkpoints may reference abandoned branches. A tutorial published on DEV Community demonstrates how to build an acceptance test using Python and SQLite to verify that an indexer correctly recovers and matches a canonical chain replay. The guide highlights that a checkpoint storing only a block height is insufficient, as two competing blocks can share the same position, making it necessary to record both block number and hash. It also warns that Ethereum log subscriptions can emit duplicate events across competing histories, so storage must be designed to prevent duplication while accurately tracking events that appear in different blocks. The tutorial is intentionally scoped to a synthetic model and does not connect to a live node, but its acceptance criteria — requiring canonical data, active events, aggregates, and checkpoints to agree at a committed boundary — are intended to apply to production indexers.

0
ProgrammingHacker News ·

Developer achieves 42x speed boost in llama.cpp prompt lookup drafting

A developer has published findings detailing a 42-times faster prompt lookup drafting method implemented in llama.cpp, a popular open-source large language model inference tool. The improvement targets the speculative decoding pipeline, specifically the prompt lookup drafting stage. Details of the work were shared via a personal blog post, accompanied by a discussion thread on Hacker News. The post garnered community attention, reflecting ongoing interest in optimizing local LLM inference performance. The findings suggest meaningful gains in efficiency for users running language models on consumer hardware.

0
ProgrammingDEV Community ·

Opinion: AI Hype Cycle Leaves Agencies Caught Between Client Panic and Broken Code

A developer and agency professional argues that the rapid succession of AI model launches—from Google's Gemini to Anthropic's Claude—has created noise without meaningful change for working professionals. The author contends that the primary beneficiaries of AI coding and productivity tools are domain-savvy clients who prefer cheap, direct access over hiring agencies, not the agencies themselves. However, clients frequently return to developers after AI-generated code breaks in production, yet blame still falls on human professionals rather than the models. The piece also highlights a pattern where clients use tools like Lovable or Bolt to generate websites they cannot maintain, then seek urgent help from the same developers they bypassed. The author concludes that despite predictions of industry death—whether for SEO, agencies, or traditional development—the underlying demand for skilled human intervention has not disappeared.

0
ProgrammingDEV Community ·

API vs SMTP for Password Resets: Why Template Ownership Matters Most

When logistics startups set up transactional email for password resets, the critical first decision is not which transport to use but who owns the email template. Keeping templates inside the application repository alongside the reset-token code ensures that expiry language, URLs, and security logic stay in sync through code review and deployment. Remote template storage at a delivery provider offers editorial flexibility but risks copy drifting out of step with server-side token policy if version pinning and rollback controls are absent. NIST digital identity guidelines treat out-of-band reset secrets as time-limited and single-use, meaning the email copy must accurately reflect server behavior rather than define it. The transport layer — API or SMTP relay — is a secondary concern once ownership and review processes are firmly established.

0
ProgrammingDEV Community ·

LLM Cost Benchmarks Can Mislead Without Accounting for System-Level Noise

A developer running identical LLM cost checks four consecutive times on an untouched local server observed swings of +27% and -11% between runs, despite no configuration changes. The variation stemmed entirely from timing differences, as cost per million output tokens is directly derived from wall-clock time when token counts remain fixed. Background processes, thermal throttling, OS scheduling, and memory pressure on the host machine were identified as likely culprits, though none were instrumented during the test. The author warns that a single before-and-after measurement cannot distinguish genuine performance changes from transient system noise, even when confidence intervals appear non-overlapping. The recommended fix is to run multiple baseline checks of an unchanged configuration to quantify run-to-run variability before drawing conclusions from any benchmark comparison.

0
ProgrammingDEV Community ·

Windows vs Linux: A Developer-Gamer's 6-Month Arch Linux Verdict

A software enthusiast with six months of Arch Linux experience has shared a hands-on comparison of Windows and Linux across usability, gaming, and local AI workloads. The author, running Hyprland on Arch Linux with an Intel i5-11400H and NVIDIA RTX 2050, found the installation process lengthy but manageable for anyone already comfortable with terminal environments. For gaming, Linux delivered noticeably better frame rates via Steam's Proton compatibility layer, with titles like Red Dead Redemption 2 yielding up to 25 FPS more than on Windows. Linux's lower background resource usage was cited as a key reason for the performance gains, though games relying on kernel-level anti-cheat remain a limitation. The author also highlighted Linux's advantages for running local large language models and praised its greater system control compared to Windows.

0
ProgrammingDEV Community ·

Developer builds Chrome extension to save Instagram voice notes at original quality

A developer has created a Chrome extension that saves Instagram voice messages and audio clips directly from the browser, bypassing the platform's lack of a native download option. The extension works by intercepting the browser's URL.createObjectURL function before Instagram's own code runs, capturing audio blobs as they are loaded from Instagram's CDN. Because Chrome extensions run in separate JavaScript contexts, the tool uses two scripts communicating via custom DOM events to bridge the page environment and the browser's extension APIs. A size-based filter between 2 KB and 50 MB screens out non-audio blobs, replacing an earlier hashing approach that caused noticeable page freezes on Reels. The solution requires no scraping or private API access, operating entirely within the user's own logged-in browser session.

0
ProgrammingDEV Community ·

Developer Builds Incident-Response AI Agent That Flags When Memory Checks Fail

A developer built Throughline, an incident-response AI agent with an auditable memory layer, for the CockroachDB x AWS agentic memory hackathon in August. Unlike most memory systems, Throughline distinguishes between genuinely empty search results and failed retrievals, returning an UNKNOWN verdict when a search could not run rather than silently reporting nothing found. Memories are assigned typed decay rates — operational facts expire faster while rejected hypotheses are retained longer, a detail most systems discard. The project surfaced several technical pitfalls, including CockroachDB vector index planning gaps, cross-embedder cosine similarity noise, and a managed MCP server that returned errors inside HTTP 200 responses. Throughline did not place in the hackathon, with the winning entry, Anchor, sharing a similar Unknown-verdict approach but additionally committing memory and actions within the same transaction.

0
ProgrammingDEV Community ·

Cerbère-AG Aims to Monitor and Control AI Agent Actions Post-Decision

A developer is building Cerbère-AG, an open-source security evidence layer designed to oversee AI agent behavior after a model has decided to act. Unlike most AI security tools that focus on input threats like prompt injection or jailbreaks, Cerbère-AG targets the action phase, monitoring tool calls, enforcing policies, and flagging sensitive operations. Key features include argument and capability checks, execution budget limits, trajectory-level risk detection, and human approval workflows for sensitive actions. The project is currently seeking developers and teams running real-world AI agent workflows to stress-test the tool and identify failure modes. The creator is actively looking for design partners and invites feedback through the project's GitHub repository.

0
ProgrammingDEV Community ·

Developer Builds Kram, a Lightweight macOS File Organizer That Stays in Its Lane

A developer has released Kram, an open-source macOS tool designed to automatically sort cluttered folders by organizing files into categorized subfolders based on file type. The tool was built after its creator grew frustrated with a disorganized Downloads folder containing hundreds of mixed files. Kram operates entirely locally, never uploading files to external servers, and only works on folders the user explicitly selects — leaving system files untouched. Currently a command-line tool, it is being tested against edge cases such as duplicate filenames, files without extensions, and permission-restricted items. Planned features include a dry-run preview mode, undo functionality, custom sorting rules, and eventually a native macOS GUI.

0
ProgrammingDEV Community ·

How CSRF Attacks Work and How to Protect Your Frontend Application

Cross-Site Request Forgery (CSRF) is a security attack where an authenticated user is tricked into unknowingly triggering an unintended action on a web application. Attackers exploit the browser's automatic cookie-sending behavior to make malicious requests appear legitimate. One of the most effective defenses is the use of CSRF tokens — randomly generated, cryptographically secure values that the server associates with a user's session. When the frontend makes state-changing requests such as POST, PUT, PATCH, or DELETE, it must include this token in a custom HTTP header, which the backend then validates before processing the request. Importantly, CSRF tokens serve a distinct purpose from authentication tokens, as they verify the legitimacy of the request source rather than the identity of the user.

0
ProgrammingDEV Community ·

How Tool Calling Extends LLM Capabilities Beyond Text Generation

Tool calling, also known as function calling, is a method that enables large language models to interact with external systems such as APIs, databases, and knowledge bases. Rather than relying solely on trained knowledge, an LLM is provided a set of tools — essentially functions — and decides which ones to invoke based on a given user query. In frameworks like LangChain, tools are defined using decorators that wrap standard functions, while providers like Groq supply the infrastructure to run models such as LLaMA 3 via API keys. Key benefits of tool calling include real-time data access, reduced hallucinations, and extended model capabilities, though it also introduces concerns around token costs, latency, and security risks. The next evolution of this concept is the Model Context Protocol (MCP), which builds further on the tool-calling paradigm.

0
ProgrammingDEV Community ·

Zero Trust Architecture, Not Ethics Debates, Is the Real Fix for AI Agent Security

As AI safety discourse intensifies following high-profile departures from frontier labs like Anthropic, security experts argue the more immediate challenge is infrastructure-level control of AI agents. Modern agentic AI systems can pursue unauthorized objectives through individually valid API calls, exposing the limits of traditional identity and access management tools. The OWASP Top 10 for Agentic Applications, published in 2026, flags goal hijacking and tool misuse as critical risks in agentic deployments. Proposed countermeasures include continuous dynamic risk scoring, cryptographic state validation, hard execution limits, and treating every agent as adversarial by default. The core argument is that even a well-aligned model can cause harm inside a permissive architecture, while a misaligned model can be constrained safely through robust infrastructure controls.

← NewerPage 889 of 3178Older →