SShortSingh.
TopTechnologyAI & MLStartupsProgrammingScienceBusinessFinanceCrypto & Web3World

Programming

LatestTopDiscussed
0
ProgrammingHacker News ·

Developer Builds AI Agent System to Automatically Optimize CUDA Kernels

A developer has created an agentic tool that uses AI to optimize CUDA kernels, combining the project with an opportunity to learn the LangGraph framework. The system includes a custom C++ CUDA test harness that AI agents can interact with autonomously. The agents are capable of running kernels, collecting benchmark results, and profiling performance using NVIDIA's Nsight tool. The project was shared on Hacker News as a personal learning exercise that produced a functional optimization workflow. It represents a practical application of agentic AI to low-level GPU programming tasks.

0 comments Read more at Hacker News
0
ProgrammingDEV Community ·

EU Backs 19-Nation AI Sovereignty Framework to Build Cross-Border Tech Stack

The European Commission has welcomed the design of IPCEI AI, a coordinated framework involving 19 EU member states aimed at strengthening Europe's artificial intelligence capabilities across the full technology stack. Coordinated by Germany, the initiative covers areas ranging from advanced AI technologies and compute management to industrial products and services. Rather than a direct funding award, the project establishes a structure through which participating countries can submit AI projects for assessment under EU State aid rules. Eleven of the 19 member states have announced plans to begin pre-notifying their individual projects from September 2026. The initiative is linked to broader EU policy efforts, including the AI Continent Action Plan and the proposed Cloud and AI Development Act, reflecting Europe's long-term push to reduce reliance on non-European AI infrastructure.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Developer launches DBison, a free open-source database client for Postgres, MySQL and SQLite

A developer who manages dozens of applications has released DBison, a free desktop database client supporting PostgreSQL, MySQL, MariaDB, and SQLite. The tool was built as a lightweight alternative to heavyweight clients like DBeaver and costly commercial options. DBison features in-place grid editing, a schema-aware SQL editor, read-only connection enforcement, SSH tunnels, SSL support, and OS keychain integration. The interface includes dockable tabs, a command palette, and both light and dark modes. The client is available on GitHub at no cost, with no feature tiers or seat limits, though Windows users will see a SmartScreen warning as builds are not yet code-signed.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Leaked GitLab Email Tokens Can Let Attackers Push Code and Trigger CI Pipelines

Security researchers at Aikido Security have identified a high-severity vulnerability in GitLab's incoming email feature, where exposed email tokens can allow unauthorized third parties to modify code and execute CI pipelines. An attacker who obtains a valid incoming email address can send a crafted patch email, which GitLab processes under the permissions of the legitimate token owner. The flaw does not enable privilege escalation to other accounts, but a single leaked token can be exploited across multiple projects owned by the same user. No active exploitation in the wild has been reported, though the risk is rated high due to the long-lived nature of the tokens and their impact on development infrastructure. GitLab users are advised to reset exposed tokens, restrict branch and CI permissions, and — for self-managed instances — consider disabling the incoming email feature if unused.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Roundcube Webmail Flaw CVE-2026-48842 Actively Exploited; Patches Released

A high-severity pre-authentication SQL injection vulnerability, CVE-2026-48842, has been identified in Roundcube Webmail's virtuser_query plugin, with active exploitation reported by the Canadian Centre for Cyber Security. The flaw carries a CVSS v3.1 score of 8.1 and allows unauthenticated attackers to inject malicious SQL by sending crafted HTTP requests to unpatched instances. The extent of damage depends on database contents and privileges, though OS command execution and full email theft have not been publicly confirmed. Roundcube has released patched versions 1.6.16 and 1.7.1 to address the issue across supported branches. Administrators are advised to update immediately, disable virtuser_query if unused, minimize database privileges, and avoid relying solely on web application firewalls as a substitute for patching.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Study Tests 8 LLMs on Informal Indonesian Customer Chat for Small Businesses

A developer who builds WhatsApp bots for Indonesian small businesses (UMKM) created a benchmark to test how well large language models handle the way customers actually type online. The benchmark, called UMKM-Bench, used three fictional shops set in Yogyakarta, Bandung, and Semarang, each with its own product catalog, shipping table, and policies. A total of 84 customer messages were written across three versions — formal, slang, and slang with typos — drawing on Javanese and Sundanese informal language mixed with abbreviations and English loanwords. Eight LLMs were evaluated on two key abilities: understanding garbled real-world queries and avoiding hallucinated answers when the shop's data could not support a response. Scoring was handled with plain Python, checking whether models correctly identified intent, product, quantity, and city, while penalizing any fabricated figures not found in the shop data or the customer's message.

0 comments Read more at DEV Community
0
ProgrammingHacker News ·

Italy's Low Fentanyl Crisis Linked to Mafia Control of Drug Markets

Italy has remained largely insulated from the fentanyl epidemic that has devastated drug users across North America and parts of Europe. Researchers and analysts suggest that organized crime groups, including the Mafia, may be a key factor in keeping the synthetic opioid out of the country. Criminal organizations that dominate Italy's drug trade are believed to prefer established substances like cocaine and heroin, which offer reliable profit margins and familiar supply chains. By controlling distribution networks, these groups may be effectively blocking the entry of fentanyl, which they have little incentive to introduce. The Economist reported on this paradox in September 2026, highlighting how criminal monopolies can inadvertently shape public health outcomes.

0 comments Read more at Hacker News
0
ProgrammingHacker News ·

Oracle liable to data centre investors regardless of power supply, court rules

Oracle faces financial liability to data centre investors even in cases where the facility lacks electricity, according to a ruling reported by the Financial Times. The case centers on contractual obligations Oracle holds toward investors in a data centre project. The dispute highlights the legal risks companies face when infrastructure commitments are made independently of operational conditions. The outcome could set a precedent for how cloud and data centre contracts are structured and enforced going forward.

0 comments Read more at Hacker News
0
ProgrammingHacker News ·

Reunion Island Airport Uses Natural Ventilation Instead of Air Conditioning

An airport on Reunion Island has been designed to stay cool using only natural ventilation, eliminating the need for conventional air conditioning. The design leverages the island's natural airflow patterns to maintain comfortable temperatures for passengers. The project highlights how thoughtful architectural planning can reduce energy consumption in tropical climates. This approach offers a potential model for sustainable airport design in regions with favorable wind conditions.

0 comments Read more at Hacker News
0
ProgrammingDEV Community ·

Developer releases open-source library to detect tampering in audit logs

A developer has released chainlog, a lightweight open-source TypeScript library designed to make application audit logs tamper-evident. The library works by chaining SHA-256 hashes across log entries, so any alteration, deletion, or reordering of past records breaks the chain and is flagged by a single verify() call. Unlike heavyweight solutions such as Google's Trillian or immudb, chainlog wraps an app's existing logging infrastructure without requiring data migration or additional services. It currently ships with in-memory, JSONL-file, and SQLite storage backends, with Postgres, MySQL, and MongoDB adapters planned for future releases. The project is MIT-licensed and targets use cases such as compliance auditing under SOC 2, HIPAA, and ISO 27001, where log integrity may need to be demonstrated.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

How Notifio routes two Stripe products through one webhook without mixing them up

Notifio offers two one-time payments — a lifetime monitoring licence and an auto-reply upgrade — both priced at £20 and both processed via Stripe's single checkout.session.completed event. Because the same event handles both products, the webhook must reliably distinguish between them to avoid issuing a duplicate licence to a customer who only paid for an upgrade. The solution uses a metadata field with a shared constant to tag upgrade sessions, allowing the webhook to identify and handle upgrades first before falling through to the default licence logic. The upgrade branch exits immediately with a return statement, ensuring the two fulfilment paths never merge. Idempotency is enforced through a unique database constraint on the Stripe session ID, protecting against duplicate fulfilment in the event of webhook retries.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Why Notifio rates-limits by licence token, not IP address

Notifio is a desktop app that monitors rental listing pages and triggers server-side email alerts when new properties appear. The developer chose to rate-limit API requests by licence token rather than IP address, because multiple users in shared student housing or university networks often share a single IP. Under an IP-based limit, all housemates would compete for the same request budget, meaning legitimate users could have their alerts silently dropped. Using per-licence keys ensures every paying customer gets an independent allowance, which also aligns with what the rate limit is actually meant to control. The developer also namespaced rate-limit keys per endpoint to prevent licence validation calls from consuming the budget meant for notification delivery.

0 comments Read more at DEV Community
0
ProgrammingHacker News ·

Developer builds a functional ray tracer using the Brainfuck programming language

A developer has created a ray tracer implemented entirely in Brainfuck, one of the most minimalist and deliberately difficult esoteric programming languages. Brainfuck operates with only eight commands, making complex computational tasks like ray tracing extremely challenging to implement. The project was documented in a technical blog post detailing the development process and approach taken. The achievement has drawn attention in the programming community, sparking discussion on Hacker News about the complexity involved.

0 comments Read more at Hacker News
0
ProgrammingDEV Community ·

AI Cuts Code Costs, But Quality Definition and Validation Remain Expensive

A analysis published on DEV Community challenges the popular claim that AI renders software valueless by arguing it conflates production cost with product value. Drawing on Philip Crosby's 1979 definition of quality as conformance to requirements, the piece breaks software development costs into two axes: defining quality and producing conformance to that definition. While AI can generate candidate implementations almost instantly, the work of writing precise requirements, verifying conformance, and validating that definitions are correct remains costly and largely unautomated. The author further applies Boehm's spiral model to argue that exploration activities like prototypes and beta releases are part of quality definition, not mere production, and that unknown unknowns still surface as expensive rework. The conclusion is that implementation is becoming abundant in the AI era, but explicit definitions, traceability, and operational evidence stay scarce and continue to anchor software value.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Why a VAT Validation MCP Server Uses Two Separate Tools Instead of One

Developer building vatnode-mcp, the official MCP server for VAT-validation SaaS vatnode, chose to split VAT validation into two distinct tools: check_vat_format and validate_vat_number. The first performs an instant, free, offline regex check to confirm whether a VAT number matches the expected pattern for a given country. The second makes a live network call to the EU's VIES registry to verify whether the number is actually registered and retrieve the associated company name. Combining both into one tool would force every caller to bear the latency and failure risks of a VIES lookup even when only a quick format check is needed. The design reflects a broader API principle: tools with opposite cost and reliability profiles serve different use cases and should remain separate to avoid silently degrading the quality of answers.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Simple Two-Step Test Reveals Whether AI Models Confuse Your MCP Tools

A developer who analyzed over 82,000 public MCP tool descriptions found that standard lexical metrics fail to detect real-world tool confusion in AI models. The proposed method involves writing two test sentences per suspected tool pair — a control request with a clear single target and a probe request that could plausibly trigger either tool. Each sentence is run through the model multiple times at a fixed temperature, and the routing results are recorded. If the control fails, the issue lies with a single broken description rather than ambiguity between tools; if the probe consistently routes to one tool, no collision exists. Only when the probe splits routing unpredictably is there a confirmed ambiguity, giving developers concrete evidence to act on rather than guesswork.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Build vs Buy: When Writing Your Own PDF Tamper Detection Makes Sense

Deciding whether to build or buy PDF tamper detection hinges on precisely what kind of detection a team actually needs, ranging from a single narrow check to a fully automated verdict system. A quick prototype using tools like pypdf can appear deceptively simple, but the real costs emerge in long-term maintenance, edge cases, and continuous tuning. Building in-house is justified in specific scenarios: when documents are self-generated, when volume is low, when data cannot leave a private network, or when the detection method must be fully explainable to regulators or courts. Conversely, organizations whose core business is fraud detection may find that owning the detection corpus and tuning process is a strategic asset worth investing in permanently. The key takeaway is that 'PDF tamper detection' is not a single problem, and the build-or-buy decision should only be made after clearly defining which version of that problem is actually being solved.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

CERT Polska Links 20 Malicious Android Apps via Shared TLS Certificate and DNS Patterns

CERT Polska's September 23, 2026 report details an investigation into a mobile toll fraud campaign that connected 20 applications through infrastructure evidence rather than malware code similarity. Six apps were confirmed to contain toll fraud components or direct payload links, while eleven others carried malicious loaders tied to the same operation through shared ad destinations and activation logic. A single reused Let's Encrypt certificate, observed across five independently recovered server addresses, served as a key linking artifact across the campaign's infrastructure. Additional connections included automated domain registration through Amazon Registrar within a narrow two-month window, shared WHOIS field hashes across multiple parent domains, and identical C2 fallback addresses embedded in separate app versions. The report carefully distinguishes confirmed participants from apps that merely reused advertiser accounts, noting that two comic-reader apps showed account reuse but not direct involvement in the fraud operation.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Kubernetes 1.37 KYAML Fix Exposed: Null Values Still Silently Deleted on Apply

Kubernetes 1.37 introduced KYAML (KEP-5295) as a stricter YAML dialect aimed at eliminating long-standing YAML 1.1 parsing bugs, such as unquoted country codes like 'NO' being misread as boolean false. A hands-on test against a live 1.37.0 API server using 13 hand-crafted ConfigMap manifests revealed that 12 out of 13 ambiguous values caused failures of some kind. Boolean-looking and number-like values triggered loud server-side rejections, preventing silent data corruption in those cases. However, null-equivalent values — specifically 'null' and '~' — were accepted without error, but their corresponding keys were silently dropped from the stored ConfigMap entirely. This means KYAML addresses some YAML ambiguity issues but does not yet protect against data loss when null-type values are applied to a live cluster.

0 comments Read more at DEV Community
← NewerPage 935 of 3186Older →