SShortSingh.

Programming

0
ProgrammingDEV Community ·

Why AI Coding Agents Lose Engineering Context Between Sessions

AI coding agents can read and modify codebases effectively, but they often lack access to the reasoning behind engineering decisions made in previous sessions. A developer working on long-term projects observed that agents could see what a rule was but not why it existed, who approved it, or what depended on it. This creates risk when agents fill knowledge gaps with reasonable-sounding inferences that quietly become part of the codebase. The author argues that different types of engineering knowledge — product requirements, architectural decisions, verification results — need distinct, authoritative homes rather than being lumped into a single prompt or instruction file. The proposed solution involves structuring knowledge so that missing decisions surface as explicit gaps requiring human input before implementation begins, not after.

0
ProgrammingDEV Community ·

Add a security.txt File Now to Meet EU Cyber Resilience Act Requirements

RFC 9116 defines a simple plain text file placed at /.well-known/security.txt that gives security researchers a clear, standardised way to report vulnerabilities in a product. The file requires just three core fields — Contact, Expires, and Canonical — and can be deployed in under ten minutes with no build tools or dependencies. The EU Cyber Resilience Act, which takes full effect on 11 December 2027, mandates a coordinated vulnerability disclosure policy and a public contact address under Annex I, Part II; a valid security.txt Contact field directly satisfies the latter requirement. Fines under Article 64 of the Act also kick in from that same December 2027 deadline, making early preparation advisable since drafting a thorough disclosure policy takes considerably longer than creating the file itself. Security professionals note that without such a file, researchers who discover bugs may resort to public disclosure or simply abandon the report altogether.

0
ProgrammingDEV Community ·

Codelux Tool Gives AI Coding Agents Persistent Memory Across Sessions

A developer has built Codelux, a local daemon tool designed to solve the problem of AI coding agents losing all project context at the end of each session. The tool indexes a codebase locally in seconds, storing files, symbols, call flows, and developer decisions in a local database that persists between sessions. When a new session begins, the agent queries this stored memory instead of re-reading entire files, which the creator claims can reduce token usage by up to 90% on individual file reads. A Team plan allows multiple developers or agents on the same project to share decisions and notes in near real-time with end-to-end encryption. Codelux works via the MCP protocol on localhost and is compatible with tools like Claude Code, Cursor, Codex, and VS Code, with a free tier available for one project per machine.

0
ProgrammingHacker News ·

Ink & Switch Launches Interactive Homepage for Research Lab

Ink & Switch, an independent technology research lab, has launched a new interactive homepage at inkandswitch.com. The updated site appears designed to showcase the lab's ongoing research projects and work in an engaging, hands-on format. The link was shared on Hacker News, garnering modest early attention with 6 points. The lab is known for its work on tools for thought, local-first software, and collaborative computing research. No further details about the specific interactive features were provided in the submission.

0
ProgrammingDEV Community ·

Developer Documents 8 Undisclosed M-Pesa STK Push Behaviors That Can Break Payment Systems

A developer building an open-source mobile money gateway conducted systematic tests on Safaricom's Daraja STK Push API between September 18–23, 2025, using the sandbox environment. A critical finding reveals that the API password is merely Base64-encoded — not hashed — meaning anyone who accesses a request body, debug log, or APM trace can recover the passkey, and no documented revocation endpoint exists. Error code 500.001.1001, widely interpreted as 'transaction does not exist,' was observed returning unreliably even for confirmed live transactions, making it an unsafe basis for payment status decisions. The AccountReference field chosen by the caller is neither idempotency-safe nor echoed back in the response, meaning duplicate submissions can generate two separate payment prompts for a single order. The developer recommends treating request bodies as secret-bearing, building idempotency into the caller's own system, and treating ambiguous error codes as 'unknown — retry later' rather than definitive failures.

0
ProgrammingDEV Community ·

Power BI Data Modelling: From Flat Tables to Star Schema Explained

Data modelling in Power BI involves organizing tables, defining relationships, and establishing rules that govern how data is stored, filtered, and queried. A flat table structure, where all data exists in a single table, leads to significant redundancy, bloated file sizes, and poor performance. The star schema is the industry-recommended design pattern, featuring a central fact table surrounded by descriptive dimension tables. In a retail example, a FactSales table holds transactional data linked via foreign keys to dimension tables like DimDate, DimCustomer, DimProduct, and DimStore. A well-designed data model improves analytics accuracy and simplifies DAX calculations in business intelligence solutions.

0
ProgrammingHacker News ·

Opinion: Why the Tech Industry Needs More Humanities-Trained Professionals

A recently published opinion piece argues that the technology sector needs humanists more than ever. The article, hosted on passo.uno, makes the case for integrating humanities expertise into tech environments. It gained traction on Hacker News, accumulating 14 points and at least one comment. The piece reflects a broader ongoing debate about the role of liberal arts and humanistic thinking in shaping responsible and effective technology development.

0
ProgrammingDEV Community ·

Tutorial unifies Python, PHP, Prometheus, Loki and OpenTelemetry into one Docker Compose stack

A DEV Community tutorial series has culminated in a single Docker Compose configuration that integrates all previously built observability components, including Python and PHP mini-apps, Prometheus, Loki, and Grafana. The key addition in this final article is an OpenTelemetry Collector, which acts as a central intermediary to receive distributed traces from both applications via the OTLP protocol. Previously, apps exported spans directly to the console for testing; now they forward telemetry to the collector, which handles routing to any backend without requiring changes to individual applications. The setup uses a debug exporter to confirm the full pipeline works end-to-end, while noting that a dedicated tracing backend like Grafana Tempo or Jaeger would be needed for visual span exploration. The author positions this as a natural next step for developers looking to deepen their observability practice beyond this introductory series.

0
ProgrammingDEV Community ·

Reciprocal Rank Fusion Combines Vector and Keyword Search for Better RAG Retrieval

Retrieval-Augmented Generation (RAG) systems often struggle because vector search excels at semantic similarity but fails on exact tokens like error codes, while keyword search does the opposite. Reciprocal Rank Fusion (RRF), a technique introduced in a 2009 paper by Cormack, Clarke, and Buettcher, solves this by ignoring raw scores entirely and combining results based solely on document rankings from each search method. The core formula assigns each document a fused score by summing the inverse of a constant k plus its rank across all result lists, making scores from incompatible systems directly comparable. A damping constant of k=60 is the widely accepted default, ensuring top-ranked results carry more weight without completely overshadowing lower-ranked ones. Because RRF only requires ordered lists rather than raw scores, it can be applied to any combination of rankers, including dense retrievers, lexical indexes, and rerankers simultaneously.

0
ProgrammingDEV Community ·

Why a 200 OK Response Can Still Display the Wrong Data to Users

A subtle UI bug can cause web forms to display results from an outdated request when a user edits their input before the server responds. For example, if a user changes a shipping destination mid-request, the earlier response may render beneath the newer input, making incorrect data appear valid. This race condition is independent of server correctness — the response is accurate for its original request, but wrong for the current user intent. Developers can prevent this by assigning each request a revision number tied to the user's latest input, and only allowing the most current revision to update the interface. Stale successes, errors, and loading states must all be guarded against to ensure the displayed result always reflects what the user actually submitted.

0
ProgrammingDEV Community ·

Why Your AI Prototype Cannot Replace a Real Operations System of Record

AI demos and vibe-coded prototypes can quickly showcase ideas and speed up individual tasks, but they lack the structure needed to run business-critical operations. A true system of record requires multi-user roles, durable records, approval workflows, audit trails, and reliable behaviour under concurrent use. Companies risk serious operational failures when a prototype built for a boardroom presentation is asked to manage payroll handoffs, stock, disbursements, or regulated approvals. The recommended approach is to first establish a proper system of record for a core business journey, retire informal tools like spreadsheets and WhatsApp as sources of truth, and then layer AI on top as an accelerator. AI delivers the most value when it works with clean, trustworthy data rather than as a substitute for sound operational infrastructure.

0
ProgrammingDEV Community ·

Free browser-based PDF tool processes files locally with no server uploads

A developer has launched HandleMyFile, a free online PDF tool that processes files entirely within the user's browser using WebAssembly technology. Unlike most free PDF tools, it does not upload or store files on any backend server, keeping data in the device's RAM only. The tool works offline and requires no internet connection once loaded. It supports 30 languages and offers instant processing speeds by eliminating upload wait times.

0
ProgrammingDEV Community ·

How to Fix Cursor IDE Stuck on 'Waiting for Extension Host'

Cursor IDE users have been reporting a recurring issue where the editor hangs on a 'Waiting for Extension Host' message, causing extensions, AI features, and Git tools to stop working. The quickest fix is to open the command palette and run 'Developer: Restart Extension Host', which relaunches the host process without closing open files. If the problem persists, restarting Cursor with extensions disabled helps identify a faulty extension by re-enabling them in batches. A corrupted SQLite session file stored in the app's user data folder can also block the host from loading and should be deleted or renamed before restarting. Other common causes include aggressive folder indexing, stale WSL or Remote-SSH mounts, and antivirus software interfering with the host process.

0
ProgrammingDEV Community ·

Two-Pass Grading Pipeline Uses Heuristics and Local LLM to Filter Tech Messages

A developer building a message-grading system on limited hardware — an RTX 4050 with 6GB VRAM and an Intel i7 — has detailed how the pipeline processes data without blindly feeding it to a local LLM. Before any LLM call is made, a heuristic layer using length checks and regex filters out obvious noise, eliminating roughly 12% of redundant messages in real runs. Each remaining message is then graded individually by the LLM on a scale of 1 to 5, where higher scores indicate clear technical value such as solutions, useful resources, or practical results. The system intentionally keeps heuristic filtering lenient to avoid dropping important messages, relying on the LLM as a safety net for borderline cases. Results are stored in JSON format during the MVP phase, with scalability improvements planned for later stages of development.

0
ProgrammingDEV Community ·

How AI Systems Monitor Hidden Market Signals to Flag Financial Crises Early

AI systems can potentially detect financial crises before they fully materialize by tracking subtle structural shifts such as declining liquidity, widening spreads, and rising cross-asset correlations rather than waiting for visible price drops. Unlike human analysts, these systems can continuously monitor thousands of market relationships simultaneously, identifying when normal patterns begin to break down. Liquidity is considered a particularly telling early indicator, as order books often thin and bid-ask spreads widen before prices reflect underlying stress. In crypto markets, blockchain data adds a further layer of real-time signals, including exchange flows, large-holder transactions, and derivatives positioning. The goal is not to predict exact price moves but to detect when the financial system's behavior itself is changing in ways that historically precede periods of severe stress.

0
ProgrammingDEV Community ·

F-Droid 2.0 Launches Days Before Google Enforces Android Sideloading Rules

F-Droid released version 2.0 on September 24, 2025, just six days before Google begins enforcing developer identity verification for app installations on certified Android devices starting September 30. The rebuilt client features a Kotlin and Jetpack Compose codebase, improved search, combinable filters, and default auto-updates, and underwent an independent security audit after over a year of development. Google's new rule requires all sideloaded apps on certified devices to be tied to a verified developer's signing key, with initial enforcement in Brazil, Indonesia, Singapore, and Thailand before a planned global rollout in 2027. The policy creates a structural challenge for F-Droid, which builds apps from source and signs roughly 85% of its catalog with its own key rather than the original developer's key. Reproducible builds are considered the clearest solution, as they would allow F-Droid to distribute developer-signed APKs, but coverage remains only partial today.

0
ProgrammingDEV Community ·

Developer builds 59 privacy-first browser tools in vanilla JS with zero dependencies

A developer has publicly launched Antigravity Tools, a collection of 59 free, browser-based utilities built entirely in vanilla JavaScript with no external dependencies, backend servers, or analytics. The project was motivated by privacy concerns with popular online tools, such as JWT decoders and regex testers, which can log user data on remote servers. All operations run locally in the user's browser using native APIs including Web Crypto, Canvas, Web Audio, and IndexedDB. The toolkit covers a wide range of developer needs, including JWT inspection, RSA key generation, JSON formatting, cURL conversion, regex testing, and AI prompt utilities. The tools are freely accessible at antigravitytools.app, with the developer sharing technical learnings from the build process.

0
ProgrammingDEV Community ·

Why SaaS Businesses Should Re-Validate VAT Numbers at Every Subscription Renewal

A VAT ID verified at the time of purchase only confirms validity on that specific date, not on future invoice dates. Under EU VAT rules, each subscription renewal constitutes a new supply, meaning businesses must hold valid evidence of a customer's VAT status for each individual invoice. A customer's VAT registration can lapse, be suspended, or change between renewals without any notification to the supplier. Hooking into a billing provider's renewal event to re-check VAT IDs just before each invoice is generated helps close this compliance gap. While no EU regulation mandates a specific re-validation frequency, aligning checks with the billing cycle is a practical, low-cost approach recommended in consultation with a tax adviser.

0
ProgrammingDEV Community ·

How to Safety-Test an AI Agent's SAP Integration Before Going Live

Before connecting an AI agent to SAP via Model Context Protocol (MCP), security and access controls must be validated beyond simple connectivity checks. Developers are advised to test denied scenarios—such as out-of-scope data requests, expired sessions, and unauthorized operations—as formal acceptance criteria, not afterthoughts. Each test should change only one condition at a time and record the principal, target system, scope, and outcome to confirm that authorization decisions are enforced server-side, not just hidden from the interface. Write operations require additional scrutiny, including testing that post-approval changes invalidate prior approvals and that timeouts are reconciled against actual downstream outcomes. MCP authorization is explicitly noted as a complement to—not a replacement for—SAP's own roles and authorization objects.

← NewerPage 936 of 3186Older →