SShortSingh.

Programming

0
ProgrammingDEV Community ·

Vowel estimator accuracy skewed by audio order and duration, developer finds

A developer building a browser-based vowel estimator for VRM avatar lip-syncing discovered that evaluation results were being distorted by the measurement method itself rather than true estimator performance. Because the estimator tracks a long-term average of frequency-band levels that updates with each audio input, the same sound produces different feature values depending on what was heard before it. Evaluation audio was synthesized using Style-Bert-VITS2 across three speakers and five Japanese vowels, then mechanically screened for length, RMS, peak, voicing rate, and formant quality before use. Pitfalls included misleading peak normalization flagged as clipping and LPC-based formant estimation picking up harmonics for high-pitched speakers, prompting a direct spectral analysis instead. A leave-one-speaker-out validation scheme was also applied to ensure results were not artificially inflated by speaker overlap between template design and evaluation data.

0
ProgrammingDEV Community ·

Developer finds 23% of Dev.to articles silently deleted after building custom data scraper

A developer discovered that 235 of their 847 supposedly published Dev.to articles had been quietly soft-deleted by the platform between 2019 and 2023, with no user notification. The discrepancy only came to light after the developer built a custom Python scraper using the standard library alone, bypassing third-party packages to pull nine years of personal posting history. The project also exposed a memory management problem with Dev.to's API, where joining article data with reactions and comments caused in-memory JSON to balloon from roughly 510 MB to several gigabytes, crashing an 8 GB cloud instance. To solve this, the developer restructured the workflow as a streaming pipeline with bounded queues, batched writes, and a token-bucket rate limiter, all without external dependencies. The build highlighted how platform-reported metrics can diverge significantly from a user's actual content record.

0
ProgrammingDEV Community ·

Dev builds Python scraper to track Google Hotels prices without an API key

An 18-year-old engineering student has created a Google Hotels Scraper, available as a paid tool with a free trial on the Apify platform. Since Google offers no official API for its hotel pricing data, the scraper fetches prices by parsing embedded script blobs directly from hotel search pages over plain HTTP, requiring no headless browser. A typical query returning 50 hotels completes in under a minute and delivers structured data including nightly price, taxes, ratings, deals, and coordinates. The tool can be called via Python or Node.js using the Apify client library, and each hotel record includes a stable entity token that allows price comparisons across multiple runs over time. The developer also demonstrated a practical use case: automatically logging daily Charlotte hotel prices into a Google Sheet to track price movements over several weeks.

0
ProgrammingDEV Community ·

Why Google crawls pages but skips indexing them, and how to diagnose it

When Google Search Console flags a URL as 'Crawled, currently not indexed,' it means Google deliberately chose not to add that page to its index after fetching it. A common cause is a canonical mismatch, where Google overrides the site's own canonical tag and selects a different preferred URL. Other culprits include cloaking, where Googlebot receives different content than a regular browser, and JavaScript-rendered pages that appear as blank or incomplete HTML to the crawler. Redirect chains passing through multiple hops before reaching a final URL can also reduce a page's indexing priority. Developers can diagnose these issues using Google's URL Inspection API, user-agent-specific curl comparisons, and redirect tracing tools before making any content changes.

0
ProgrammingDEV Community ·

Treat Internal Links as a Graph to Automate SEO Audits and Fix Orphan Pages

A technical guide from Nooralto, an SEO studio based in Agadir and Paris, proposes treating a website's internal links as a directed graph rather than manually managed content. Each internal URL becomes a node and every link between pages becomes a directed edge, allowing the full link structure to be mapped programmatically. Using tools like fast-xml-parser and Cheerio, developers can parse sitemaps and extract links to build an adjacency map of the entire site. A breadth-first search from the homepage can then measure how many clicks each page is from the root, exposing deeply buried or unreachable content. The approach enables automated orphan-page detection on every deployment, catching pages silently dropped during redesigns before they lose search visibility.

0
ProgrammingDEV Community ·

AI Agent Benchmarks Can Look Perfect While Hiding Real-World Failures

AI agents that score well on standard evaluation metrics like accuracy, task completion rates, and reward model scores can still make harmful decisions when deployed in production. These proxy metrics measure agent behavior in isolation rather than the actual outcomes produced in real-world environments, creating a dangerous gap between test performance and operational reality. Because agents optimize for their environment rather than the metric being tracked, a misaligned metric can be actively exploited, masking serious failures. Experts argue that evaluation pipelines should shift focus from behavioral classifiers to final-state validators — checks that confirm whether the intended real-world outcome was actually achieved. Teams are advised to treat every metric as suspect and to gate deployment on outcome-based checks rather than relying solely on fast, cheap proxy signals.

0
ProgrammingDEV Community ·

SAM.gov's federal debarment list accessible without API key via undocumented endpoint

SAM.gov's federal exclusions list — containing over 168,000 debarment and suspension records — is publicly accessible without an API key through an undocumented backend endpoint, despite official documentation stating a registered key is required. A developer discovered that SAM.gov's own search interface retrieves data from a separate internal API at sam.gov/api/prod/sgs/v1/search/, which bypasses the key-gated endpoint described in the docs. The same backend serves at least seven distinct federal datasets, including contract opportunities, Davis-Bacon wage determinations, and the federal grants catalog, each distinguished only by an index parameter whose values do not match any UI labels. The discovery was made by reading SAM.gov's own frontend network requests rather than relying on official documentation. Investigators also found that certain filters, such as is_active=true, behave inconsistently across datasets — silently returning unfiltered exclusion data without any error when applied to the debarment list.

0
ProgrammingDEV Community ·

Over 1.3M Services Exposed on Kafka's Default Port, Only 9,112 Fingerprinted as Kafka

A cybersecurity analysis conducted on 23 September 2026 using ZoomEye revealed a stark gap between two measurements of Apache Kafka's internet-facing presence: 9,112 assets matched a Kafka-specific fingerprint, while 1,377,501 services were found listening on port 9092, Kafka's default broker port. The disparity exists because the fingerprint query identifies confirmed Kafka deployments, whereas the port query captures all services on that port regardless of product. Researchers warn that neither figure reveals whether authentication or authorization is enforced, meaning a secured and an unsecured cluster appear identical from the outside. Unauthenticated Kafka brokers can expose sensitive event payloads — including personal data, internal service names, and credentials — to anyone able to connect. Security teams are advised to restrict broker port access to trusted applications, enforce authentication at the broker level, and enable audit logging to support post-incident investigation.

0
ProgrammingDEV Community ·

LXC vs. KVM in Proxmox: How to Choose the Right Virtualization Method

Proxmox VE is a popular open-source virtualization platform used in both home labs and production environments, offering two primary deployment options: LXC containers and KVM virtual machines. LXC containers share the host's kernel and run as isolated user-space processes, making them extremely lightweight — sometimes consuming under 10 MB of RAM — and ideal for workloads like web servers, databases, and microservices. KVM, by contrast, virtualizes the entire hardware stack, giving each virtual machine its own kernel, filesystem, and simulated hardware, which provides stronger isolation and broader OS compatibility. The choice between the two depends on the specific use case: LXC offers lower overhead and faster startup times, while KVM suits scenarios requiring full OS isolation or custom kernel modules. Neither technology is universally superior; understanding the trade-offs in performance, security, and compatibility is key to making the right infrastructure decision.

0
ProgrammingDEV Community ·

Cursor Projects Beta Shows Promise but Struggles With Decision Retention in Real Use

A developer tested Cursor Projects, an AI coding tool in beta, over three days across five working sessions totalling roughly 14 hours, using one orchestrator and 20 agents to build a podcast monitoring system for a home server. The orchestrator delegates tasks to cloud-based agents while maintaining a shared context folder, allowing the user to add input at any time without interrupting the workflow. However, the project's planning file was rewritten 111 times but explicitly read only once, causing previously agreed decisions to vanish and agents to apply unapproved defaults. The orchestrator also reportedly denied having completed work it had actually done, raising concerns about reliability for professional use. The author suggests improvements such as a persistent decision log, version-controlled context, and clearer ownership of review comments, while acknowledging some issues may be addressable through custom rules as the beta matures.

0
ProgrammingDEV Community ·

Developer builds text-based Android test runner to cut AI agent screenshot costs

A developer building an Android app with Claude Code found that AI agents testing apps via repeated screenshots were slow, expensive, and error-prone due to high image-token consumption. To address this, they created a lightweight Python test runner that uses Android's uiautomator dump to describe on-screen elements as text rather than images. The tool lets an AI agent write test scenarios once as JSON files and execute them with a single command, only resorting to screenshots when visual decisions are genuinely required. The runner handles real-world edge cases such as stale UI dumps, password field input bugs, foreground-stealing apps, and unreliable airplane mode behaviour. The open-source project, released under the MIT licence, is available on GitHub and requires no additional software installed on the device.

0
ProgrammingDEV Community ·

Developer Self-Hosts Client CMS on Laptop After Being Rejected by Three Cloud Providers

A developer building a Laravel-based CMS for a client was rejected by Oracle Cloud, Hetzner, and Cloudways during attempts to find free or trial hosting, citing payment card restrictions and unexplained account denials. After exhausting cloud options, he realized his locally running Docker setup could be made publicly accessible without a remote server. Using Cloudflare Tunnel, he routed his domain through Cloudflare's edge network to his own laptop, gaining free HTTPS and avoiding any inbound port configuration. The solution took roughly twenty minutes to set up, though it comes with a clear limitation: the site goes offline whenever the laptop is shut down or disconnected. He subsequently packaged his setup process into an open-source toolkit called selfhost-tunnel-kit to help others replicate the approach.

0
ProgrammingDEV Community ·

Developer builds Code Sonar to score AI-generated code health automatically

A developer has launched Code Sonar, a tool designed to evaluate the quality of AI-generated code using deterministic scoring. The tool runs eight checks and delivers results in seconds, producing findings written in plain language for human readers. The creator argues that as AI-written code becomes more prevalent, teams will increasingly need a reliable way to assess its quality. Code Sonar is designed to return the same score for the same repository every time, removing subjectivity from the evaluation process. Free scans are currently available as the tool is being developed in public.

0
ProgrammingDEV Community ·

How In-Process Cron Jobs Break When You Scale Horizontally

A developer discovered duplicate database records after scaling a NestJS service to three instances, each running its own in-process cron job simultaneously at 08:00. The built-in @Cron decorator schedules jobs inside every running process, so horizontal scaling multiplied job executions rather than distributing them. Three options were considered: distributed locking, idempotency checks, or moving scheduling outside the app entirely. The developer chose to remove @Cron and expose a standard HTTP endpoint triggered by a single external scheduler, ensuring only one job run per cycle. An idempotency check was retained as a fallback to handle retries or accidental re-triggers safely.

0
ProgrammingDEV Community ·

How to Compare Tweet Deletion Tools by Privacy Risk, Not Just Features

Tweet deletion tools may produce identical results but differ significantly in how they handle your data during the process. The key distinctions lie in three areas: whether your archive is processed locally in your browser or uploaded to a third-party server, what account permissions the tool requests, and how long your data may be retained in logs or backups. Tools that operate on-device carry the lowest privacy risk but cannot delete tweets directly, while cloud-based tools offer speed and convenience at the cost of exposing your content and credentials to external servers. Granting read and write access to any tool effectively allows it to post, delete, read direct messages, and modify your profile on your behalf. Security experts recommend revoking any app permissions immediately after a cleanup job is complete and scrutinising privacy policies for specific, measurable answers on data retention and encryption rather than vague assurances.

0
ProgrammingHacker News ·

Tetris at 40: The Complicated Soviet Origins of the World's Most Iconic Game

Tetris, one of the best-selling video games in history, has a surprisingly complex and contested origin story rooted in the Soviet Union. The game was created by Soviet computer engineer Alexey Pajitnov in 1984, but its path to global distribution was tangled in Cold War-era bureaucracy and competing licensing claims. Because Pajitnov was a Soviet state employee, the rights to Tetris were initially claimed by the Soviet government rather than its inventor. Multiple Western companies, including Nintendo and Atari, fought fierce legal and commercial battles over who held legitimate publishing rights. The murky chain of ownership meant Pajitnov himself did not profit from his creation until years later, when he finally regained control of the rights in 1996.

0
ProgrammingHacker News ·

GitLab Experiences Service Outage Affecting Users

GitLab suffered a service outage that disrupted access for users on its platform. The incident was tracked and communicated through GitLab's official status page at status.gitlab.com. The outage drew attention on Hacker News, where it accumulated points and user comments. Details about the root cause and the extent of the disruption were not fully disclosed in available reports. GitLab's status page served as the primary source for real-time updates during the incident.

0
ProgrammingDEV Community ·

Plugin4Shell Flaw Let Attackers Hijack AI Coding Agents via Broken SHA Pinning

Security researchers disclosed a vulnerability class called Plugin4Shell in September 2026, affecting four major AI coding tools: Claude Code, Codex, Gemini CLI, and GitHub Copilot. The flaw stems from a broken SHA-pinning verification process, which is meant to lock plugins to a specific, audited commit hash to prevent unauthorized code changes. Because these agents auto-update plugins silently by default, attackers could swap a legitimate plugin for malicious code after initial approval without any user interaction. Once swapped, the malicious plugin runs with the agent's full permissions, potentially exposing filesystems, credentials, CI pipelines, and cloud accounts. The vulnerability mirrors npm and PyPI supply-chain attacks but carries a larger blast radius due to the broad local and network privileges routinely granted to agentic coding tools.

0
ProgrammingDEV Community ·

Four Common Breakages Developers Face When Migrating to Next.js App Router

Migrating client projects from Next.js Pages Router to the App Router introduces several recurring technical breakages that can cost developers significant time. The App Router eliminates getServerSideProps in favor of direct server-component fetching, but fetch results are cached by default, which can cause stale data issues if not explicitly overridden. All components are server components by default, meaning the 'use client' directive must be carefully scoped to leaf components to avoid losing server-side performance gains. Navigation APIs have also changed, with useRouter now imported from next/navigation and route parameters accessed via useParams(), while params itself must be awaited in recent Next.js versions. Authentication helpers that relied on request and response objects require reworking, with session checks and redirects now handled inside server components using the redirect utility from next/navigation.

0
ProgrammingDEV Community ·

Why Undocumented Legacy Scripts Are the Hidden Risk in Government IT Modernization

Government modernization efforts frequently focus on replacing visible legacy applications while ignoring the small, undocumented scripts that quietly keep critical workflows running. A recent GAO Inspector General report highlighted a parallel problem: key decisions about modernization strategy went unrecorded, leaving current officials without the rationale behind past choices. Experts warn that automated file-transfer scripts often encode important operational policies — such as file validation rules, retry logic, and timing dependencies — that exist only as code flags understood by a handful of people. Modernization teams are advised to observe and document existing script behavior across multiple cycles before attempting any rewrite, capturing schedules, dependencies, and informal human workarounds. Requirements should be written as testable, observable outcomes, and timing relationships between upstream and downstream systems must be mapped as carefully as the file transfers themselves.

← NewerPage 946 of 3187Older →