SShortSingh.
TopTechnologyAI & MLStartupsProgrammingScienceBusinessFinanceCrypto & Web3World

Programming

LatestTopDiscussed
0
ProgrammingDEV Community ·

GE Vernova Engineer Open-Sources Free Web-Based CNC Machining Calculator

Li Lu, a machining development engineer at GE Vernova in Singapore with over a decade of CNC experience, has built and open-sourced a free web-based CNC machining calculator. The tool covers six core calculations including spindle speed, feed rate, chip load, cutting speed, material removal rate, and drilling parameters, each derived from clearly stated engineering formulas. Built with modular Python 3.12, the calculator features automated pytest unit tests and GitHub Actions CI to ensure no formula errors reach the live tool. The front end uses plain HTML, CSS, and JavaScript with no frameworks, making it fast to load on shop-floor tablets, and requires no account or login. Lu designed the tool to be fully transparent and auditable, addressing a gap he observed in existing machining apps and paper catalogs used in daily shop-floor work.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

OAuth 2.0 Device Flow Enables Secure Login on Smart TVs, CLIs, and Consoles

OAuth 2.0 Device Authorization Grant, known as Device Flow, solves the authentication challenge for devices like smart TVs, game consoles, and CLI tools that lack convenient input methods. Instead of logging in directly on the device, the user completes authentication on a separate phone or computer by visiting a verification URL and entering a short code. The original device receives a device code and user code from the authorization server, then repeatedly polls the token endpoint until the user finishes authenticating. Once the user approves access, the authorization server issues an access token that the original device uses to call protected APIs. The device must also handle intermediate responses such as authorization_pending, slow_down, expired_token, and access_denied to manage the polling process correctly.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Jev Skill Family Becomes First to Score Perfect 10 on Security Across All Members

A family of five AI agent skills called Jev has become the first group to achieve a perfect 10/10 security score across all members in a skill evaluation directory that rates tools on six dimensions. The five skills — covering classification, evaluation, evidence extraction, workflow design, and action selection — are built to work as a composed system rather than standalone prompt wrappers. Each skill handles one specific type of judgment and returns a decision to the host agent, deliberately avoiding actions like browsing, executing code, or sending data. Notable features include a smoke-test pattern for bulk classification, citation-preserving evidence extraction that reports when no match is found, and an action-selection skill that explicitly separates selection from execution. The open-source repository, licensed under MIT and CI-tested, documents 108 scenarios and 14 recorded input/output pairs for transparency and verification.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Developer Proposes L3 Payment Incident Triage Task for Enterprise AI Benchmark

A developer has submitted a pull request to Enterprise-Bench, an open benchmark designed to evaluate how well AI agents handle complex, real-world enterprise tasks. The proposed Level 3 task challenges AI agents to triage a fictional payment incident by independently identifying which systems and evidence are relevant, without being given a prescribed investigation path. Agents must correlate engineering data, customer records, and internal business information to pinpoint the most consequential problem and assess its operational or compliance impact. Unlike simpler benchmark tasks, the agent is not instructed to take any remedial action and must stay within read-only access boundaries while producing a fully evidence-grounded assessment. The contributor disclosed receiving a $25 payment from DevRev to write about the project, but stated that positive coverage was not required.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

AI Code Reviewers in CI Pipelines Need Their Own Test Suites, Experts Warn

AI-powered code reviewers integrated into pull-request pipelines can silently degrade over time when prompts are tweaked or model versions are updated, often without anyone noticing. Unlike the code they evaluate, these AI reviewers typically have no test coverage of their own, leaving teams unaware of regressions in bug-detection behavior. A structured testing approach involves collecting real or synthetic pull requests with known, labeled defects and running them through the reviewer to assert whether specific findings are correctly flagged or appropriately omitted. Using tools like Python, pytest, and structured JSON output, developers can define fixtures that pin both precision and recall, checking that a reviewer catches genuine issues without flooding teams with irrelevant noise. The core argument is that an AI system making judgment calls on every commit in an organization warrants the same quality assurance discipline applied to any other production software component.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

CaseGuard Uses TigerGraph and AI to Investigate Fraud With Built-In Uncertainty Checks

Developers have built CaseGuard, an autonomous AI fraud investigation system that combines TigerGraph, GSQL, GraphRAG, and agentic reasoning to analyze suspicious financial transactions. Unlike traditional fraud systems that rely on static thresholds, CaseGuard is designed to withhold judgment when confidence is low, instead requesting additional evidence before recommending an action. The system uses native graph queries to detect patterns such as card testing, device-sharing across multiple accounts, and geographic anomalies in transaction history. Completed investigations are stored back into TigerGraph as institutional memory, allowing the system to reference past cases — for instance, using a cardholder's legitimate travel history to clear a false alert. When reporting thresholds are met, CaseGuard can also automatically generate structured FinCEN Suspicious Activity Report narratives, reducing manual documentation work for investigators.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

How to Fix the 'Enable JavaScript and Cookies to Continue' Error

The 'Enable JavaScript and cookies to continue' message appears when a website protected by Cloudflare or a similar Web Application Firewall detects that the client browser fails its minimum security requirements. The protection works by injecting a JavaScript challenge to confirm the visitor is a real browser rather than an automated script or misconfigured headless browser. Common triggers include using Python's requests library without a solver, disabled cookies, strict privacy extensions, or VPNs that alter HTTP headers. Developers can resolve the issue programmatically by using tools such as cloudscraper for Python or puppeteer combined with cloudflare-bypass for Node.js, both of which simulate a real browser environment. Regular users should ensure JavaScript and third-party cookies are enabled in their browser settings and temporarily disable privacy extensions like uBlock Origin.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Dev Guide: Use a Mini Evidence Card to Catch State-Change Bugs at Release

A software development practice proposes attaching a small 'evidence card' to pull requests when releasing features that involve shared state, such as booking reschedules. The card documents intended behavior, adjacent paths tested, production signals to monitor, and a named rollback owner with a clear decision threshold. The approach addresses a common gap where a passing CI test confirms the changed feature but leaves adjacent behaviors — like reminders tied to an old appointment time — unverified. A pure-function JavaScript example illustrates how targeted unit tests can surface forgotten state updates, while the author notes that integration and production checks remain separately necessary. The goal is to make the scope of verification explicit and to record what was actually observed after deployment, rather than treating a green build as full proof of correctness.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

MCP OAuth Confirms Identity But Cannot Authorize Individual Tool Calls

The 2026-07-28 MCP specification strengthens authentication through issuer validation, CIMD direction, and Mcp-Method/Mcp-Name headers, but these advances address only identity verification. Authentication (AuthN) confirms who is making a request, while tool-call authorization is a separate decision determining whether that principal may execute a specific tool in a given context. Risk levels vary significantly across operations — a read action carries far less risk than a financial transaction or a destructive database command. A recommended architecture routes requests through an MCP client, gateway, and Policy Decision Point (PDP) before reaching the MCP server, with deny-by-default rules and step-up checks applied to high-risk operations.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

How JWT Tokens Carry Identity and Permissions Across Microservices

In microservice architectures, every request requires context about who is making it and what they are allowed to do, which is handled through JWT access tokens created at login. A User Profiles Service issues these tokens via two endpoints — one returning a full login response and another returning only a Bearer token for callers that already have user context. Before generating a token, the service verifies the user's password, resolves their relationships to projects, accounts, and organizations, and retrieves permissions from a dedicated permissions service. The resulting JWT payload contains not just a user ID but a full security context including project, account, organization, group, and per-service permission mappings. This graph-like linking model ensures that authorization decisions across services are based on verified, structured context rather than raw request headers.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Dev.to's Underused API Can Reconstruct Your Full Follower History in One Pull

A developer who has been publishing on Dev.to since April 2017 used the platform's largely overlooked public API to analyse nine years of their own writing and audience data. By querying the followers endpoint with the correct v1 accept header and a per_page value of 1000, they reduced a 227-request operation to just 19 calls. A key discovery was that each follower record includes a created_at timestamp, allowing the entire follower growth curve to be reconstructed retroactively from a single API pull rather than daily snapshots. However, the dataset only reflects current followers, meaning anyone who unfollowed is absent and the resulting curve rises monotonically, masking any real-world declines. The author notes that omitting the v1 accept header silently returns older v0 data with no error, a subtle gotcha that can cause documented fields to appear missing.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

How to Build Production-Grade Mobile Apps With Failure-First Architecture

A technical guide published on DEV Community outlines a failure-first approach to designing production-grade mobile applications, arguing that real engineering complexity lies beneath seemingly simple user interactions. The guide emphasizes defining clear system boundaries and layer ownership — separating presentation, domain, and data concerns — rather than starting with a list of screens. It warns against representing UI state with unrelated booleans, which can produce impossible combinations, and instead recommends sealed state interfaces to model meaningful transitions explicitly. The principles discussed are framework-neutral but are said to apply well to Kotlin/Android, Swift/iOS, Flutter, and React Native. The article also addresses offline-first behavior, network failure handling, and recovery strategies as essential considerations for scalable mobile codebases.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

How Freelance Developers Can Use Milestone Payments to Avoid Disputes

Freelance software developers often face late or withheld payments due to poorly defined project structures rather than bad-faith clients. Structuring projects into clearly defined milestones — such as spec, core build, completion, and handover — with explicit deliverables and acceptance criteria can prevent most payment conflicts. Each milestone should specify which features must work, which tests must pass, and include a fixed client review window, after which silence is treated as approval. Escrow arrangements, where clients fund each milestone before work begins and funds are released upon approval, add a neutral safeguard for both parties. Keeping the final milestone at 20% or less of the total budget and treating all out-of-scope requests as separately priced milestones further reduces financial risk for developers.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

GitHub OIDC Sub Claim Format Change Breaks AWS Deployments for New Repos

A developer discovered that GitHub Actions deployments to AWS S3 were silently failing due to a mismatch in the OIDC token's subject claim format. GitHub introduced a new sub claim format in April 2026, embedding numeric owner and repo IDs into the string, replacing the older name-only format used in IAM trust policies. Repositories created after July 15, 2026 receive this new format by default, causing AWS STS to reject role assumption requests when trust policies still reference the old pattern. The change was designed to prevent trust policy hijacking, where an abandoned repo name could be reclaimed by another user to spoof the original subject claim. The fix requires updating the IAM trust policy condition in Terraform to match the new format that includes the numeric GitHub owner and repository IDs.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Developer Builds Unified AWS Access Key Monitor to Flag Stale or Risky Credentials

A developer created a dedicated visibility tool called Kultarr to help teams track and manage AWS access keys more effectively. The tool surfaces key details such as age, usage history, privilege level, and whether root account keys exist, all in a single view. The motivation came from a common real-world problem: access keys created for scripts or CI jobs often remain active long after they are no longer needed. Unlike generic security dashboards, Kultarr adds context to distinguish between, for example, an aged read-only key and an equally aged administrator key. The project is in early development, and the creator is building it around practical AWS security challenges encountered firsthand.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

DirectSurface 0.1.0 brings dockable, Canvas-based workspace UI framework to npm

A developer has released DirectSurface 0.1.0, an MIT-licensed TypeScript package on npm that enables building desktop-style browser workspaces using the HTML Canvas API. The framework offers layouts, dockable panels, data grids, charts, forms, and overlay management, targeting data-heavy back-office applications where consistent control behavior across long sessions is critical. It was created to reduce the application-level state coordination overhead the author encountered when using Vue and React for dense, multi-view interfaces. The release includes a live demo featuring a project delivery workbench and a Canvas workspace with a 10,000-row scrollable grid, both built using the public package API. Notably, this version does not support assistive-technology accessibility, as Canvas controls are not exposed as semantic DOM elements, making it unsuitable for content sites requiring native page semantics.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Developer benchmarks his own PDF-to-Markdown tool against rivals, publishes losses

A developer who built a PDF-to-Markdown converter called CleanMD ran a structured benchmark comparing it against Microsoft's MarkItDown and Artifex's pymupdf4llm across five diverse public documents, including an RFC, a SCOTUS opinion, and an arXiv paper. The test measured section heading recall, code block detection, and table quality using ground truth derived from the documents themselves rather than any tool's output. CleanMD initially missed 11 RFC headings due to a font-parsing bug where hyphens triggered a second font subset, a flaw the developer fixed the same day but kept in the published results to avoid presenting a misleading after-only picture. pymupdf4llm led on heading recall and fence count, though many of its fences wrapped single inline code words rather than full blocks, while MarkItDown produced cleaner tables on the NIST document but detected zero headings in it. The developer published the benchmark openly, including the areas where his own tool underperformed, framing it as a transparency exercise rather than a marketing exercise.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

How a Single Postgres Exclusion Constraint Prevents Double Bookings in a Parking App

Developer building ParkEase, a peer-to-peer parking marketplace in India, faced a classic race condition where two users could simultaneously book the same parking slot. Instead of using application-level locks, Redis mutexes, or serializable transaction retry loops, the developer solved the problem with a single PostgreSQL exclusion constraint on the booking_slots table. The constraint uses a GiST index to ensure no two confirmed or active bookings can share the same space, vehicle type, slot index, and overlapping time period. Cancelled or released bookings are excluded from the constraint via a WHERE predicate, preserving historical records while immediately freeing slots. The approach centralises the no-overlap rule entirely within the database, making it impossible for any code path to accidentally bypass it.

0 comments Read more at DEV Community
← NewerPage 959 of 3188Older →