SShortSingh.
TopTechnologyAI & MLStartupsProgrammingScienceBusinessFinanceCrypto & Web3World

Programming

LatestTopDiscussed
0
ProgrammingDEV Community ·

Developer Builds Python SDK to Measure True Cost of AI Self-Improvement

An independent developer has created an open-source Python SDK called dream-rsi-sdk, built around the recently published Dream-RSI concept, which improves AI agent behavior by replaying exploration history and rewriting policies offline without changing model weights. The project's central goal is to account for the full cost of self-improvement, including training and validation, rather than reporting only deployment savings. An early experiment using a cloud-based model showed the full process consumed 100 model requests compared to a 24-request baseline, exposing how deployment-only metrics can be misleading. A follow-up local experiment using Ternary-Bonsai-27B-Q2_g64 via llama.cpp yielded a more honest result: the learned policy path cost 248 total operations versus 256 for the fixed baseline, a modest 3.125% all-in reduction with quality unchanged. The developer highlights an amortization insight — the upfront 24-operation preparation cost breaks even after roughly 48 tasks, making the approach increasingly worthwhile at scale.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Solo founder warns: poor SR&ED documentation turned a claim into three weeks of archaeology

A solo founder of CloudWise, an AWS cost optimization tool, spent roughly three weeks reconstructing documentation for a Canadian SR&ED tax credit claim after filing it himself without a consultant. Canada Revenue Agency requires claimants to document technological uncertainty — what was unknown, what was attempted, and why initial approaches failed — but the founder had recorded only code commits, not the reasoning behind failed experiments. He successfully received a CRA refund following a T2 reassessment notice, but warns that rebuilding a 14-month narrative from git history and AI coding sessions was far costlier than anticipated. The core issue is that commit logs capture what changed, not why earlier approaches were abandoned — information that fades quickly from memory. He now advocates a simple habit: writing two lines per dead end on the day it occurs, which he estimates would have reduced the reconstruction effort to a few days.

0 comments Read more at DEV Community
0
ProgrammingHacker News ·

Researchers Find Prompt Injection Vulnerabilities in Non-LLM Decision Model Jev

Security researchers at Check Point have published findings showing that Jev, a typed decision model rather than a traditional language model, is susceptible to prompt injection attacks. The discovery is notable because prompt injection has largely been associated with large language models, not structured decision systems. Check Point's research suggests that the vulnerability class may be broader than previously understood, extending beyond generative AI. The findings raise new concerns about the security assumptions made when deploying non-LLM AI systems in sensitive or automated decision-making contexts.

0 comments Read more at Hacker News
0
ProgrammingHacker News ·

Oracle Invokes Force Majeure Clause Over Controversial Data Center Project

Oracle has cited a force majeure clause in an attempt to limit its legal liability related to a controversial data center project. The move involves invoking an 'act of God' or unforeseeable circumstances defense, a legal strategy typically used to excuse a party from contractual obligations. The situation has drawn attention given the scale and sensitivity of the data center involved. Details surrounding the specific circumstances Oracle is citing as grounds for the force majeure claim remain limited. The development has sparked discussion about corporate accountability in large-scale infrastructure contracts.

0 comments Read more at Hacker News
0
ProgrammingDEV Community ·

How to Enable Automatic Security Updates on Debian 13 with unattended-upgrades

The unattended-upgrades package allows Debian 13 servers to automatically download and install security updates daily without manual intervention. It is configured using dpkg-reconfigure and a settings file at /etc/apt/apt.conf.d/50unattended-upgrades, where administrators can fine-tune which update sources are included. By default, the tool covers both Debian security patches and conservative stable point-release updates, while larger software upgrades remain under manual control. Administrators can also configure automatic cleanup of unused kernels and dependencies to prevent the /boot partition from filling up. The tool supports optional automatic reboots at a scheduled time for kernel updates, though this setting requires a deliberate choice based on server availability requirements.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

HTTP 200 Status Code Alone Cannot Confirm a Credential or Secret Leak

A 200 OK response from a server only confirms that a body was returned, not that sensitive data was exposed, according to a security-focused analysis published on DEV Community. Many web applications return identical HTML shells, login redirects, or branded error pages with a 200 status, making the code unreliable as standalone evidence. Investigators are advised to send a control request to a random nonexistent path and compare its structure, content type, and URL with the suspected file to determine if the response is merely a fallback. Any credible finding should include a format signature specific to the expected resource — such as the structure of an environment file or backup archive — rather than generic terms like 'password'. Security reports should clearly separate observed data from inferred conclusions, and sensitive credentials should never be copied into public issues or screenshots.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

How to Configure Traefik v3 as a Reverse Proxy with Automatic HTTPS

Traefik v3 can be set up as a central reverse proxy that listens on ports 80 and 443, automatically routing incoming requests to the correct Docker containers based on domain labels. It integrates with Let's Encrypt to obtain and renew TLS certificates automatically, eliminating the need for manual certificate management. Requests flow through four stages — Entrypoint, Router, Middleware, and Service — a structure that also helps with debugging when routing fails. A shared Docker proxy network, optionally configured with IPv6 support, must be created in advance so Traefik can communicate with all connected containers. A valid, publicly resolving domain pointing to the server is a prerequisite, as Let's Encrypt requires HTTP access to verify domain ownership before issuing certificates.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Why Adding 86,400 Seconds Does Not Always Equal One Day in Code

A software developer has highlighted a subtle but impactful bug that affects date arithmetic in production systems twice a year, during Daylight Saving Time (DST) transitions. The issue arises because a spring-forward day is only 82,800 seconds long and a fall-back day stretches to 90,000 seconds, meaning adding exactly 86,400 seconds to a timestamp can land on the wrong calendar day. The problem affects multiple programming languages, including JavaScript, Java, Python, Go, and SQL, each handling the distinction between duration-based and calendar-aware date operations differently. Developers are advised to store timestamps in UTC or epoch seconds and perform calendar-day calculations using timezone-aware methods tied to a full zone ruleset rather than a fixed offset. Including DST boundary dates in automated test suites is recommended to catch these errors before they reach production.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Streaming Materialized Views Offer a Simpler Path to Live Read Models in 2026

Streaming materialized views allow developers to declare read models in SQL, with a streaming engine maintaining them incrementally as new events arrive, eliminating the need for custom consumer code or separate serving layers. This approach is particularly well-suited for Change Data Capture workloads, where upstream row-level changes must be reflected in near real-time for applications and dashboards. Two leading engines are compared: RisingWave, favored for its SQL-first experience, built-in CDC connectors, and simplified operations, and Apache Flink, preferred for complex, code-centric workloads requiring advanced event-time semantics and a polyglot serving layer. Despite their advantages, streaming materialized views still carry operational concerns, including unbounded state growth, schema evolution challenges, and reprocessing semantics that teams must plan for carefully. The guidance advises teams to evaluate latency requirements, state footprint, and existing infrastructure investments before choosing between the two approaches.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Restic Offers Encrypted, Off-Site Backups Beyond Provider Snapshots

Provider snapshots are not true backups because they reside on the same infrastructure and can be lost if an account is suspended or a data center fails. Restic is an open-source backup tool that creates encrypted, deduplicated repositories stored off-site, on a second server or remote storage. It supports multiple transfer protocols including SFTP, S3-compatible storage, and rclone bridges to services like Backblaze B2 and Google Drive. Users can restore individual files or full snapshots, enforce retention policies, and verify data integrity at any time. Automation via a systemd timer ensures backups run on schedule and send alerts if a backup job fails.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Brazil's DREX Digital Currency: How It Works and What Changes in 2025

Brazil's central bank is developing DREX, a central bank digital currency (CBDC) that represents the Brazilian Real in a programmable digital format with a 1:1 parity, backed by sovereign guarantee. Unlike Pix, which handles everyday payments, DREX is designed to settle complex financial operations — such as real estate, government bonds, and receivables — instantly and atomically using smart contracts. The system runs on a two-layer architecture built on Hyperledger Besu, with a wholesale layer for interbank settlement and a retail layer of tokenized deposits accessible through bank-issued digital wallets. A pilot involving over 16 financial institutions has already tested tokenized Selic Treasury bonds, achieving settlement in seconds for transactions that currently take one to two days. Expected practical benefits include lower credit costs, programmable collateral, asset fractionalization, and reduced reliance on intermediaries such as notary offices.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Atomic File Writes in Bash: How a Temp File and EXIT Trap Prevent Silent Data Corruption

A software developer demonstrated a Bash scripting pattern that prevents consumers from reading incomplete output files when a script is interrupted mid-execution. The approach uses mktemp to write data to a temporary file first, then atomically moves it to the final destination only on successful completion. An EXIT trap ensures the temporary file is deleted if the script is killed by a signal, fails due to set -e, or exits normally, leaving the previously published file intact. Testing on Bash 5.3.9 confirmed that sending SIGTERM mid-run preserved the last complete output while cleanly removing the partial temp file. The developer also highlighted a critical ordering bug in the cleanup handler: capturing the exit code must be the very first line, as running even a successful rm beforehand will overwrite the status with zero, causing monitoring tools to report false success.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Developer Finds AI Eval Was Circular After Rule Engine Labeled Its Own Test Data

A developer building SugarShield, a tool to detect hidden sugars in ingredient lists, discovered a critical flaw in their model evaluation process: most of the 59-record gold test set had been labeled using the same rule engine being tested. This circular setup caused the rule engine to score 100% accuracy — not because it performed well, but because it was essentially graded against its own answers. Meanwhile, a fine-tuned Qwen2.5-based model scored only 69% accuracy on the same set, exposing that neither result could be trusted for real-world use. The developer resolved the issue by building a completely separate 132-record evaluation set that neither system had any hand in producing. The incident highlights a broader risk in ML development: when training or labeling pipelines contaminate evaluation data, benchmark scores become meaningless.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

ML Has No Type System for Tensor Shapes — and Most Bugs Pass Silently

In machine learning engineering, tensor shapes like [B, T, d] function as the closest equivalent to type signatures, but unlike traditional software, no runtime enforces their correctness. A deliberate experiment with four shape bugs in PyTorch found that only one was caught by the runtime, with the rest failing silently. PyTorch's broadcasting rule resolves shape mismatches by aligning dimensions from the right and stretching size-1 dimensions, but it operates purely on sizes, not semantic meaning. This means two axes of identical size — such as sequence length and hidden dimension — can be silently swapped without triggering any error. The post argues that manually annotating shape signatures next to operations is the only reliable discipline available to ML engineers working with tensors.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

CrowdSec Pairs With Traefik to Block Web App Attacks Using Shared Threat Data

CrowdSec is an open-source intrusion prevention tool that complements Fail2ban by targeting HTTP-layer threats rather than SSH, working alongside the Traefik reverse proxy. It reads Traefik access logs to detect suspicious behavior such as port scans, path probing, CVE exploitation attempts, and login brute force attacks. A Traefik plugin called a bouncer enforces bans by returning a 403 Forbidden response to flagged IPs across all protected applications. CrowdSec also participates in a collaborative community blocklist, where anonymized attack data is shared globally so users benefit from threats detected elsewhere. The setup, tested with CrowdSec v1.8.1 and Traefik v3.7, requires Docker Compose and JSON-formatted access logging enabled in Traefik.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

How Cynative Builds AI Security Agents Locked to Read-Only Infrastructure Access

As AI models gain direct access to enterprise infrastructure, security teams face serious risks from agent errors such as accidental data deletion or misconfigured cloud settings. Traditional approaches mirror infrastructure into a data lake, but this introduces sync delays, cost, and data sovereignty concerns. Cynative, an infrastructure security research agent, addresses this with a two-sided architecture: a sandboxed code execution environment and an action gate that enforces read-only policies before any credentials are attached. The agent operates directly on live infrastructure but is structurally prevented from making changes or leaking data, rather than relying on filters it could potentially bypass. The tool ships as a single binary deployed within the customer's own environment, supporting any model endpoint including those hosted by major cloud providers.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

TypeSafe AI Launches Jev, a Fast-Decision Model for Smarter AI Workflows

TypeSafe AI released Jev on 15 September 2026, describing it as its first publicly available 'System One' model designed to handle rapid classification and scoring tasks within software workflows. Unlike large language models, Jev does not generate prose or code; instead, it returns structured outputs and probabilities that application logic can act upon. The model is intended to handle judgment steps — such as categorising a customer message or routing a support request — before an LLM takes over for more complex reasoning or response drafting. TypeSafe says Jev was trained using an approach it calls Reinforcement Learning for Calibrated Decisions (RLCD), though these remain the company's own descriptions of its system. The product name references economist William Stanley Jevons, reflecting TypeSafe's expectation that cheaper, faster AI decisions could make it practical to evaluate far more messages and workflow steps at scale.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

A Beginner's Roadmap to Learning Git Version Control

Git is a distributed version control system widely used in software development to track code changes and enable team collaboration without overwriting each other's work. Unlike older centralised systems, Git gives every developer a full local copy of the project history, making it fast and reliable. Beginners are advised to start with core commands such as git init, git add, git commit, and git status before progressing to branching and merging. Merge conflicts — which occur when two contributors edit the same line — are a common hurdle but a critical skill to master. Once comfortable locally, developers can extend their workflow by pushing code to cloud platforms such as GitHub, GitLab, or Bitbucket.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

How Beginners Should Choose Their First Programming Language

Choosing a first programming language is a common challenge for aspiring coders, with hundreds of options often leading to decision paralysis. Experts advise beginners to start by identifying their goals — such as web development, data science, or mobile apps — since the ideal language varies by use case. Python is widely recommended for most beginners due to its clean, readable syntax, while JavaScript is the go-to choice for those interested in web development. High-level languages are generally better for newcomers as they abstract complex tasks like memory management, allowing learners to focus on core programming concepts. A strong community ecosystem, including forums, tutorials, and documentation, is also a key factor to consider when making the choice.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Responsive Web Design in 2024: Key Practices for Multi-Device Compatibility

A technical guide published on DEV Community outlines the essential responsive web design practices developers should follow in 2024. The guide emphasizes a mobile-first approach, noting that Google's mobile-first indexing makes it critical to design for the smallest screen before scaling up. It recommends using modern CSS tools like Grid, Flexbox, and the clamp() function to build fluid, maintainable layouts without excessive code. Performance optimization is highlighted as non-negotiable, with advice to adopt next-generation image formats such as WebP and AVIF alongside responsive image sets using the srcset attribute. Accessibility is also stressed, with the guide urging developers to ensure logical tab order, screen-reader compatibility, and touch-friendly interactive elements of at least 44×44 pixels.

0 comments Read more at DEV Community
← NewerPage 960 of 3188Older →