SShortSingh.
TopTechnologyAI & MLStartupsProgrammingScienceBusinessFinanceCrypto & Web3World

Programming

LatestTopDiscussed
0
ProgrammingDEV Community ·

Developer Turns CVSS 10.0 RCE Exploit Script into Chrome Extension Using GitHub Copilot

A security researcher revived a dormant 50-line Python proof-of-concept, originally written in December 2025 to fingerprint CVE-2025-55182, a critical unauthenticated Remote Code Execution vulnerability in React Server Components. Using GitHub Copilot as an architectural assistant, the developer spent 48 hours rebuilding the script into a Manifest V3 Chrome extension during the MLH Finish-Up-a-Thon hackathon. The upgraded tool, named RSC Fingerprint Detector, performs both passive and active reconnaissance to detect React Flight protocol vulnerabilities without triggering backend alerts. Key architectural improvements include IndexedDB-backed persistent telemetry, Shadow DOM isolation, and cross-context IPC, replacing the original synchronous, stateless design. GitHub Copilot played a central role in navigating Chrome's Content Security Policy restrictions and MV3 lifecycle constraints that had previously stalled the project.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Developer builds MCP spell-check server to keep AI writing agents style-accurate

A developer has released language-mcp, a lightweight TypeScript MCP server that gives AI writing agents local spell-checking capabilities without relying on external spelling APIs. The tool currently supports US English and Dutch, using Hunspell with bundled dictionaries — SCOWL/LibreOffice for English and OpenTaal for Dutch — to keep text processing on-device. A fifth tool queries Woordenlijst.org for detailed Dutch lexical information such as pronunciation, word forms, and hyphenation. The server flags potential spelling and style issues but leaves all editorial decisions to the AI agent, deliberately separating dictionary rules from style guidelines and human judgment. The project requires Git, Node.js 20 or later, npm, and Hunspell installed on the host machine, with Linux, macOS, and WSL supported.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

How to Patch Ubuntu Servers Safely Using Ansible and AWX in Production

A DevOps engineer has shared a structured, production-tested approach to patching Ubuntu Linux servers using Ansible playbooks orchestrated through AWX. The workflow is divided into four sequential phases — pre-check, patch, post-check, and validate — each running as a separate AWX job template controlled by Ansible tags. A manual approval node is placed between the pre-check and patch phases, allowing engineers to review disk space, kernel versions, and application status before any changes are made to live servers. The playbook stops the running application before applying updates and restarts it after reboot, with the specific stop and start commands configurable for any environment. Servers are patched one at a time using Ansible's serial setting to prevent a failure on one host from affecting others.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

How CogniPrep built a scalable content cluster by keeping copy out of components

CogniPrep, a candidate prep platform, had two product pages — /interview and /assessment-centre-practice — with no supporting content cluster, internal links, or search visibility. To fix this, the team built a structured content architecture with a clear rule: shared components may own markup, mobile behaviour, and structured data, but never the copy a visitor reads. All user-facing text is written at the page level, preventing the common failure where components accumulate variant props and default headings until no one can trace where a paragraph originates. A central metadata registry drives hub cards, sitemaps, and sibling navigation, while a single utility function generates consistent Next.js metadata across every guide in the cluster. The result is a system where adding a new guide requires only one registry entry and one folder, with build-time errors catching omissions before they reach production.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

OpenTelemetry: how the CNCF standard unified distributed tracing for all backends

OpenTelemetry (OTel) is a Cloud Native Computing Foundation project that provides a vendor-neutral set of APIs, SDKs, and the OTLP transport protocol for generating and exporting telemetry data including traces, metrics, and logs. It was formed in 2019 through the merger of two competing and incompatible projects, OpenTracing and OpenCensus, ending ecosystem fragmentation that had forced developers to choose between the two. The unified standard gained rapid industry adoption, with major observability vendors such as Datadog, New Relic, Grafana, AWS, Google Cloud, and Azure all supporting OTLP as a native ingestion protocol. A key benefit of OTel is that applications instrument their code once against its API and can later switch backend destinations purely through configuration, without rewriting instrumentation. Core concepts include spans as the basic unit of a timed operation, traces as the full end-to-end collection of spans for a single request, and W3C traceparent headers for propagating trace context across service boundaries.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Build vs Buy: Why Startups Must Treat Tech Choices as Business Decisions

Startups frequently face the dilemma of whether to build software components in-house or purchase existing solutions, a choice that carries significant business consequences. Engineering teams naturally gravitate toward building, but every hour spent on non-core infrastructure like authentication or notifications is time diverted from features that drive customer value. Experts suggest startups should only build technology that creates a genuine competitive advantage, such as a unique recommendation engine or a proprietary delivery algorithm, while buying commodity services like payments or file storage from established providers. However, over-reliance on third-party vendors carries its own risks, including rising costs at scale, vendor lock-in, and exposure to outages beyond a company's control. The guiding principle is to maximize value from every engineering hour by building what differentiates the product and buying everything else.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Developer fixes Chrome credit card autofill bug triggered by French word in form label

A developer discovered that Chrome and Android's Autofill Manager were incorrectly suggesting saved credit cards on an order-number field in a form, because the French label 'Numéro de commande' semantically resembled a card number field. Chrome deliberately ignores the autocomplete='off' attribute for payment-related fields, a documented behavior stemming from widespread misuse of the attribute on real checkout forms. Standard fixes like maxlength and inputmode='numeric' did not resolve the false positive, as Chrome's classifier performs semantic matching on label text rather than relying solely on HTML attributes. The team resolved the issue by inserting an invisible Unicode Zero Width Space (U+200B) character at the midpoint of longer words in the label, breaking the keyword pattern without altering the visual display. The developers cautioned that the fix's impact on screen readers remains untested, and advised others to treat it as a workaround rather than a fully verified accessibility-safe solution.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Developer finds real-world files expose critical flaws that 260 passing tests missed

A developer building a file-type detection app discovered significant real-world failures after running it against approximately 8,900 files from an actual Windows PC, despite the tool having 260 passing tests and a perfect benchmark score. The detector incorrectly flagged 13 Windows System32 files as dangerous, misidentified 90 Tcl message files, and froze for several minutes on a single .ini file. Investigation revealed the root causes included flawed extension assumptions, such as .msg not always being Outlook format, and a regex rule with exponential backtracking that hung the program. After fixes, overall accuracy on known extensions improved from 69.9% to 90.1%, and false alarms dropped from 105 to zero. The developer concluded that synthetic test files written to match expected formats cannot substitute for the unpredictable variety found in real-world use.

0 comments Read more at DEV Community
0
ProgrammingHacker News ·

Paper Instruments Launches Paper Office AI Document Editing Tool

Paper Instruments has introduced Paper Office, a new tool aimed at AI-assisted document editing. The product appears designed to integrate with AI agents to streamline document workflows. The announcement was shared on Hacker News, where it received limited early engagement with 3 points and no comments. Details about specific features and pricing were not available from the source material.

0 comments Read more at Hacker News
0
ProgrammingHacker News ·

Opinion: AI Systems Lack True Intent and Motivation, Analyst Argues

A viewpoint article published on I-Programmer.info challenges the notion that artificial intelligence possesses genuine intent or motivation. The piece argues that despite increasingly sophisticated outputs, AI systems do not have underlying drives or goals of their own. The distinction matters because attributing human-like motivation to AI can lead to misconceptions about how these systems actually function. The article was shared on Hacker News, where it received minimal engagement at the time of posting.

0 comments Read more at Hacker News
0
ProgrammingHacker News ·

Developer releases Search, a lightweight WebKit-based browser for macOS

A developer named Drice Roland has released Search, a small and fast web browser built for macOS using the WebKit engine. The project is open source and hosted on GitHub. It is designed to be a minimal, performant alternative to heavier mainstream browsers on Apple's desktop platform. The release was shared on Hacker News, where it received 28 upvotes at the time of posting.

0 comments Read more at Hacker News
0
ProgrammingDEV Community ·

Security Audit Flags High-Severity Vulnerabilities in HashKey Exchange Contracts

A DeFi security researcher published a vulnerability surface analysis of HashKey Exchange, a cross-chain decentralized exchange with approximately $1.73 billion in total value locked across Ethereum and several Layer 2 networks. The audit, dated September 24, 2026, examined smart contracts including the router, vault, pool, bridge adapters, and governance proxy components. Researchers identified nine vulnerability categories, with three rated high severity: a single externally owned account controlling contract upgrades without a timelock or multi-signature safeguard, re-entrancy risks in withdrawal and swap functions, and price oracle manipulation exposure on low-liquidity assets. Additional medium-severity issues include flawed cross-chain bridge message verification that could enable double-spend attacks, misconfigured access controls, and front-running risks on limit-order execution. The protocol received an overall risk score of 7 out of 10, with auditors noting that concentrated privileged control and the re-entrancy and oracle weaknesses significantly elevate its risk profile.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Developer Uses AI Assistant to Automate Multi-Generation Genealogy Research

A developer has shared an updated account of using an AI assistant to automate genealogy research, building on an earlier post that drew mixed feedback. The AI-driven workflow searches genealogy sites and official archives, transcribes records, and updates a GEDCOM family tree file, repeating the process generation by generation. To address concerns about data reliability, the developer applies the GEDCOM quality rating system, assigning lower trust scores to genealogy sites and higher scores to verified official civil or parish records. The setup uses separate skills for each genealogy and archive site, with varying technical approaches to handle bot protection, including Playwright automation and Chrome in debug mode for Cloudflare-protected sites. The developer acknowledged limitations such as AI hallucination risks and the uneven trustworthiness of genealogy platforms, but argued these are mitigated when responses are grounded in sourced data.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Apple on-device AI app lets model pick questions, not write them, for voice notes

Simple Memo, an iPhone note-taking app, uses Apple's Foundation Models framework to power a voice-driven feature called Dialogue Memo, where users speak an idea and the app asks follow-up questions to build a structured note. Early testing revealed that letting the model freely generate text produced unreliable results, including repeated commentary, unanswered questions, and mismatched language prefixes. Developers responded by restricting the model to selecting from a predefined Swift enum of question choices, with fixed, human-reviewed text mapped to each option in code. Note layout is similarly constrained: the model only returns a structural arrangement of the user's own sentences, and any invalid layout triggers a retry or falls back to a simple bullet-point format. All processing runs entirely on-device with no cloud fallback, and hard limits such as a six-question cap and a 3,600-character transcript ceiling keep the interaction concise.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Developer builds cross-device clipboard app, battles Android OS limits and distributed systems complexity

A developer created ClipboardX to solve a personal frustration of manually transferring text between an Android phone and a Windows PC via messaging apps. Android's background process restrictions blocked the original design, forcing a pivot to embed clipboard access inside a custom keyboard. Building the keyboard nearly derailed the project until the developer adopted an open-source keyboard foundation and focused only on clipboard-specific features. Once Android and Windows could communicate, deeper reliability challenges emerged around message delivery, retries, deduplication, and reconnection handling. What began as a simple side project ultimately evolved into a small distributed systems problem requiring robust state management and observability.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Developer Builds Open-Source Layer to Fix Silent State Conflicts in Multi-Agent AI

A developer has released Network-AI, an open-source coordination layer designed to address a critical failure mode in multi-agent AI production systems. The core problem occurs when multiple AI agents — such as those built with LangChain, AutoGen, or CrewAI — simultaneously read and write shared context, causing one agent's work to silently overwrite another's without throwing any errors. Network-AI sits between agents and shared state, routing all updates through an atomic propose-validate-commit cycle to prevent such conflicts. The tool supports 14 AI frameworks, including MCP, AutoGen, and OpenAI Swarm, and also offers token budget controls, role-based permissions, and a full audit trail. The project is available on GitHub under an MIT license and is positioned as a complement to the Model Context Protocol, which handles agent-to-tool connections but not agent-to-agent coordination.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Rogue AI Malware Blends LLMs With Classic Tactics, Demanding New Security Playbooks

Security communities on Hacker News and r/netsec have recently reported a surge in AI-driven threats, including ransomware, phishing bots, and self-modifying payloads powered by large language models. These rogue AI agents typically infiltrate systems via compromised credentials, then contact external LLM APIs to generate malicious scripts, establish command-and-control channels, and entrench themselves through scheduled tasks. Analysts have outlined a five-phase attack chain — infiltration, model call, payload generation, execution, and persistence — each with specific indicators to monitor. Recommended detection methods include auditd and Sysmon rules, Python log-aggregation scripts, and Bash scans for base64-encoded payloads in temporary directories. Key mitigations include blocking outbound LLM API endpoints at the firewall, enforcing strict API-key rotation and vault storage, and deploying TLS-inspection proxies to flag unusually large POST requests to known AI services.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

How Transparent Rubrics and Fixed Judges Make LLM Benchmarks More Trustworthy

Most LLM leaderboards publish scores without explaining how those numbers are generated, making rankings difficult to verify. The LFORLA RL Game Agents benchmark addresses this by using identical prompts for every model, a fixed deterministic judge, and four scored axes: reward, code validity, reproducibility, and sample efficiency. Results are logged in a public verbatim trail so anyone can audit what each model actually produced. In current standings, DeepSeek V4 Pro scored 41.75 against Nemotron 3 Ultra's 33.57, while the benchmark's own GLM 5.2 model topped the board at 78.0. The authors argue that publishing their own model's results alongside others is essential to distinguish genuine benchmarking from promotional scoring.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Semantic Caches Served Wrong Answers 30% of the Time in Ops Assistant Test

A developer experiment replayed 288 operations-related questions through a semantic cache using six embedding models and 50 different similarity thresholds. At a 0.80 similarity threshold with the bge-m3 model, the cache answered 32 percent of queries from memory but served incorrect answers roughly one in three times — for instance, giving git reset advice for a pushed commit when only a local undo had been cached. Raising the similarity threshold did not reliably fix the problem; between 0.88 and 0.92, wrong answers actually outnumbered correct ones among remaining cache hits. Across all models tested, the highest hit rate that produced zero wrong answers was just 0.7 percent, making the cache effectively useless at safe thresholds. Adding a small verification model reduced wrong answers but eliminated speed gains and made the overall setup more expensive than using no cache at all.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

How Data Modelling, Relationships and Joins Shape Effective Power BI Reports

Data modelling in Power BI involves organising tables, columns, and relationships so that multiple data sources work together accurately for analysis. Rather than storing everything in one large flat table, data is typically split into fact and dimension tables connected by keys. Three main modelling approaches exist: flat tables, star schemas, and snowflake schemas, each with distinct trade-offs in complexity and performance. The star schema, where a central fact table links to surrounding dimension tables, is widely recommended for Power BI due to its simplicity and compatibility with DAX calculations. Relationships between tables also involve cardinality, filter direction, and join types in Power Query, all of which affect how reports filter and display data correctly.

0 comments Read more at DEV Community
← NewerPage 965 of 3189Older →