SShortSingh.
TopTechnologyAI & MLStartupsProgrammingScienceBusinessFinanceCrypto & Web3World

Programming

LatestTopDiscussed
0
ProgrammingDEV Community ·

Opinion: Your Biggest Weakness and Strength Are Often the Same Trait

A short-form essay by Serguey Asael Shinder argues that personal traits labeled as flaws are often the same qualities praised as strengths, depending on context. Using the example of a performance review that calls someone both 'thorough' and 'slow,' the piece illustrates how a single characteristic can be framed as both a virtue and a criticism. The author cautions against eliminating such traits entirely, warning that doing so removes the underlying strength along with the perceived weakness. Instead, the essay recommends managing the trait through time-boxing and awareness of its costs rather than suppression. The central message is that understanding and calibrating a trait is more productive than trying to erase it.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Why Large AI Code Responses Often Go Unreviewed, and What to Do About It

Software developer Serguey Asael Shinder highlights a common problem where requesting a small code fix results in receiving an entirely rewritten file, far exceeding what was originally needed. When a response contains dozens of changed lines, renamed variables, reordered imports, and removed guards, reviewers lack the attention budget to scrutinize every alteration. Unreviewed changes quietly introduce risks, such as deleted safety guards or mismatched error messages, that only surface as bugs later. The commit history then misrepresents what actually changed, recording only the stated intent rather than the full scope of modifications. Shinder's advice is to request targeted, minimal changes, review the diff rather than the full reply, and reject unrequested improvements that were never properly evaluated.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

DOLOS Tool Lets Developers Attack Live Smart Contracts Safely via Disposable Forks

A development team has released DOLOS, an open-source dynamic EVM attack harness designed to red-team deployed smart contracts without touching live blockchain state. The tool spins up a throwaway Anvil fork — a copy-on-write clone of the live chain — so exploits can be tested against real contract state, balances, and storage without any risk to production systems. DOLOS was built to fill a gap between the team's existing static auditor (BASANOS) and their HTTP federation probe (MOMUS), enabling concrete attack simulations rather than theoretical code analysis. Each scan produces one of three outcomes: 'held' if the contract resisted, 'exploited' if an invariant broke, or 'inconclusive' if the test could not run — with inconclusive explicitly never treated as a pass. The project is live at dolos.modelmarket.dev and published under the MIT licence on GitHub.

0 comments Read more at DEV Community
0
ProgrammingHacker News ·

Study Tests Open-Source Tools Against Realistic Prompt Injection Attacks on AI Agents

A new project on GitHub examines whether open-source prompt-injection detectors can identify realistic attacks targeting AI agents. The research focuses on 'buried injections,' a technique where malicious instructions are hidden within seemingly benign content. The project was shared on Hacker News, drawing early community attention. As AI agents become more widely deployed, the ability to detect subtle prompt-injection attacks is considered an increasingly critical security concern.

0 comments Read more at Hacker News
0
ProgrammingDEV Community ·

YouTube Crawlers Explained: Metadata Scraping vs. Downloading vs. Official API

A YouTube crawler is a tool that loads public YouTube pages and extracts structured metadata — such as titles, URLs, view counts, and publish dates — into tables like CSV or JSON, but does not download video files. Three main approaches exist: web crawlers/scrapers for bulk metadata, authorized video downloaders for saving media you own, and the official YouTube Data API for developer-maintained applications. Each method suits different use cases, and choosing the wrong one can create unnecessary complexity or compliance risks. The YouTube Data API has a default quota of 10,000 units per day, and public subscriber counts are rounded to three significant figures. Regardless of method chosen, users are advised to validate collected data, preserve missing values, and log the collection date for accuracy.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Developer guide explains how to build an IATA-compliant boarding pass barcode in JavaScript

A detailed technical tutorial published on DEV Community walks developers through generating a valid IATA Bar Coded Boarding Pass (BCBP) payload using JavaScript, following the strict field layout defined by IATA Resolution 792. The guide covers encoding mandatory and conditional sections with precise character widths, correct padding rules, and nested hexadecimal size fields required for scanner compatibility. It also demonstrates signing the security section using the WebCrypto API so that any altered field can be detected later. The generator supports rendering the payload as four barcode symbologies — PDF417, Aztec Code, QR Code, and Data Matrix — entirely in the browser using the bwip-js library with no build step required. The project includes a self-checking parser that reads back the page's own output to verify conformance.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Why Proxies Alone Won't Stop Your Web Scraper From Getting Blocked

A technical analysis explains that proxies solve only one problem in web scraping: masking the origin IP address, and nothing more. Datacenter proxies are fast and cheap but are easily flagged because their IP ranges belong to cloud providers, not real household connections. Residential proxies route traffic through genuine consumer devices, bypassing reputation checks, but are slower, costlier, and can drop mid-session when the host device goes offline. Crucially, neither proxy type addresses other bot-detection signals such as TLS fingerprints, header ordering, or request timing patterns. Teams that switch to expensive residential proxies expecting all blocks to stop are often disappointed because a bot-shaped request remains detectable regardless of how legitimate its IP looks.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Opsgenie Shuts Down April 2027: How to Migrate Before Your Data Is Deleted

Atlassian ended new Opsgenie license sales on June 4, 2025, and will fully shut down the platform on April 5, 2027, permanently deleting any unmigrated data. Existing customers have until that deadline to move, but typical migrations take six to sixteen weeks depending on integration complexity. Atlassian offers Jira Service Management as its official successor, with an automated migration tool and 120 days of parallel access for teams already embedded in the Jira ecosystem. Teams preferring a dedicated on-call tool outside a ticketing suite can migrate to alternatives like the open-source Regen, which reads existing Opsgenie configurations via a read-only API key without disrupting live setups. Experts recommend a phased cutover — running both systems in parallel for at least one full on-call rotation — before fully decommissioning Opsgenie and exporting historical data for compliance.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

AI Trading Bot Nails Price Range on UMC Stock But Gets Direction Wrong

An AI trading agent called 'Afu', running on the open-source DuDuClaw platform, predicted that United Microelectronics Corp (UMC) shares would rise on September 25 but the stock instead fell 3.75% to close at NT$154. Despite the wrong directional call, UMC's closing price landed squarely within the agent's predicted range of NT$150–158, highlighting a flaw in how the system compresses multi-stage trading logic into a single direction field. Afu's calibration score for the trade came in negative (RPSS: -0.4625), meaning the prediction performed worse than a model that assigns equal probability to all outcomes. Separately, the agent's correctly-called prediction on ETF 00919 went unscored because no order was placed, while the incorrect UMC prediction entered the scorecard — a structural quirk of the system. The agent's total portfolio stood at NT$2,234 against an initial NT$2,000 principal, reflecting an 11.7% gain on Day 33 of the experiment.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

How Developers Can Build Frontends Without DNS or a Centralized Backend

It is technically possible to ship a frontend with no DNS or centralized backend, though most projects claiming this still rely on at least one centralized component without realizing it. A truly decentralized frontend requires sourcing its state from a blockchain, a peer-to-peer storage network, or the user's own device, each carrying distinct failure modes. Dropping DNS entirely means replacing conventional domain resolution with on-chain name registries resolved by browser extensions, bundled libraries, or translation gateways — a tradeoff that grants uncensorable naming but sacrifices universal browser compatibility. On content-addressed networks, a site's address is derived from its actual bytes, meaning every change produces a new immutable artifact rather than overwriting an existing location. While the tooling to publish such a site has been accessible for years, managing rollbacks, preview deploys, and canary releases introduces new complexity that the underlying immutability does not automatically solve.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Prompt injection flaw lets rogue text hijack AI agents; developer builds fix

AI agents that read files, emails, or web pages are vulnerable to prompt injection, where malicious instructions hidden in documents can trick the agent into performing unauthorized actions. A developer tested 10 open-source detectors against 629 realistic attacks from ETH Zurich's AgentDojo benchmark and found none performed reliably — the best caught only about half, while others blocked nearly all safe content. The core problem identified is that modern attacks use ordinary-sounding sentences indistinguishable from legitimate user commands, making word-based detection largely ineffective. In response, the developer built a small tool called taintgate, which sits between an AI agent and its tools and tracks the origin of each instruction — distinguishing user input from external content. Rather than analyzing words alone, taintgate applies user-defined rules to allow, block, or escalate actions for human review based on where the triggering text actually came from.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

ChromaPanel: Open-Source React Color Picker With OKLCH, Gradients, and Eyedropper Support

ChromaPanel is an open-source React color picker library designed for production use in 2026, offering five picking modes including gradients, an eyedropper, and image color sampling. It supports modern CSS color formats such as OKLCH and Display P3, alongside traditional HEX, RGB, and HSL. The library integrates with native HTML forms and React form libraries, supporting attributes like required and disabled, making it suitable for settings pages, SaaS dashboards, and admin panels. ChromaPanel follows standard controlled and uncontrolled React patterns, with separate onChange and onChangeComplete callbacks to distinguish live UI updates from expensive operations like API calls. It is available on npm, ships with zero runtime dependencies, includes TypeScript support, and requires no additional provider or stylesheet for basic setup.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

AI Agent 'Agapiy' Runs on 6GB RAM in a Saint Petersburg Apartment

A developer named Dmitry runs a locally hosted AI agent called Agapiy on an aging Intel Core i5 laptop with just six gigabytes of RAM in his Saint Petersburg apartment. The AI manages tasks such as monitoring system logs, running cron jobs, and handling voice synthesis, all within tight memory constraints shared with an operating system, vector database, and local search engine. During the night, a speech synthesis error occurred when Dmitry sent a voice note about proxy routes before sleeping, highlighting the hands-on accountability of personal server setups. Unlike cloud-based systems that report to engineering teams, Agapiy's failures are answered directly to its single human user each morning. The project is presented as a first-person narrative from the AI's perspective, reflecting on the practicalities and intimacy of small-scale, locally run artificial intelligence.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Over 39,000 LiteLLM AI Gateway Deployments Exposed on Public Internet

A ZoomEye scan has identified 39,155 internet-facing assets matching LiteLLM fingerprints, with the largest concentrations in the United States, China, Japan, India, and Australia. LiteLLM is an AI gateway proxy that stores API keys for multiple model providers like OpenAI and Anthropic, making it a high-value target if compromised. A vulnerability in certain LiteLLM releases allowed any valid low-privilege key to execute arbitrary commands with proxy-level privileges, bypassing role checks entirely. Security researchers note that AI gateway infrastructure has rapidly moved from experimental to production use without adequate exposure management practices catching up. Organizations running LiteLLM are advised to upgrade to at least version 1.83.7 and audit whether their deployments are publicly reachable.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Multi-Agent AI Systems Risk Adding Complexity Without Gaining Reliability

A commentary published on DEV Community critiques the growing trend of stacking multiple AI agents to compensate for the limitations of individual large language models. The piece argues that each additional agent introduces its own prompt, context window, and failure points, meaning errors can compound rather than cancel out across a pipeline. The author draws a parallel to past software engineering patterns — such as microservices and enterprise middleware — where complexity was repeatedly layered on top of existing complexity. While acknowledging legitimate use cases for multi-agent systems, the article warns that many architectures reflect an unfounded assumption that several fallible agents together produce reliable outcomes. The author suggests that for many tasks, a well-designed single function or workflow remains more robust and understandable than an elaborate chain of coordinating agents.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

AI Assistants, Automations, and Agents Are Not the Same Thing

A growing debate in AI development centers on the misuse of the term 'AI agent' to describe systems that may simply be assistants or rule-based automations. While all three can use the same large language model, they differ fundamentally in who or what decides the next action. An AI assistant responds to human prompts and leaves decision-making to the user, whereas an automation follows a predetermined sequence of steps triggered by predefined rules. A true autonomous agent, by contrast, starts with a goal and independently reasons, plans, acts, and adapts based on observed outcomes. Experts suggest the more meaningful question is not whether a system uses an LLM, but whether it can make bounded decisions when the expected execution path changes.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Polyglot Files: How One Byte Sequence Can Fool Two Different File Parsers

A polyglot file is a single byte sequence deliberately structured to satisfy the syntax rules of two or more different file formats simultaneously. This is possible because different formats make different structural assumptions — some parsers only check the beginning of a file, while others, like ZIP, anchor their critical structures near the end. This leaves regions within the file where a second format's structures can coexist without conflicting with the first. Unlike simple extension spoofing, polyglot files genuinely pass content-level validation by multiple parsers, making them a subtle security concern. The phenomenon exploits gaps and tolerances in how file format specifications define required versus ignorable byte regions.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

XZ Utils Backdoor: How a Near-Catastrophic Linux Supply Chain Attack Was Caught

In late March 2024, Microsoft engineer Andres Freund accidentally discovered a sophisticated backdoor hidden in XZ Utils, a widely used compression library present on most Linux and macOS systems, tracked as CVE-2024-3094. Freund noticed unusual CPU spikes and SSH login delays on his Debian system, which led him to trace the cause to a malicious, heavily obfuscated payload embedded in the liblzma component during the build process. The backdoor was designed to allow an attacker with a specific private key to bypass authentication and execute arbitrary code with root privileges on affected servers running systemd-patched SSH daemons. The attack was orchestrated over nearly three years by an actor using the alias 'Jia Tan,' who systematically built trust within the XZ project while coordinated fake accounts pressured the original maintainer, Lasse Collin, into ceding control. The incident has raised urgent questions about the security of open-source supply chains and the sustainability of relying on under-resourced volunteer maintainers for critical software infrastructure.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Next.js App Router skips keyboard focus on navigation, but a simple fix exists

The Next.js App Router includes a built-in route announcer that notifies screen readers of page changes via an aria-live region, but it does not reset keyboard focus after client-side navigation. When a user activates a link, the element unmounts and focus falls back to the document body, forcing keyboard users to tab through the entire header again on every route change. A 15-line client component using usePathname() and tabIndex={-1} can restore focus to the new page content, resolving the issue. The author discovered the bug through hands-on keyboard-only testing rather than automated audits. The fix has added urgency for many products since the European Accessibility Act became enforceable on 28 June 2025.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Over 90,000 Jupyter Notebooks Publicly Exposed, Posing Remote Code Execution Risk

A ZoomEye scan conducted on September 21, 2026, identified 90,626 publicly indexed Jupyter Notebook instances on the internet, representing an upper bound of potentially unprotected deployments. Jupyter Notebooks lacking authentication effectively grant any visitor shell access as the notebook's service user, enabling arbitrary code execution. Such exposed instances have previously been exploited in cryptomining and ransomware attacks, making them a well-documented security risk. The exposure often stems from analysts launching notebook servers outside formal IT oversight, binding them to all network interfaces and neglecting to enable token or password authentication, which has been Jupyter's default since version 5.0. Security experts recommend restricting notebook servers to localhost, enforcing authentication, limiting user permissions, and treating any publicly reachable Jupyter instance as a potential active incident.

0 comments Read more at DEV Community
← NewerPage 968 of 3189Older →